Key takeaways

Governor Jeff Landry signed the Louisiana Data Privacy Act (SB 386) into law on May 29, 2026.

The new law takes effect on January 1, 2027, making Louisiana the 22nd state with a comprehensive privacy statute.

The statute applies to businesses that meet specific revenue thresholds or other qualifying conditions.

The legislation mirrors the framework of comprehensive privacy laws recently enacted in states like Texas.

The Enactment

On May 29, 2026, Louisiana Governor Jeff Landry signed SB 386 (Louisiana) into law, officially creating the Louisiana Data Privacy Act. As first reported in legal media on or about June 4, 2026, the legislation establishes a comprehensive consumer privacy framework for the state. The new statutory requirements are scheduled to take effect on January 1, 2027.

By enacting this legislation, Louisiana becomes the 22nd state in the nation to adopt a comprehensive consumer privacy law. The statute targets companies that process consumer data, establishing jurisdiction over entities that meet specific revenue thresholds or satisfy other statutory conditions. Rather than inventing a wholly unique regulatory scheme, the Louisiana legislature modeled the new framework on legislation recently enacted in states like Texas.

Why It Matters

The passage of the Louisiana Data Privacy Act represents a continuation of the state-by-state approach to data regulation in the United States. Because Congress has not passed a preemptive federal privacy statute, state legislatures continue to fill the regulatory void. Louisiana joining this group means nearly half of all U.S. states now impose distinct, albeit overlapping, obligations on businesses handling consumer data.

The rapid succession of state privacy laws creates a compounding compliance burden. Even when a new statute closely tracks an existing law, corporate legal departments cannot simply assume identical obligations. They must conduct a comparative analysis to identify minor deviations in statutory language, consumer response requirements, or vendor contract provisions. The reliance on specific revenue thresholds also requires continuous monitoring; a company that falls below the threshold in 2026 might exceed it in 2027, suddenly triggering a massive compliance project. Consequently, the enactment of SB 386 (Louisiana) demands proactive, ongoing financial and operational monitoring from businesses operating in the Gulf South.

Who Should Care

For lawyers

Corporate counsel, privacy officers, and outside compliance advisors must immediately begin assessing their clients' exposure to the Louisiana Data Privacy Act. The primary task is evaluating the specific revenue thresholds and other qualifying conditions to determine if the statute applies to a given entity. If a company falls within the scope of SB 386 (Louisiana), legal teams have until January 1, 2027, to update privacy notices, implement consumer request protocols, and revise vendor contracts. Lawyers advising regional businesses in the South should specifically analyze the overlap between the Louisiana and Texas frameworks to create unified compliance strategies that satisfy both jurisdictions simultaneously.

For consumers

Residents of Louisiana will soon gain new legal rights regarding their personal information. When the law takes effect in 2027, consumers will have statutory mechanisms to control how qualifying businesses collect, use, and share their data. While the exact procedures will depend on how companies implement their compliance programs, the law generally shifts power back to the public, allowing individuals to demand transparency from the companies monetizing their digital footprints.

Legal Background

Before the enactment of SB 386 (Louisiana), Louisiana lacked a comprehensive statutory framework governing consumer data privacy. The state relied on a patchwork of sector-specific laws and general consumer protection statutes to penalize deceptive trade practices. This approach mirrored the historical baseline across the United States, where data privacy was largely unregulated outside of specific industries like healthcare and financial services.

The absence of a unified federal standard has forced companies to manage a fragmented regulatory environment. When California passed the first comprehensive state privacy law, it set a high compliance bar. Subsequent states diverged, creating a spectrum of regulatory approaches. The Texas model, which Louisiana has now embraced, represents a middle ground. It provides consumers with significant rights regarding data access, correction, and deletion, while offering businesses clear, objective applicability triggers based on revenue rather than vague operational definitions. By relying on specific financial metrics, the legislature provides a bright-line rule for corporate counsel attempting to determine if the law applies to their clients.

What the Legislature Did

In drafting and passing SB 386 (Louisiana), the Louisiana legislature chose to align the state with the growing coalition of jurisdictions utilizing the Texas framework. Lawmakers structured the Louisiana Data Privacy Act around specific applicability triggers. Rather than applying the law to any entity conducting business in the state, the legislature restricted the statute's reach to companies meeting specific revenue thresholds or other defined conditions.

The legislature also built in a significant grace period for businesses. By setting the effective date for January 1, 2027, lawmakers provided companies with more than six months from the May 29, 2026, signing date to audit their data practices and build the necessary compliance infrastructure. The statutory text focuses on establishing consumer rights and business obligations that parallel those found in neighboring jurisdictions, ensuring that Louisiana integrates smoothly into the broader regional regulatory environment.

How It May Be Applied

As January 1, 2027, approaches, the primary challenge for businesses will be statutory interpretation regarding the applicability thresholds. Companies will need to calculate their revenues and assess their data processing volumes to determine if they meet the specific conditions outlined in SB 386 (Louisiana).

Because the Louisiana law shares a framework with Texas, practitioners expect that enforcement and compliance norms will similarly align. Companies that have already mapped their data inventories for Texas compliance will likely use those same maps to satisfy Louisiana's requirements. Open questions remain regarding how state regulators will interpret specific consumer requests and whether the attorney general will prioritize enforcement against out-of-state tech companies or focus on local data brokers. The extended lead time until the 2027 effective date gives regulatory bodies time to issue any necessary guidance, and gives businesses time to pressure-test their consumer response portals.

Statutory Framework Comparison

Feature	Pre-2027 Louisiana Law	Louisiana Data Privacy Act (SB 386)
Comprehensive Privacy Framework	None	Established
Applicability Triggers	N/A	Specific revenue thresholds or other conditions
Legislative Model	N/A	Similar to Texas privacy legislation
Effective Date	N/A	January 1, 2027
National Rank	N/A	22nd state to adopt such a law

Plain-English Callout

What this means for everyday business: If your company collects data from Louisiana residents, you need to check your revenue and data-processing volume. The new Louisiana Data Privacy Act does not target small local shops; it focuses on companies that hit specific financial or operational benchmarks. If your business meets those thresholds, you have until the start of 2027 to figure out what consumer data you hold, how you use it, and how you will let consumers access or delete it. Because the rules are similar to those in Texas, companies already following Texas law are well on their way to being ready for Louisiana.

This article is general legal information and commentary about legal developments. It is not legal advice, does not address your specific situation, and is not a substitute for advice from a licensed attorney. Reading this article and contacting us through this website do not create an attorney-client relationship.

Sources & authorities

SB 386 (Louisiana) — source

Louisiana Enacts Comprehensive Data Privacy Act

Key takeaways