Louisiana Data Privacy Act: What Your Business Needs to Know Before January 2027

Louisiana is the latest US state to pass a comprehensive consumer privacy law. Senate Bill 386, the Louisiana Data Privacy Act, has cleared both chambers of the legislature and is awaiting Governor Jeff Landry's signature. Once signed, it takes effect January 1, 2027.

If your business collects data about Louisiana residents and meets the thresholds below, you have new legal obligations. Here is everything you need to know, including how the law compares to CCPA and what to do before the deadline.

Louisiana SB 386 creates Chapter 20-B of Title 51 of Louisiana's Revised Statutes (sections 1776 through 1780). It follows the broad structure of other state privacy laws passed in recent years, granting consumers a set of enumerated rights and placing corresponding obligations on the businesses that collect their data. The law is part of a rapidly growing body of US state privacy legislation. As of 2026, more than 20 US states have enacted comprehensive consumer privacy laws, with more advancing through legislatures. Louisiana joins states including California, Virginia, Colorado, Connecticut, Texas, Oregon, and Montana in creating enforceable consumer data rights.

Who does the Louisiana Data Privacy Act apply to?

The law covers for-profit businesses that do business in Louisiana AND satisfy at least one of the following thresholds:

Meeting just one threshold is enough to bring your business within scope.

Who is exempt? State agencies, nonprofits, financial institutions regulated under the Gramm-Leach-Bliley Act, HIPAA-covered healthcare entities, institutions of higher education, and electric public utilities are all excluded. Certain data categories are also exempt, including protected health information, employee and contractor data, and data regulated under the Fair Credit Reporting Act.

What rights do Louisiana consumers have?

The Louisiana Data Privacy Act creates five enforceable consumer rights. Every covered business must build processes to facilitate them.

Businesses must respond within 45 calendar days, extendable once by 45 more days. Responses are free of charge up to twice annually per consumer. Businesses must offer at least two secure submission methods and cannot require consumers to create a new account to exercise their rights.

How Louisiana compares to other US state privacy laws

Louisiana SB 386 does not exist in isolation. More than 20 US states now have active comprehensive consumer privacy laws. Here is how Louisiana stacks up against the major ones:

One pattern is clear: GPC is becoming the industry standard. As of 2026, 12 US states require businesses to honor GPC opt-out signals, up from just one (California) in 2020. Louisiana joins this majority. If you have not implemented GPC signal detection, you are now out of step with the direction of US privacy law as a whole.

A second pattern: cure periods are shrinking. Early laws gave businesses long grace windows. Louisiana's cure window exists only for the first seven months of the law, then closes permanently. The direction is toward stricter enforcement, not more leniency.

Louisiana Data Privacy Act vs CCPA: key differences

CCPA is the most searched consumer privacy law in the US. Here is a direct comparison between Louisiana's law and California's framework.

The practical upshot: if your business is already operating under CCPA, the Louisiana Data Privacy Act will feel familiar. The core rights framework is similar. The main differences are that Louisiana uses a consent model for sensitive data (California uses an opt-out limitation model), Louisiana has no dedicated privacy enforcement agency, and Louisiana's threshold for data volumes is 75,000 rather than California's 100,000. Businesses already compliant with CCPA/CPRA will have less ground to cover, but they are not automatically covered for Louisiana.

Common privacy compliance failures: what the data shows

Understanding the most common failure points helps you prioritize. Here is what enforcement data and platform observations reveal:

1. GPC signals ignored or mishandled

Failure to honor GPC signals is the most common compliance failure Clym observes across its platform in 2026. This aligns with broader enforcement trends: California, Colorado, and Connecticut conducted a coordinated GPC enforcement sweep in September 2025, resulting in multiple fines. Tractor Supply was fined $1.35 million in September 2025, specifically for failing to honor consumer opt-out mechanisms.

The scale of the GPC gap is significant. As of March 2026, 648,833 domains have implemented GPC globally, yet the retention rate sits at just 47.8%, meaning roughly half of sites that once implemented GPC support have let it lapse. Many businesses add GPC support during a compliance push, then fail to maintain it through website updates and tech stack changes.

2. Consent banners firing before consent is given

Misconfigured consent banners that fire tracking cookies before the user has clicked accept are the second most common issue Clym identifies when auditing new clients. This is a technical error with direct legal consequences: loading a tracking script before consent is obtained is a clear violation of consent-first requirements.

3. Data subject request response failures

Businesses without dedicated DSR workflows routinely miss the 45-day response deadline. The volume of requests is often underestimated. Once a law takes effect and consumers are aware of their rights, request volumes increase, particularly for deletion and opt-out requests. Manual handling at any meaningful scale is not sustainable.

4. Dark patterns in consent interfaces

Consent obtained through dark patterns is explicitly invalid under the Louisiana Data Privacy Act. The law uses the FTC's definition of dark patterns. This includes interfaces designed to make opting out harder than opting in, confusing toggle logic, pre-ticked checkboxes, and 'consent walls' that block access unless users accept tracking.

How Clym can support your Louisiana Data Privacy Act preparation

The Louisiana Data Privacy Act creates obligations that are hard to manage manually at scale. Clym is a consent management and privacy compliance platform that addresses the core technical requirements from a single dashboard, supporting 150+ global regulations, including US state laws.

Consent management and GPC detection

Clym's consent management platform deploys a configurable consent banner that detects and honors GPC signals automatically, without requiring manual handling of individual browser-level opt-out requests. Clym's RealtimeCompliance™ technology identifies third-party scripts and cookies present on your site, so you know what is loading and when. It also integrates with the Global Privacy Platform (GPP) framework, which means that consent signals communicate correctly to ad platforms and analytics tools.

If you are not currently certain whether your website honors GPC, Clym's GPC platform is built specifically to close that gap.

Data subject request management

Clym's data subject request management gives consumers a structured submission portal and gives your team a tracked response workflow with deadline monitoring. Every request is logged and documented, giving you an audit trail for the Attorney General if ever needed. The 45-day clock is tracked automatically.

Privacy notice generation

Clym generates and/or hosts your privacy notice, covering the data categories you process, your third-party sharing practices, how consumers can exercise their rights, and your appeals process. When regulations change, your notice updates accordingly.

Multi-regulation coverage

If your business operates in multiple states, Clym manages your obligations across state lines from a single platform. You do not run separate tools for California, Texas, Colorado, and Louisiana. One dashboard, one consent configuration layer, updated as new laws take effect.

Conclusion

The Louisiana Data Privacy Act is straightforward in its core requirements: know what data you hold, give consumers the ability to access and control it, honor opt-out signals, including GPC, get consent for sensitive data, update your privacy notice, and document your processing activities. None of these obligations is unreasonable. But all of them require deliberate action.

The effective date of January 1, 2027, looks far away. It is not. Building consumer rights infrastructure, auditing your consent setup, and reviewing processor contracts takes time. Businesses that start now have the runway to do this properly. Businesses that wait until Q4 2026 will be scrambling.

Louisiana is also not the last state on this trajectory. The pattern across 20+ state laws is clear: more consumer rights, GPC as standard, shrinking cure periods, and increasing enforcement appetite. Your privacy compliance programme needs to be built to scale across states, not rebuilt for each one.