Louisiana's New Privacy Law: What Small Businesses Must Do by January 1, 2027

On May 29, 2026, Louisiana's governor signed SB 386, the Louisiana Data Privacy Act (LDPA) — making Louisiana the third state that year to enact a comprehensive privacy law, alongside Oklahoma and Alabama. It takes effect January 1, 2027, the same day as Oklahoma's law.

What makes Louisiana interesting isn't the date — it's the thresholds. Where most states use consumer-count tests, Louisiana borrowed California's model. That changes the applicability math in ways worth understanding.

Who the law covers

The LDPA applies to a person or entity that does business in Louisiana and meets any one of these three triggers:

• Annual gross revenue over $25 million, or
• Annually buys, receives, sells, or shares the personal information of 75,000 or more Louisiana consumers, households, or devices for commercial purposes, or
• Derives 50% or more of annual revenue from selling consumers' personal information.

Compare that to the standard model (100,000 consumers, or 25,000 + 50% revenue from data sales) and you can see the difference: Louisiana's revenue prong ($25M) will catch mid-size companies that the consumer-count test wouldn't, while its 75,000-consumer prong sits below the usual 100,000.

For most small businesses, the practical read is straightforward: under $25M in revenue and under 75,000 Louisiana consumers means you're out. But if you're a growing e-commerce business doing real volume in Louisiana, run the numbers — don't assume.

What's exempt

Louisiana's exemption list will look familiar:

• Nonprofits and higher-education institutions are exempt.
• Regulated data: financial institutions and GLBA-covered data, HIPAA-covered entities and protected health information.
• Employment context: data about job applicants, employees, and contractors acting in those roles.
• Commercial-context individuals: people acting in a business capacity, not as consumers.

Enforcement: AG only, with a shrinking cure period

Like its 2027 siblings, Louisiana gives enforcement exclusively to the state attorney general — no private lawsuits. Before acting, the AG must give notice and a 30-day opportunity to cure. But note the catch: the cure period sunsets on July 31, 2027 — seven months after the law takes effect. After that, the AG can proceed without offering a cure first.

That sunset is the quiet deadline inside the deadline. It means the grace period for honest mistakes is real but short — another reason to get the basics right in the first half of 2027 rather than scrambling later.

What covered businesses need to do

The obligations track the standard state-privacy playbook:

• Consumer rights: access, deletion, correction, portability, and opt-out of sales, targeted advertising, and profiling.
• Privacy notices that actually describe your practices.
• Opt-out mechanisms including honoring universal opt-out signals.
• Reasonable data security and written processor contracts.
• Sensitive data: opt-in consent before processing it.

A realistic prep timeline

What "doing business in Louisiana" means in practice

The LDPA's trigger isn't just the numbers — it's doing business in Louisiana plus the numbers. For most small businesses, "doing business" here means the ordinary things: selling to Louisiana customers, shipping there, running ads targeted at the state, or having any physical footprint (office, employee, warehouse).

Where it gets interesting is the edge cases. A purely passive website that happens to get Louisiana visitors? Probably not "doing business." A Shopify store that ships 2,000 orders a year to New Orleans and runs Meta ads geo-targeted at Louisiana? That's doing business — and then it's just the threshold math. The pattern across states is consistent: intentional commercial activity directed at the state is the test, not accidental web traffic.

If you're unsure which side of that line you're on, that's a cheap question for a Louisiana attorney and an expensive one to guess wrong.

Louisiana vs. the standard model

The practical effect: Louisiana's $25M revenue prong is the one to watch if you're a mid-size company. You can be well under every consumer-count threshold in the country and still be covered in Louisiana on revenue alone. That's unusual — and it's why Louisiana deserves its own applicability check rather than a hand-wave.

Frequently asked questions

We do $30M in revenue but have almost no Louisiana customers. Covered?

On the revenue prong alone: the law applies to entities doing business in Louisiana that exceed $25M in annual gross revenue. "Doing business in Louisiana" still has to be true — revenue alone, without Louisiana business activity, isn't enough. But if you sell into Louisiana at all, take this seriously and get advice.

What's the deal with the cure period ending?

Louisiana gives a 30-day opportunity to cure — but only until July 31, 2027. After that sunset, the AG can proceed directly to penalties. It's the shortest grace window of the 2027 states, which makes front-loading your compliance the smart play.

We're a nonprofit. Are we exempt?

Yes — Louisiana exempts nonprofits and higher-education institutions, along with the usual regulated-data carve-outs (GLBA, HIPAA) and employment-context data. Note that not every state is this generous (New Hampshire and Delaware notably aren't), so don't carry the assumption across state lines.