When Does the Louisiana Data Privacy Act Take Effect for Marketers?

The Louisiana Data Privacy Act takes effect January 1, 2027. Louisiana's governor signed the law, Senate Bill 386, on May 29, 2026, making it the latest state to enact a comprehensive consumer privacy law that directly affects targeted advertising.

Who Has to Comply

The law applies to businesses that meet any one of three thresholds: more than $25 million in annual gross revenue, processing the personal data of 75,000 or more Louisiana consumers, households, or devices, or deriving 50% or more of gross revenue from selling personal data. State agencies, HIPAA-covered entities, and GLBA-regulated financial institutions are exempt.

What It Means for Targeted Advertising

Covered businesses must let consumers opt out of targeted advertising, the sale of their personal data, and certain types of profiling used for decisions with legal or similarly significant effects. The law also requires businesses to honor universal opt-out signals — such as Global Privacy Control — sent from a consumer's browser, as long as that signal reflects an affirmative choice the consumer made rather than a vendor's default setting.

Sensitive Data Needs Affirmative Consent

Processing sensitive personal data — including biometric data, precise geolocation, and data from a known child under 13 — requires affirmative consumer consent before it happens, not an opt-out after the fact. Heightened-risk processing activities, including targeted advertising, data sales, and certain profiling, also require a documented data protection assessment, though assessments aren't required retroactively for processing completed before the law takes effect.

The Cure Period Has a Built-In Expiration

Businesses get a 30-day period to fix a violation before the Louisiana Attorney General can pursue enforcement — but only temporarily. That cure period sunsets on July 31, 2027, seven months after the law itself takes effect. After that date, the Attorney General can act on violations without giving businesses advance notice to fix them first. The law gives consumers no private right of action; enforcement is exclusively through the Attorney General.

Processor Contracts Need to Be in Writing

Any business that shares consumer data with a third-party processor — an ad platform, an email service provider, a data enrichment vendor — needs a written contract in place governing that processing relationship once the law takes effect. This mirrors the processor-contract requirement found in most other comprehensive state privacy laws, so businesses that are already compliant with Virginia's, Colorado's, or Connecticut's laws likely have most of the paperwork structure in place already; the main work is confirming Louisiana-specific terms are reflected in those agreements before January 1, 2027.

Bottom Line

If retargeting or lookalike campaigns reach Louisiana consumers, have opt-out handling and browser opt-out signal detection working before January 1, 2027, and don't plan around the 30-day cure period as an ongoing safety net — it disappears on July 31, 2027.

Sources: Louisiana SB 386 (Louisiana Data Privacy Act), enacted May 29, 2026; Bass Berry & Sims, "Louisiana Joins the Second Line of States With Comprehensive Privacy Laws."