PRIA Logo™
LouisianaSB 3862026 Regular SessionSenateWALLET

IDENTITY DATA: Provides for opting out of providing personal information on social media websites. (1/1/27)

Sponsored By: Patrick Connick (Republican)

Signed by Governor

CommerceCommerce, Consumer Protection and International Affairs

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

9 provisions identified: 3 benefits, 1 costs, 5 mixed.

Louisiana residents gain control over data

Beginning January 1, 2027, Louisiana residents can ask covered businesses whether they process their data, and access, correct, or delete it. Residents can get a portable copy of data they provided when it is digital and transfer is technically feasible. They can opt out of targeted ads, data sales, and profiling used for decisions with legal or similarly significant effects. Parents or guardians can act for known children, and contracts cannot waive or limit these rights. Residents can use authorized people or qualifying technology for ad and sale opt-outs; businesses must verify identity, Louisiana residency, and authority. Technology must reflect a clear, freely chosen action rather than a default setting; unclear, unverifiable, unprocessable, or legally nonqualifying agent requests can be declined.

Sensitive data needs consent and notices

Beginning January 1, 2027, covered sellers need prior consent to sell sensitive personal data. Covered businesses generally need consent to process sensitive data, including health diagnoses, identifying genetic or biometric data, and precise location. Known children’s sensitive data follows applicable federal child-privacy rules; qualifying federal parental-consent compliance satisfies this law’s parental-consent requirement. Clear privacy notices must explain data categories, purposes, rights, appeals, request methods, and applicable sale categories and buyers. Businesses must disclose data sales and targeted ads and explain opt-outs. Sensitive or biometric data sellers must also post “NOTICE: We may sell your sensitive personal data.” or “NOTICE: We may sell your biometric personal data.”

Businesses must protect data, with exceptions

Beginning January 1, 2027, covered businesses must collect only data reasonably needed for stated purposes and maintain reasonable security. They need consent for uses that are not reasonably necessary or compatible with those purposes, and cannot violate anti-discrimination laws. Businesses generally cannot punish residents for exercising privacy rights by charging more or providing worse goods or services. However, different prices, services, or quality are allowed for the specified opt-out right and voluntary loyalty, rewards, premium-feature, discount, or club-card programs.

Louisiana privacy rights have coverage limits

Beginning January 1, 2027, the law covers businesses operating in Louisiana that meet at least one test. They must have over $25 million in yearly gross revenue; commercially buy, receive, sell, or share information about at least 75,000 consumers, households, or devices yearly; or get at least 50% of yearly revenue from selling personal information. Exempt entities include state and local agencies, specified financial institutions, federally regulated health entities, nonprofits, colleges, electric public utilities, and registered public-opinion poll conductors. Exempt data includes specified health, research, credit-reporting, motor-vehicle, education, farm-credit, employment, emergency-contact, and benefits-administration information. Purely personal or household activities are also excluded, so these protections do not cover every use of residents’ data.

Businesses must review risky data uses

Beginning January 1, 2027, covered businesses must document risk reviews for targeted ads, data sales, sensitive-data processing, and other high-risk uses. Reviews also cover profiling that foreseeably risks unfair treatment, unlawful unequal effects, injury, serious privacy intrusion, or other substantial harm. Reviews must weigh benefits against risks and consider safeguards, consumer expectations, and context; comparable activities or reviews under another law can share or satisfy a review. The requirement is not retroactive, and confidential reviews are exempt from public inspection but available to the attorney general through investigative demands. Data service providers must follow business instructions and help with requests, security, breach notices, and reviews when reasonably practicable. Written contracts must cover processing, confidentiality, compliance information, subcontractors, and deletion or return when services end unless retention is legally required; qualified independent assessment reports must be provided on request.

Privacy rights allow essential data uses

Beginning January 1, 2027, privacy rights do not block uses needed for legal compliance, government inquiries, legal claims, or law-enforcement cooperation. Exceptions also allow requested services, urgent life or safety protection, fraud prevention, security, and system integrity. Public-interest research needs independent oversight and must follow applicable ethics and privacy laws. Internal product development, recalls, error repair, and operations must fit consumer expectations, an existing relationship, or a requested service or contract. Exempt uses must be necessary, proportionate, and limited to needed data; businesses must prove the exemption applies.

Data requests get deadlines and appeals

Beginning January 1, 2027, covered businesses must generally offer two secure request methods, including a website option when they have a website. Online-only businesses with direct consumer relationships may use email; businesses cannot require a new account, but may require an existing account. Businesses must respond within 45 calendar days, with one extension of up to 45 days explained during the first period. Up to two requests yearly are free; businesses may charge a reasonable fee or refuse clearly unfounded, excessive, or repetitive requests if they prove the reason. Requests require identity verification, and businesses may seek more information or refuse requests they cannot authenticate. Denials must explain why and how to appeal; businesses must issue written appeal decisions within 60 calendar days and provide an online attorney-general complaint option after denial. For deletion requests involving data from another source, businesses may keep minimal information to preserve deletion or an opt-out.

Masked data gets safeguards and exceptions

Beginning January 1, 2027, businesses holding deidentified data must reasonably prevent links to individuals and publicly promise not to reidentify them. They must bind recipients to the law and reasonably monitor and address broken commitments when sharing deidentified or coded data. Some consumer-rights and business-duty rules do not apply to coded data when identifiers are separate and effective controls block access. Businesses can decline requests they cannot reasonably match to data, or that are unreasonably burdensome, only with added limits. The data must not identify or contact the resident, connect to other data, or be sold or voluntarily shared outside allowed exceptions.

State enforces privacy, with remedy limits

Beginning January 1, 2027, the Louisiana attorney general enforces the law and posts online information about rights and business duties. Violations count as unfair or deceptive trade practices and face state-law penalties, but the referenced private lawsuit rights are excluded. From January 1 through July 31, 2027, the attorney general must give at least 30 calendar days’ written notice before investigating. An investigation cannot start if the business fixes the violation within 30 days, supplies a written statement and proof, and makes needed policy changes. Enforcement proceeds must support consumer protection or education; the law specifies no amount.

Sponsors & Cosponsors

Sponsor

  • Patrick Connick

    Republican • Senate

Cosponsors

  • Cameron Henry

    Republican • Senate

  • Edward J. Price

    Democratic • Senate

  • Glen Womack

    Republican • Senate

  • Gregory A. Miller

    Republican • Senate

  • Jay Luneau

    Democratic • Senate

  • Jeremy Stine

    Republican • Senate

  • Katrina R. Jackson-Andrews

    Democratic • Senate

  • Larry Selders

    Affiliation unavailable

  • Regina Barrow

    Democratic • Senate

  • Sam Jenkins

    Democratic • Senate

  • Tehmi Jahi Chassion

    Democratic • House

Roll Call Votes

All Roll Calls

Yes: 139 • No: 0

House vote • 5/18/2026

Read third time by title, amended, roll called on final passage, yeas 94, nays 0. Finally passed, ordered to the Senate.

Yes: 94 • No: 0

House vote • 5/11/2026

Reported with amendments

Yes: 9 • No: 0

Senate vote • 4/8/2026

Senate floor amendments read and adopted. Read by title and passed by a vote of 36 yeas and 0 nays; ordered reengrossed and sent to the House. Motion to reconsider tabled.

Yes: 36 • No: 0

Actions Timeline

  1. Signed by the Governor. Becomes Act No. 502.

    5/29/2026Senate

  2. Effective date 1/1/2027.

    5/29/2026Senate

  3. Signed by the Speaker of the House.

    5/25/2026House

  4. Enrolled. Signed by the President of the Senate.

    5/21/2026Senate

  5. Sent to the Governor by the Secretary of the Senate.

    5/21/2026Senate

  6. Scheduled for floor debate on 05/18/2026.

    5/18/2026House

  7. Read third time by title, amended, roll called on final passage, yeas 94, nays 0. Finally passed, ordered to the Senate.

    5/18/2026House

  8. Received from the House with amendments.

    5/18/2026Senate

  9. Read by title, amended, passed to 3rd reading.

    5/13/2026House

  10. Reported without Legislative Bureau amendments.

    5/12/2026House

  11. Reported with amendments (9-0). Referred to the Legislative Bureau.

    5/11/2026House

  12. Read by title, under the rules, referred to the Committee on Commerce.

    4/14/2026House

  13. Received in the House from the Senate, read by title, lies over under the rules.

    4/13/2026House

  14. Senate floor amendments read and adopted. Read by title and passed by a vote of 36 yeas and 0 nays; ordered reengrossed and sent to the House. Motion to reconsider tabled.

    4/8/2026Senate

  15. Read by title. Committee amendments read and adopted. Ordered engrossed and passed to third reading and final passage.

    4/7/2026Senate

  16. Reported with amendments.

    4/1/2026Senate

  17. Introduced in the Senate; read by title. Rules suspended. Read second time and referred to the Committee on Commerce, Consumer Protection and International Affairs.

    3/9/2026Senate

  18. Prefiled and under the rules provisionally referred to the Committee on Commerce, Consumer Protection and International Affairs.

    2/27/2026Senate

Bill Text

Related Bills

Back to State Legislation