iQ Cookie State Law Series
Cookie & Privacy Law in Louisiana
Law not yet in effect. Louisiana’s LDPA becomes enforceable January 1, 2027. This guide reflects the law as signed, current as of August 2026. Check back closer to the effective date, since implementing regulations or clarifications could still emerge before then.
Educational purposes only — not legal advice. This guide is intended to help you understand Louisiana’s data privacy law as it relates to cookie consent and website compliance. Laws change, and your specific situation may vary. Always consult a qualified legal professional before making compliance decisions. iQ Cookie is a technology tool, not a law firm.
The short version
Louisiana’s LDPA (SB 386) was signed in 2026 as the 22nd comprehensive state privacy law and takes effect January 1, 2027. Its early cure period is unusually tight: 30 days’ notice is only available from the effective date through July 31, 2027, then disappears for good. The bill also has a notable legislative history — the Senate’s original version explicitly referenced "artificial intelligence systems" in processor obligations, but the House stripped that language before final passage. The enacted law regulates AI-driven decisions only indirectly, through its existing profiling and automated-decision provisions.
Louisiana does not have a separate cookie law. Cookie compliance flows from the LDPA itself — its opt-out and sensitive-data rules apply directly to cookies and tracking technology.
Who does it apply to?
The LDPA covers businesses that conduct business in Louisiana or target Louisiana residents, and meet at least one of these thresholds:
Annual gross revenue exceeding $25 million.
Annually buys, receives, sells, or shares personal data of 75,000 or more consumers, households, or devices.
Derives 50% or more of annual revenue from selling personal data.
State agencies, GLBA financial institutions, HIPAA entities, nonprofits, higher-education institutions, electric utilities, and registered polling organizations are exempt at the entity level.
Consumer rights
Once in effect, Louisiana residents whose data is covered by the LDPA will be able to:
Businesses must respond within 45 days, extendable once by 45 more. There is no private right of action — only the Attorney General can enforce.
What makes Louisiana different
AI-specific language was deliberately removed before final passage. The Senate’s version required processors to help secure data used by AI systems, borrowing phrasing from Texas law. The House rewrote that provision and deleted the AI reference entirely — a choice one legal analysis called deliberate, not a technical fix. AI-driven decisions are still covered, but only through the law’s general profiling and automated-decision rules.
The cure period has a hard 7-month window, then vanishes. The 30-day cure opportunity exists only from January 1 through July 31, 2027. After that date, it does not renew or become discretionary — it is simply gone.
A broader definition of "sale" than Virginia’s model. Louisiana defines sale to include disclosure for "monetary or other valuable consideration," not just money changing hands — a wider net than the Virginia-model standard several earlier states in this series use.
GPC recognition is required, with conditions. Controllers must honor universal opt-out mechanisms, but businesses may decline signals lacking clear technical specifications, or where they don’t process similar requests for other state laws — a more conditional GPC mandate than most peer states.
Elder and disabled consumers get enhanced penalties. On top of the standard $5,000 base penalty per violation, an additional $5,000 applies when a violation targets elderly individuals or people with disabilities — a protection not seen elsewhere in this series.
Sensitive data & children
Processing sensitive data will require opt-in consent before any collection begins. Sensitive data includes:
Data from known children under 13 must be processed in compliance with COPPA. The law does not impose heightened protections for the 13–17 age band beyond the general consumer rights framework — check final agency guidance closer to the effective date for any updates.
What this will mean for your cookies
| Cookie / data type | Requirement | What to do |
|---|---|---|
| Sensitive / biometric data cookies | Opt-in required | Gate these behind affirmative consent; add the required sale-notice sentence for sensitive/biometric sales. |
| Sale / targeted advertising cookies | Opt-out required | Provide a clear opt-out mechanism. |
| GPC / universal opt-out signals | Required, with exceptions | Build GPC support; confirm your tool meets the technical-specification bar. |
| Profiling / automated-decision cookies | Opt-out required | Offer an opt-out for profiling with legal or significant effects, including AI-driven decisions. |
| Any cookies — known children | COPPA-aligned consent | Verifiable parental consent required. |
Enforcement
The Louisiana Attorney General will have exclusive enforcement authority under the state’s Unfair Trade Practices and Consumer Protection Law. Curing during the initial window requires written confirmation, supporting documentation, and preventive policy changes — not just a fix.
Your action checklist
With the effective date still months away, start now — the cure window is short and time-limited once it begins:
Check your thresholds now. $25 million in revenue, 75,000+ consumers/households/devices, or 50%+ revenue from data sales — any one path puts you in scope.
Build toward compliance well before January 1, 2027. The cure period only runs through July 31, 2027 — a shorter runway than most peer states offer.
Prepare the sensitive/biometric sale-notice language. Louisiana requires the same prescribed notice pattern Texas uses.
Test your GPC handling against the technical-specification requirement. Confirm your consent tool’s signal meets whatever standard final guidance settles on.
Flag elder/disabled consumer protections in your compliance review. The enhanced penalty tier is unique to Louisiana in this series.
Recheck this guide closer to the effective date. This post reflects the law as signed in 2026; implementing details could still be clarified before enforcement begins.
Review vendor contracts. Any processor handling Louisiana resident data will need a written agreement specifying processing instructions and confidentiality obligations, with subcontractor flow-down.
iQ Cookie scans your site for compliance gaps and deploys a lightweight US-built consent banner.
iQ Cookie State Law Series · Guide 23 of 25 · Next: Oklahoma →