What Louisiana's New Privacy Law Means for Your Ecommerce Stack

It's been a busy year for privacy legislation. We're only halfway through 2026, and four states have already passed new laws: Oklahoma, Alabama, Vermont, and now Louisiana.

The Louisiana Data Privacy Act (LDPA) follows the framework most comprehensive state privacy laws have settled into, with a few notable exceptions. It borrows several provisions from other states, including a couple that come almost word-for-word from California.

If you're running an ecommerce brand, you're probably reading this for one reason: to figure out whether this law affects your business. Here's what matters.

When it takes effect

The LDPA takes effect on January 1, 2027. That may sound like plenty of time, but privacy work adds up quickly once vendor contracts, privacy notices, and data protection assessments are on the list.

Whether it applies to you (it probably does)

The law applies to businesses operating in Louisiana that meet at least one of these thresholds. For many growing ecommerce brands, the bar is lower than it first appears.

• More than $25 million in annual revenue. Many ecommerce brands cross this milestone long before they revisit their privacy program. Louisiana also joins California here. The CCPA is the only other comprehensive state privacy law with a standalone revenue threshold.
• Handling the personal data of 75,000 or more Louisiana residents a year. That includes buying, selling, receiving, or sharing personal data. If you sell nationwide and rely on the usual mix of ecommerce tools, marketing pixels, and email platforms, you may already collect data from more Louisiana residents than you realize.
• Generating at least 50% of annual revenue from selling personal data. There's no minimum consumer threshold attached to this requirement. If selling personal data represents a significant share of your business, this provision can apply regardless of company size.

The LDPA also includes a long list of exemptions for organizations like nonprofits, colleges and universities, political organizations, and businesses already regulated under HIPAA or the GLBA. Those exemptions matter, but they won't apply to most ecommerce brands.

What the law asks you to do

If you've worked through another state privacy law, most of these requirements will feel familiar. The challenge usually isn't understanding the law. It's keeping your privacy program aligned as your storefront, vendors, and customer data workflows continue to evolve.

Publish privacy notices that reflect how your business operates today

Your privacy notice needs to explain:

• The categories of personal data you process
• Why you process that data
• How consumers can submit privacy requests
• The categories of personal data you sell to third parties
• The categories of third parties that receive it

Privacy notices tend to fall behind over time. Another tracking pixel gets added, a new app connects to your storefront, or an agency updates your analytics setup. Before long, the policy no longer reflects how customer data actually moves through your business.

Louisiana also requires two notices to appear verbatim when they apply:

"NOTICE: We may sell your sensitive personal data."
"NOTICE: We may sell your biometric personal data."

Those notices are unusual, but Louisiana isn't alone. Florida and Texas have similar requirements.

Honor consumer privacy rights

Louisiana residents have the right to:

• Access their personal data and receive a portable copy
• Delete their personal data
• Correct inaccurate personal data
• Opt out of data sales, targeted advertising, and profiling that produces legal or similarly significant effects

That last requirement deserves extra attention. Targeted advertising and profiling support retargeting campaigns, lookalike audiences, and many attribution strategies. When someone opts out, those preferences need to flow through to the tools and platforms that rely on customer data.

Give people at least two ways to submit a request

Businesses that operate exclusively online only need to provide an email address.

This requirement comes directly from California's regulations, although California is currently considering replacing it with a requirement for an online request form.

Get express consent before processing sensitive data

This requirement often surprises ecommerce brands, especially those selling wellness, supplement, beauty, or health-related products.

Louisiana defines sensitive data as:

• Personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexuality, citizenship, or immigration status
• Genetic or biometric data
• Precise geolocation
• Personal data belonging to a known child under 13

Update processor contracts

Your vendor agreements need to meet the LDPA's requirements. That includes contracts with analytics platforms, email providers, fulfillment partners, review tools, and the rest of your ecommerce stack.

If those agreements haven't been reviewed recently, now's a good time to compare them against the law's requirements.

Complete data protection assessments

You'll need documented assessments for higher-risk processing activities, including:

• Selling personal data
• Targeted advertising
• Profiling that presents a foreseeable risk of harm
• Processing sensitive personal data

Many ecommerce brands running paid social campaigns, behavioral advertising, or retargeting will fall into one or more of these categories.

Respect universal opt-out signals

The LDPA requires businesses to recognize universal opt-out signals such as Global Privacy Control.

This is one place where privacy programs often drift over time. A consent banner can look like it's working while quietly ignoring the signals browsers send automatically.

How it's enforced

Violations of the LDPA count as unfair and deceptive trade practices under Louisiana law and can carry civil penalties of up to $5,000 per violation.

The Louisiana Attorney General has exclusive enforcement authority, and the law doesn't include a private right of action for consumers.

Through July 31, 2027, businesses receive a mandatory 30-day opportunity to correct violations. After that date, the cure period expires, and enforcement can begin immediately.

The short version

If you're already complying with another comprehensive state privacy law, the LDPA won't introduce many surprises. Most of the requirements will look familiar, with a few Louisiana-specific additions like the required notices and standalone revenue threshold.

The bigger challenge is keeping your privacy program current as your business changes. Vendors get added, tracking configurations evolve, and customer data flows shift. Over time, privacy workflows can drift away from how your business actually operates.

That's why staying compliant takes more than reading the latest law. It takes keeping your privacy operations aligned with the store you're running today, including your consent setup, vendor contracts, privacy notices, and request workflows.