Louisiana 2026 Regular Session Status: Enacted Bipartisan · 7 D · 5 R cosponsors

SB 386 — IDENTITY DATA: Provides for opting out of providing personal information on social media websites. (1/1/27)

Last action — Signed by the Governor. Becomes Act No. 502.

  1. ✓
    Introduced
  2. ✓
    In Committee
  3. ✓
    Passed Senate
  4. ✓
    Passed House
  5. ✓
    To Executive
  6. 6
    Enacted

This bill has been enacted into law. Introduced February 27, 2026. Enacted.

Signed by Governor Jeff Landry (Republican) on May 29, 2026.

Odds of enactment

High chance

Based on the sponsor, cosponsors, and committee posture, this bill has a high chance of becoming law.

Upgrade to see the exact probability and what's driving it.

A statistical estimate from our own model of past outcomes — an insight, not a guarantee. Policymaking is volatile.

Prognosis

Likely to advance 82% · high confidence

  • Enacted

    Current position in the legislative process.

  • 12 sponsors

    1 primary, 11 co-sponsors signed on.

  • Bipartisan support

    Sponsored across 2 parties (7 D · 5 R) — cross-party backing.

  • Mixed recorded votes

    3 passed, 1 failed in recorded votes so far.

Based on stage, sponsorship breadth, committee status, recorded votes, and cross-state momentum — a description of the observable signals, not a prediction.

In plain language

The bill allows individuals to opt out of providing personal information on social media websites.

This legislation permits users of social media to choose whether or not to share their personal information. It aims to enhance privacy controls for individuals using these platforms.

What this means for you
  • Consumers: This means you will have more control over what personal information you share on social media.

Bill Text

What changed in the latest version

714 added · 783 removed

Plain-language change summary

In the latest version of Bill SB 386, a reference to "ACT No. 502" has been removed. This change likely simplifies the bill by eliminating an outdated or unnecessary citation. Removing such references can make the legislation easier to understand and follow, ensuring it focuses on current and relevant laws or provisions.

→
Previous
Latest
SLS 26RS-431 REENGROSSED Regular Session SENATE BILL NO.
Regular Session ENROLLED SENATE BILL NO.
386 BY SENATORS CONNICK, BARROW, HENRY, JACKSON-ANDREWS, JENKINS, LUNEAU, MILLER, PRICE, SELDERS, STINE AND WOMACK IDENTITY DATA.
386 BY SENATORS CONNICK, BARROW, HENRY, JACKSON-ANDREWS, JENKINS, LUNEAU,MILLER,PRICE,SELDERS,STINEANDWOMACKAND REPRESENTATIVE CHASSION AN ACT To enact Chapter 20-B of Title 51 of the Louisiana Revised Statutes of 1950, to be comprised of R.S.
Provides for opting out of providing personal information on social media websites.
51:1780.1 through 1780.5, relative to consumer data privacy;
(1/1/27) AN ACT To enact Chapter 20-B of Title 51 of the Louisiana Revised Statutes of 1950, to be comprised of R.S.
createstheLouisianaDataPrivacyAct;
51:1776 through 1780, relative to consumer data privacy;
to provide for limitations and restrictions of the use of certaindata;to provideforduties ofacontroller and processor;
creates the Louisiana Data PrivacyAct;
to provide for consumer rights regarding personal data;
to provide for limitations and restrictionsoftheuse ofcertaindata;toprovideforconsumerrightsregardingpersonaldata;toprovidefor applicabilityand exemptions;
to provide for applicability and exemptions;
to provideforpublicnotice;toprovidefordefinitions andterms;toprovide for a private right of action;
to provide for public notice;
and to provide forrelatedmatters.
to provide for definitions and terms;
to provide for enforcement;
and to provide for related matters.
51:1776 through 1780, is hereby enacted to read as follows:
51:1780.1 through 1780.5, is hereby enacted to read as follows:
LOUISIANA DATA PRIVACY ACT §1776.
LOUISIANA DATA PRIVACY ACT §1780.1.
For purposes of this Paragraph, "control" or Page 1 of 27 Coding:
For purposes of this Paragraph, "control" or "controlled" means any of the following:
Words which are struck through are deletions from existing law;
words in boldface type and underscored are additions.
SLS 26RS-431 REENGROSSED SB NO.
386 "controlled" means any of the following:
(2) "Authenticate" means to verify through reasonable means that the consumer who is entitled to exercise the consumer's rights under R.S.
(2) "Authenticate" means to verify through reasonable means that the Page 1 of 26 Coding:
51:1778 is the same consumer exercising those consumer rights with respect to the personal data at issue.
(3)"Biometricdata"meansdatageneratedbyautomaticmeasurements of an individual's biological characteristics.
The term includes a fingerprint, voiceprint, eye retina or iris scan, or other unique biological pattern or characteristic that is used to identify a specific individual.
The term does not include a physical or digital photograph or data generated from a physical or digital photograph, a video or audio recording or data generated from a video or audio recording, or information collected, used, or stored for health care treatment, payment, or operationsunder the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C.
1320d et seq.).
(4) "Business associate" has the same meaning assigned to the term by the Health Insurance Portability and Accountability Act of 1996 (45 CFR Part 160.103).
(5) "Child" means an individual younger than thirteen years of age.
(6) "Consent" when referring to a consumer means a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreementtoprocesspersonaldatarelatingtotheconsumer.Thetermincludes a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.
The term does not include any of the Page 2 of 27 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 following:
386 ENROLLED consumer who is entitled to exercise the consumer's rights pursuant to R.S.
51:1780.3 is the same consumer exercising those consumer rights with respect to the personal data at issue.
(3)"Biometricdata"meansdatageneratedbyautomaticmeasurements of an individual's biological characteristics that are used to identify a specific individual.
The term includes a fingerprint, voiceprint, eye retina or iris scan, or other unique biological pattern or characteristic when such data is used to identify the specific individual.
The term does not include a physical or digital photograph ordata generatedfromaphysical ordigital photograph or a video or audio recording or data generated from a video or audio recording, unless such data is generated to identify a specific individual.
The term does not include information collected, used, or stored for health care treatment, payment, or operations under the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C.
1320d et seq.
(4) "Business associate" has the same meaning assigned to the term by the Health Insurance Portability and Accountability Act of 1996, 45 CFR Part 160.103.
(5) "Child" means an individual younger than thirteen years of age.
(6) "Consent" when referring to a consumer means a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreementtoprocesspersonaldatarelatingtotheconsumer.Thetermincludes a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.
The term does not include any of the following:
Show all 394 changed rows (354 more)
Previous
Latest
(7)"Consumer"meansanindividualwhoisaresidentofthisstateacting only in an individual or household context.
(7)"Consumer"meansanindividualwhoisaresidentofthisstateacting Page 2 of 26 Coding:
The term does not include an individual action in a commercial or employment context.
Words which are struck through are deletions from existing law;
words in boldface type and underscored are additions.
SB NO.
386 ENROLLED only in an individual or household context.
The term does not include an individual acting in a commercial or employment context.
(9)"Coveredentity"hasthemeaningassignedtothetermbytheHealth Insurance Portability and Accountability Actof 1996(42U.S.C.
(9)"Coveredentity"hasthemeaningassignedtothetermbytheHealth Insurance Portability and Accountability Act of 1996, 42 U.S.C.
1320d et seq.).
1320d et seq.
(12)"Deidentifieddata"meansdatathatcannotreasonablybelinkedto an identified or identifiable individual, or a device linked to that individual.
(12) "Deidentified data" means data that cannot reasonably be used to infer information about, or otherwise be linked to an identified or identifiable individual, or a device linked to that individual, if the controller or processor that possesses such data does all of the following:
Page 3 of 27 Coding:
(a) Takes reasonable measures to ensure that such data cannot be associated with an individual.
(b) Publicly commits to process such data only in a deidentified fashion and attempt to reidentify such data.
(c) Contractually obligates any recipients of such data to satisfy the criteria set forth in Subparagraphs (a) and (b) of this Paragraph.
Page 3 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 (13)"Healthcareprovider"hasthemeaningassignedtothetermby the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C.
386 ENROLLED (13)"Healthcareprovider" has themeaningassignedtothetermby the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C.
1320d et seq.).
1320d et seq.
(14) "Health record" means any written, printed, or electronically recorded material maintained by a healthcare provider in the course of providinghealthcareservicestoanindividual thatconcernstheindividual and the services provided.
(14) "Health record" means any written, printed, or electronically recorded material maintained by a healthcare provider in the course of providing healthcareservicestoan individual that concernstheindividual and the services provided.
(a) The substance of any communication made by an individual to a health care provider in confidence during or in connection with the provision of health care services.
(a) The substance of any communication made by an individual to a healthcareproviderinconfidenceduringorinconnectionwiththeprovisionof healthcare services.
(16) "Institution of higher education" means either one of the following items:
(16) "Institution of higher education" means either one of thefollowing items:
(b) An organization exempt from federal taxation under Section 501(a) of theInternal Revenue Code of 1986, as amended by being listed as an exempt organizationunderSections501(c)(3),501(c)(6),501(c)(12),or501(c)(19)ofthat Page 4 of 27 Coding:
(b) An organization exempt from federal taxation under Section 501(a) of the InternalRevenueCodeof 1986,as amended by being listed as an exempt organizationunderSections501(c)(3),501(c)(6),501(c)(12),or501(c)(19)ofthat Code.
Page 4 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 Code.
386 ENROLLED (c) A political organization.
(c) A political organization.
The termincludes pseudonymous data when the data is used by a controlleror processorin conjunction with additional information that reasonably links the data to an identified or identifiable individual.
(20) "Political organization" means a party, committee, association, fund, or other organization, regardless of whether incorporated, that is organizedand operatedprimarilyforthepurpose of influencing orattempting to influence:
(20) "Political organization" means a party, committee, association, fund, or other organization, regardless of whether incorporated, that is organizedand operatedprimarilyforthepurpose of influencing orattempting to influence either of the following:
(a) The selection, nomination, election, or appointment of an individual to a federal, state, or local public office or an office in a political organization, regardless of whether the individual is selected, nominated, elected, or appointed;
(a) The selection, nomination, election, or appointment of an individual to a federal, state, or local public office or an office in a political organization, regardless of whether the individual is selected, nominated, elected, or appointed.
or (b) The election of a presidential/vice-presidential elector, regardless of whether the elector is selected, nominated, elected, or appointed.
(b) The election of a presidential/vice-presidential elector, regardless of whether the elector is selected, nominated, elected, or appointed.
(21) "Precise geolocation data" means information derived from technology, including global positioning system level latitude and longitude coordinatesorothermechanisms,thatdirectlyidentifiesthespecificlocationof anindividualwithprecisionandaccuracywithinaradiusofonethousandseven hundred fiftyfeet.The termdoes not include thecontentof communicationsor any data generated by or connected to an advanced utility metering infrastructure system or to equipment for use by a utility.
(c) The outcome of any ballot measure, referendum, initiative, or recall election at the federal, state, or local level.
(22) "Process" or "processing" means an operation or set of operations Page 5 of 27 Coding:
(d) Any political, legislative, or public policy matter, including public opinion relating thereto.
(21) "Precise geolocation data" means information derived from technology, including global positioning system level latitude and longitude coordinatesorothermechanisms,thatdirectlyidentifiesthespecificlocationof anindividualwithprecisionandaccuracywithinaradiusofonethousandseven hundredfiftyfeet.Thetermdoesnotincludethecontentofcommunications,or any data generated by or connected to an advanced utility metering infrastructure system or to equipment for use by a utility.
(22) "Process" or "processing" means an operation or set of operations performed,whetherbymanualorautomatedmeans,onpersonaldataoronsets Page 5 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 performed,whetherbymanualorautomatedmeans,onpersonaldataoronsets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.
386 ENROLLED of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.
(23)"Processor"means apersonthatprocessespersonal data on behalf of a controller.
(23)"Processor"means aperson thatprocessespersonal dataonbehalf of a controller.
(25) "Protected health information" has the meaning assigned to the term by the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C.
(25) "Protected health information" has the meaning assigned to the term by the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C.
1320d et seq.).
1320d et seq.
(28) "Sale of personal data" means the sharing, disclosing, or transferring of personal data for monetary or other valuable consideration by the controller to a third party.
(28) "Sale of personal data" means the exchange of personal data for monetaryorothervaluableconsiderationbythecontrollertoathirdparty.The term does not include any of the following:
The term does not include any of the following:
(b) The disclosure of personal data to a third party for purposes of Page 6 of 27 Coding:
(b) The disclosure of personal data to a third party for purposes of providing a product or service requested by the consumer.
(c) The disclosure or transfer of personal data to an affiliate of the Page 6 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 providing a product or service requested by the consumer.
386 ENROLLED controller.
(c) The disclosure or transfer of personal data to an affiliate of the controller.
(e)Thedisclosureortransferofpersonaldatatoathirdpartyasanasset that is part of a merger or acquisition.
(e)Thedisclosureofpersonaldatadirectedbyaconsumerormadewhen the consumer uses the controller to interact with a third party.
(f)Thedisclosureortransferofpersonaldatatoathirdpartyasanasset that is part of a merger, acquisition, or similar activity, or a proposed merger, acquisition, or similar activity.
(31) "Targeted advertising" means displaying to a consumer an advertisement that is selected based on personal data obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict the consumer's preferences or interests.
(31) "Targeted advertising" means displaying to a consumer an advertisementthatisselectedbasedonpersonaldataobtainedorinferredfrom thatconsumer's activities over time and across nonaffiliated websitesoronline applications to predict the consumer's preferences or interests.
(b) Based on the context of a consumer's current search query, visit to Page 7 of 27 Coding:
(b) Based on the context of a consumer's current search query, visit to Page 7 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 a website, or online application.
386 ENROLLED a website, or online application.
§1777.
§1780.2.
Applicability and preemption A.
Applicability;
preemption A.
(3) Derives fifty percent or more of its annual revenues from selling Page 8 of 27 Coding:
(3) Derives fifty percent or more of its annual revenues from selling consumers' personal information.
Page 8 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 consumers' personal information.
386 ENROLLED B.
B.
(2) A financial institution or data subject to Title V, Gramm-Leach-Bliley Act (15 U.S.C.
(2) A financial institution and its affiliates or data subject to Title V, Gramm-Leach-Bliley Act, 15 U.S.C.
6801 et seq.).
6801 et seq., and the rules and implementing regulations promulgated thereunder.
(3) A covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, 45 CFR Parts 160 and 164, established under the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C.
(3) A covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, 45 CFR Parts 160 and 164, established under the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C.
1320d et seq.).
1320d et seq.
(7)Aperson,association,partnership,orcorporationregisteredwiththe secretaryofstateasaconductorofpublicopinionpollspursuanttoR.S.14:325.
(1)ProtectedhealthinformationundertheHealthInsurancePortability and Accountability Act of 1996 (42 U.S.C.
(1)ProtectedhealthinformationundertheHealthInsurancePortability and Accountability Act of 1996, 42 U.S.C.
1320d et seq.).
1320d et seq.
(b)Collectedaspartofhumansubjectsresearchunderthegood clinical practice guidelines issued by The International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) or of the protection of human subjects under 21 CFR Parts 50 and 56.
(b)Collectedaspartofhumansubjectsresearchunderthegood clinical practice guidelines issued by The International Council for Harmonisation of TechnicalRequirementsforPharmaceuticalsforHumanUse,otherwiseknown as ICH, or of the protection of human subjects under 21 CFR Parts 50 and 56.
(c) That is personal data used or shared in research conducted in accordance with the requirements set forth in this Chapter or other research conducted in accordance with applicable law.
(c) That is personal data used or shared in research conducted in accordance with the requirements set forth in this Chapter or other research Page 9 of 26 Coding:
Page 9 of 27 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 (5)Information and documentscreatedforpurposes of theHealthCare Quality Improvement Act of 1986 (42 U.S.C.
386 ENROLLED conducted in accordance with applicable law.
11101 et seq.).
(5)Information and documentscreatedforpurposes of theHealthCare Quality Improvement Act of 1986, 42 U.S.C.
(6) Patient safety work product for purposes of the Patient Safety and Quality Improvement Act of 2005 (42 U.S.C.
11101 et seq.
299b-21 et seq.).
(6) Patient safety work product for purposes of the Patient Safety and Quality Improvement Act of 2005, 42 U.S.C.
(7) Information derived fromany of thehealthcare-relatedinformation listedinthisSectionthatisdeidentifiedinaccordancewiththerequirementsfor deidentificationundertheHealthInsurancePortabilityandAccountabilityAct of 1996 (42 U.S.C.
299b-21 et seq.
1320d et seq.).
(7)Information derived fromany of thehealthcare-relatedinformation listedinthisSectionthatisdeidentifiedinaccordancewiththerequirementsfor deidentificationundertheHealthInsurancePortabilityandAccountabilityAct of 1996, 42 U.S.C.
(8) Information originating from, and intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this Section that is maintained by a covered entity or business associate as defined by the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C.
1320d et seq.
1320d et seq.) or by a program or a qualified service organization as defined by 42 U.S.C.
(8) Information originating from, and intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this Section that is maintained by a covered entity or business associate as defined by the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C.
1320d et seq., or by a program or a qualified service organization as defined by 42 U.S.C.
(10) Information collected or used only for public health activities and purposesasauthorizedbytheHealthInsurancePortabilityandAccountability Act of 1996 (42 U.S.C.
(10) Information collected or used only for public health activities and purposesasauthorizedbytheHealthInsurancePortabilityandAccountability Act of 1996, 42 U.S.C.
1320d et seq.).
1320d et seq.
(11)Thecollection,maintenance,disclosure,sale,communication,oruse of any personal information bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics,or mode of living by a consumer reporting agency or furnisher that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the Fair Credit Reporting Act (15 U.S.C.
(11)Thecollection,maintenance,disclosure,sale,communication,oruse of any personal information bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics,or mode of living by a consumer reporting agency or furnisher that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the Fair Credit Reporting Act, 15 U.S.C.
1681 et seq.).
1681 et seq.
(12) Personal data collected, processed, sold, or disclosed in compliance with the Driver's Privacy Protection Act of 1994 (18 U.S.C.
(12) Personal data collected, processed, sold, or disclosed in compliance with the Driver's Privacy Protection Act of 1994, 18 U.S.C.
2721 et seq.).
2721 et seq.
Page 10 of 27 Coding:
Page 10 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 (13) Personal data regulated by the Family Educational Rights and Privacy Act of 1974 (20 U.S.C.
386 ENROLLED (13) Personal data regulated by the Family Educational Rights and Privacy Act of 1974, 20 U.S.C.
1232g).
1232g.
(14) Personal data collected,processed, sold, or disclosed in compliance with the Farm Credit Act of 1971 (12 U.S.C.
(14) Personal data collected, processed, sold, or disclosed in compliance with the Farm Credit Act of 1971, 12 U.S.C.
2001 et seq.).
2001 et seq.
(17) Data that is processed or maintained and is necessary to retain to administer benefits for another individual that relates to an individual describedbyR.S.51:1776(15)andusedforthepurposesofadministeringthose benefits.
(17) Data that is processed or maintained and is necessary to retain to administer benefits for another individual that relates to an individual described by R.S.
51:1780.1(15) and used for the purposes of administering those benefits.
A controller or processor that complies with the verifiable parental consent requirements of the Children's Online Privacy Protection Act of 1998 (15 U.S.C.
A controller or processor that complies with the verifiable parental consent requirements of the Children's Online Privacy Protection Act of 1998, 15 U.S.C.
6501 et seq.) with respect to data collected online is considered to be in compliance with any requirement to obtain parental consent under this Chapter.
6501 et seq., and its rules, regulations, and exemptions with respect todata collectedonline is consideredtobein compliance with any requirement to obtain parental consent under this Chapter.
§1778.
§1780.3.
Consumer rights, requests, and appeals A.(1) A consumer is entitled to exercise the consumer rights authorized bythisSectionatanytimebysubmittingarequesttoacontrollerspecifyingthe consumerrightstheconsumerwishestoexercise.Withrespecttotheprocessing of personal data belonging to a known child, a parent or legal guardian of the child may exercise the consumer rights on behalf of the child.
Consumer rights;
Page 11 of 27 Coding:
requests;
appeals A.(1) A consumer is entitled to exercise the consumer rights authorized bythisSectionatanytimebysubmittingarequesttoacontrollerspecifyingthe consumerrightstheconsumerwishestoexercise.Withrespecttotheprocessing of personal data belonging to a known child, a parent or legal guardian of the child may exercise the consumer rights on behalf of the child.
(2)Acontrollershallcomplywithanauthenticatedconsumerrequestto Page 11 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 (2)Acontrollershallcomplywithanauthenticatedconsumerrequestto exercise the right to do any of the following:
386 ENROLLED exercise the right to do any of the following:
(e) Opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer.
(e) Opt out of the processing of the personal data for purposes of:
B.(1) Except as otherwise provided by this Chapter, a controller shall comply with a request submitted by a consumer to exercise the consumer's rights pursuant to R.S.
(i) Targeted advertising.
51:1778(A)(1) as provided by this Section.
(ii) The sale of personal data.
(2) A controller shall respond to the consumer request without undue delay, which may not be laterthan theforty-fifth calendarday afterthedateof receipt of the request.
(iii) Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer.
(3) Nothing in this Section shall require the controller to reveal a trade secret.
B.(1) Except as otherwise provided by this Chapter, a controller shall comply with a request submitted by a consumer to exercise the consumer's rights pursuant to Paragraph (A)(1) of this Section.
(2) A controller shall respond to the consumer request without undue delay, which may not belaterthan theforty-fifth calendarday afterthedateof receipt of the request.
(3) If a controller declines to take action regarding the consumer's request, the controller shall inform the consumer without undue delay, which Page 12 of 27 Coding:
(3) If a controller declines to take action regarding the consumer's Page 12 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 maynotbelaterthantheforty-fifthcalendardayafterthedateofreceiptofthe request,ofthejustificationfordecliningtotakeactionandprovideinstructions on how to appeal the decision in accordance with R.S.
386 ENROLLED request, the controller shall inform the consumer without undue delay, which maynotbelaterthantheforty-fifthcalendardayafterthedateofreceiptofthe request,ofthejustificationfordecliningtotakeactionandprovideinstructions on how to appeal the decision in accordance with Subsection C of this Section.
51:1778(C).
If a request from a consumer is manifestly unfounded, excessive, or repetitive, the controller may charge the consumer a reasonable fee to cover the administrative costs of complying with the request ormaydeclinetoacton therequest.Thecontroller bears the burden of demonstrating for purposes of this Subsection that a request is manifestly unfounded, excessive, or repetitive.
If a request from a consumer is manifestly unfounded, excessive, or repetitive, the controller may charge the consumer a reasonable fee to cover the administrative costs of complying with therequestormaydecline to act on therequest.Thecontroller bears the burden of demonstrating for purposes of this Subsection that a request is manifestly unfounded, excessive, or repetitive.
(5) If a controller is unable to authenticate the request using commercially reasonable efforts, the controller is not required to comply with a consumerrequest submitted under R.S.
(5) If a controller is unable to authenticate the request using commercially reasonable efforts, the controller is not required to comply with aconsumerrequestsubmittedpursuanttoSubsectionAofthisSectionandmay requestthattheconsumerprovideadditionalinformationreasonablynecessary to authenticate the consumer and the consumer's request.
51:1778(A)and mayrequestthatthe consumerprovideadditionalinformationreasonablynecessarytoauthenticate the consumer and the consumer's request.
(6)Acontrollerthathas obtained personal data about a consumerfrom asourceotherthantheconsumerisconsideredincompliancewithaconsumer's requesttodeletethatpersonal data pursuant toSubparagraph (A)(2)(c)of this Section by either of the following:
(6)Acontrollerthat has obtained personal data about aconsumerfrom asourceotherthantheconsumerisconsideredincompliancewithaconsumer's request to delete that personal data pursuant to R.S.
51:1778(A)(2)(c) by:
C.(1) A controller shall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decisions under R.S.
C.(1) A controllershall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period of timeaftertheconsumer'sreceiptof thedecisions pursuant toParagraph(B)(3) Page 13 of 26 Coding:
51:1778(B)(3).
(2)Theappealprocessmustbeconspicuouslyavailableandsimilartothe Page 13 of 27 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 processforinitiatingactiontoexerciseconsumerrightsbysubmittingarequest under R.S.
386 ENROLLED of this Section.
51:1778(A).
(2)Theappealprocessshallbeconspicuouslyavailableandsimilartothe processforinitiatingactiontoexerciseconsumerrightsbysubmittingarequest pursuant to Subsection A of this Section.
(3)Acontrollershallinformtheconsumerinwritingofanyactiontaken or not taken in response to an appeal under this Section not later than the sixtieth calendar day afterthe date of receiptof the appeal, including a written explanation of the reason or reasons for the decision.
(3)Acontrollershallinformtheconsumerinwritingofanyactiontaken or not taken in response to an appeal under this Section not later than the sixtieth calendar day after the date of receiptof the appeal, including a written explanation of the reason or reasons for the decision.
(4) If the controller denies an appeal, the controller shall provide the consumer with the online mechanism described by R.S.
(4) If the controller denies an appeal, the controller shall provide the consumerwiththeonlinemechanismdescribedbyR.S.51:1780.5(B)(2)through which the consumer may contact the attorney general to submit a complaint.
51:1780(B)(2) through which the consumer may contact the attorney general to submit a complaint.
D.Any provision of a contractor agreement that waives orlimitsin any way a consumer right described in this Section is contraryto public policy and is void and unenforceable.
D.Any provision of a contractor agreement thatwaives orlimitsin any wayaconsumerrightdescribedbyR.S.51:1778iscontrarytopublicpolicyand is void and unenforceable.
(3)ExceptasprovidedbyR.S.51:1776(28)(d),ifthecontrollermaintains a website, the controller must provide a mechanism on the website for consumers to submit requests for information required to be disclosed under this Chapter.
(3) Except as provided by R.S.
(4) A controller that operates exclusively online and has a direct Page 14 of 27 Coding:
51:1780.1(28)(d), if the controller maintainsawebsite,thecontrollershallprovideamechanismonthewebsitefor consumers to submit requests for information required to be disclosed under this Chapter.
Page 14 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 relationship with a consumer from whom the controller collects personal information is only required to provide an email address for the submission of requests described by R.S.
386 ENROLLED (4) A controller that operates exclusively online and has a direct relationship with a consumer from whom the controller collects personal information is only required to provide an email address for the submission of requests described by Subparagraph(1)(c) of this Subsection.
51:1778(E)(1)(c).
(5)Aconsumermaydesignateanotherpersontoserveastheconsumer's authorized agent and act on the consumer's behalf to opt out of the processing of the consumer's personal data pursuant to Items (A)(2)(e)(i) and (ii) of this Section.
(5)Aconsumermaydesignateanotherpersontoserveastheconsumer's authorized agent and act on the consumer's behalf to opt-out of the processing of the consumer's personal data under R.S.
A consumer may designate an authorized agent using a technology, including a link to a website, an internet browser setting or extension, or a global setting on an electronic device, that allows the consumer to indicate the consumer's intent to opt out of the processing for targeted advertising, for sale of personal data, or both.
51:1778(A)(2)(e)(1) and (2).
A consumer may designate an authorized agent using a technology, including a link toawebsite,aninternetbrowsersettingorextension,oraglobalsettingon anelectronicdevice,thatallows theconsumertoindicatetheconsumer'sintent to opt out of the processing.
A controller is not required to comply with an opt-out request received from an authorized agent under this Subsection if any one of the following apply:
A controller is not required to comply with an opt-out request received from an authorized agent under this Subsection if any one of the following applies:
(c)Shall beconsumer-friendlyandeasytousebytheaverageconsumer.
Page 15 of 26 Coding:
Page 15 of 27 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 §1779.
386 ENROLLED (c)Shall beconsumer-friendlyandeasytousebytheaverageconsumer.
§1780.4.
(a)Exceptas otherwiseprovidedbythisChapter,processpersonaldata for a purpose that is neither reasonably necessary to nor compatible with the disclosed purpose for which the personal data is processed, as disclosed to the consumer, unless the controller obtains the consumer's consent.
(a)Exceptasotherwiseprovidedbythis Chapter,processpersonaldata for a purpose that is neither reasonably necessary to nor compatible with the disclosed purpose for which the personal data is processed, as disclosed to the consumer, unless the controller obtains the consumer's consent.
(c) Discriminate against a consumer for exercising any of the consumer rights contained in this Chapter, including by denying goods or services, chargingdifferentpricesorratesforgoods orservices,orproviding adifferent level of quality of goods or services to the consumer.
(c) Discriminate against a consumer for exercising any of the consumer rights contained in this Chapter, including by denying goods or services, chargingdifferentpricesorratesforgoodsorservices,orproviding adifferent level of quality of goods or services to the consumer.
(d) Process the sensitive data of a consumer without obtaining the consumer's consent, or, in the case of processing the sensitive data of a known child, without processing that data in accordance with the Children's Online Privacy Protection Act of 1998 (15 U.S.C.
(d) Process the sensitive data of a consumer without obtaining the consumer's consent, or, in the case of processing the sensitive data of a known child, without processing that data in accordance with the rules, regulations, and the exceptions of the Children's Online Privacy Protection Act of 1998, 15 U.S.C.
6501 et seq.).
6501 et seq.
(3) This Subsection may not be construed to require a controller to provide a product orservicethatrequiresthepersonal data ofaconsumerthat the controller does not collect or maintain or to prohibit a controller from offeringa differentprice,rate,level,quality, orselectionof goods orservicesto a consumer,including offeringgoods orservicesfornofee,if theconsumerhas Page 16 of 27 Coding:
(3) This Subsection may not be construed to require a controller to provide a product orservicethatrequiresthepersonal data of aconsumerthat the controller does not collect or maintain or to prohibit a controller from offeringa differentprice,rate,level,quality, orselectionof goods orservicesto Page 16 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 exercised the consumer's right to opt out under R.S.
386 ENROLLED a consumer, including offeringgoods orservicesforno fee,if theconsumerhas exercised the consumer's right to opt out pursuant to R.S.
51:1778(A) or the offer is relatedtoa consumer'svoluntaryparticipationinabona fideloyalty, rewards, premium features, discounts, or club card program.
51:1780.3(A) or the offer is related to a consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.
B.(1) A controller shall provide consumers with a reasonably accessible and clear privacy notice that includes all of the following:
B.(1) A controllershall provide consumers with a reasonably accessible and clear privacy notice that includes all of the following:
(c) A process on how consumers may exercise their consumer rights under R.S.
(c) A process on how consumers may exercise their consumer rights pursuant to R.S.
51:1778, including the process by which a consumer may appeal a controller's decision with regard to the consumer's request.
51:1780.3, including the process by which a consumer may appeal a controller's decision with regard to the consumer's request.
(d) If applicable, the categories of personal data that the controller shares with third parties.
(d) If applicable, the categoriesof personal data that the controller sells to third parties.
(e)Ifapplicable,thecategoriesofthirdpartieswithwhomthecontroller shares personal data.
(e)Ifapplicable,thecategoriesofthirdpartieswithwhomthecontroller sells personal data.
(f)AdescriptionofthemethodsrequiredunderR.S.51:1778(E)through which consumers can submit requests to exercise their consumer rights under this Chapter.
(f) A description of the methods required pursuant toR.S.
51:1780.3(E) throughwhichconsumerscansubmitrequeststoexercisetheirconsumerrights under this Chapter.
We may sell your sensitive personal data".
We may sell your sensitive personal data." (3) If a controller engages in the sale of personal data that is biometric data, the controller shall post the following notice in the same manner as the privacy notice described in Subsection B of this Section:
(3) If a controller engages in the sale of personal data that is biometric data, the controller shall post the following notice in the same manner as the privacy notice described in Subsection B of this Section:
If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose that process and the manner in which a consumer may Page 17 of 27 Coding:
If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose that process and the manner in which a consumer may Page 17 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 exercise the right to opt out of that process.
386 ENROLLED exercise the right to opt out of that process.
(a) Assisting the controller in responding to consumer rights requests submitted under R.S.
(a) Taking into account the nature of processing and the information available to the processor, by using appropriate technical and organizational measures, insofar as this is reasonably practicable, to fulfill the controller's obligation to respond to consumer rights requests submitted pursuant to R.S.
51:1778(A) by using appropriate technical and organizational measures, as reasonably practicable, taking into account the nature of processing and the information available to the processor.
51:1780.3(A).
(b)Assisting thecontrollerwithregardtocomplying withrequirements relating to the security of processing personal data, and if applicable, the personaldatacollected,stored,andprocessedbyanartificialintelligencesystem and to the notification of a breach of security of the processor's system under R.S.
(b) Taking into account the nature of processing and the information availabletotheprocessor,byassistingthecontrollerinmeetingthecontroller's obligations in relation to the security of processing personal data, and in relation to the notification of a breach of security of the processor's system pursuant to R.S.
51:3071, taking into account the nature of processing and the information available to the processor.
51:3071 et seq.
(i)Ensure thateachperson processingpersonal data is subjecttoaduty of confidentiality with respect to the data;
(i)Ensure thateachperson processingpersonal data is subjecttoa duty of confidentiality with respect to the data.
(ii) At the controller'sdirection,deleteorreturnall personal data to the controller as requested after the provision of the service is completed, unless Page 18 of 27 Coding:
(ii) At thecontroller'sdirection,deleteorreturnall personal data to the controller as requested after the provision of the service is completed, unless retention of the personal data is required by law.
Page 18 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 retention of the personal data is required by law;
386 ENROLLED (iii) Make available to the controller, on reasonable request, all information in the processor's possession necessary to demonstrate the processor's compliance with the requirements of this Chapter.
(iii) Make available to the controller, on reasonable request, all information in the processor's possession necessary to demonstrate the processor's compliance with the requirements of this chapter;
(iv)Allow,andcooperatewith,reasonableassessmentsbythecontroller or the controller's designated assessor.
(iv)Allow,andcooperatewith,reasonableassessmentsbythecontroller or the controller's designated assessor;
(v) Engage any subcontractor pursuant to a written contract that requires the subcontractor to meet the requirements of the processor with respect to the personal data.
and (v) Engage any subcontractor pursuant to a written contract that requires the subcontractor to meet the requirements of the processor with respect to the personal data.
Page 19 of 27 Coding:
(c) The processing of personal data for purposes of profiling, if the profiling presents a reasonably foreseeable risk of any of the following:
Page 19 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 (c) The processing of personal data for purposes of profiling, if the profiling presents a reasonably foreseeable risk of:
386 ENROLLED (i) Unfair or deceptive treatment of or unlawful disparate impact on consumers.
(i) Unfair or deceptive treatment of or unlawful disparate impact on consumers;
(ii) Financial, physical, or reputational injury to consumers.
(ii) Financial, physical, or reputational injury to consumers;
(iii) A physical or other intrusion on the solitude or seclusion, or the private affairs or concerns, of consumers,if theintrusion would be offensive to a reasonable person.
(iii) A physical or other intrusion on the solitude or seclusion, or the privateaffairsor concerns, of consumers, if the intrusion would beoffensiveto a reasonable person;
(iv) Other substantial injury to consumers.
or (iv) Other substantial injury to consumers.
(2) A data protection assessment conducted under R.S.
(2) A data protection assessment conducted pursuant to Paragraph (1) of this Subsection shall do both of the following:
51:1779(E)(1) shall:
(a)Identify and weigh thedirectorindirectbenefitsthat mayflow from the processing to the controller, the consumer, other stakeholders, and the public, against the potential risks to the rights of the consumer associated with that processing, as mitigated by safeguards that can be employed by the controller to reduce the risks.
(a)Identifyand weigh thedirectorindirectbenefitsthat mayflow from the processing to the controller, the consumer, other stakeholders, and the public, against the potential risks to the rights of the consumer associated with that processing, as mitigated by safeguards that can be employed by the controller to reduce the risks;
(b) Factor into the assessment all of the following:
and (b) Factor into the assessment all of the following:
51:1780(C)(2) available to the attorney general pursuant to a civil investigative demand pursuant to R.S.
51:1780.5(C)(2) available to the attorney general pursuant to a civil investigative demand pursuant to R.S.
51:1780(C).
51:1780.5(C).
(4)Adataprotectionassessmentisconfidential and exempt frompublic Page 20 of 27 Coding:
(4)Adata protectionassessmentisconfidential and exemptfrompublic inspectionandcopyingpursuanttothisSection.Disclosureofadataprotection assessment in compliance with a request from the attorney general does not constituteawaiverofattorney-clientprivilegeorworkproductprotectionwith Page 20 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 inspection and copying under R.S.
386 ENROLLED respect to the assessment and any information contained in the assessment.
51:1779.
(5)Asingle dataprotectionassessmentmayaddressacomparablesetof processing operations that include similar activities.
Disclosure of a data protection assessment in compliance with a request from the attorney general does not constituteawaiverofattorney-clientprivilegeorworkproductprotectionwith respect to the assessment and any information contained in the assessment.
(5)Asingledataprotectionassessmentmayaddress acomparablesetof processing operations that include similar activities.
(7)Dataprotectionassessmentsare required for processingactivitiesas of January 1, 2027, and are not retroactive.
(2) This Chapter shall not be construed to require a controller or processor to:
(2) This Chapter shall not be construed to require a controller or processor to do any of the following:
51:1778(A), if the controller:
51:1780.3(A), if the controller is all of the following:
(i)Isnotreasonablycapableofassociatingtherequestwiththepersonal dataoritwouldbeunreasonablyburdensomeforthecontrollertoassociatethe request with the personal data;
(i)Isnotreasonablycapableofassociatingtherequestwiththepersonal dataoritwouldbeunreasonablyburdensomeforthecontrollertoassociatethe request with the personal data.
Page 21 of 27 Coding:
(ii)Doesnotusethepersonaldatatorecognizeorrespondtothespecific consumer who is thesubjectof thepersonal data or associate the personal data Page 21 of 26 Coding:
SLS 26RS-431 REENGROSSED SB NO.
SB NO.
386 (ii)Doesnotusethepersonaldatatorecognizeorrespondtothespecific consumer who is thesubjectof thepersonal data or associate the personal data with other personal data about the same specific consumer;
386 ENROLLED with other personal data about the same specific consumer.
and (iii) Does not sell the personal data to any third party or otherwise voluntarilydisclosethepersonaldatatoanythirdpartyotherthanaprocessor, except as otherwise permitted by this Section.
(iii) Does not sell the personal data to any third party or otherwise voluntarilydisclosethepersonaldatatoanythirdpartyotherthanaprocessor, except as otherwise permitted by this Section.
H.(1) The consumer rights under R.S.
H.
51:1778(A)(2)(a)through (e) and controller duties under R.S.
This Chapter shall not be construed to limit a controller or processor's ability to do any of the following:
51:1779 do not apply to pseudonymous data in cases in which the controller is able to demonstrate any information necessary to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing the information.
(1) Comply with federal, state, or local laws, rules, or regulations.
(2) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities.
(3) Investigate, establish, exercise, prepare for, or defend legal claims.
(4)Providea product orservicespecifically requestedby a consumeror the parent or guardian of a child, perform a contract to which the consumer is a party, including fulfilling the terms of a written warranty, or taking steps at the request of the consumer before entering into a contract.
(5) Take immediate steps to protect against an interest that is essential for the life or physical safety of the consumer or of another individual and in which the processing cannot be manifestly based on another legal basis.
(6)Engageinpublic orpeer-reviewedscientificorstatisticalresearchin the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board or similarly independent oversight entity that determines all of the following has occurred:
(a) If the deletion of the information is likely to provide benefits that do not exclusively accrue to the controller.
Page 22 of 26 Coding:
Words which are struck through are deletions from existing law;
words in boldface type and underscored are additions.
SB NO.
386 ENROLLED (b) Whether the expected benefits of the research outweigh the privacy risks.
(c) If the controller has implemented reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with reidentification.
(7) Assist another controller, processor, or third party with any of the requirements pursuant to this Subsection.
(8) Cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local laws, rules, or regulations.
I.
The obligations imposed on controllers or processors pursuant tothis Chapter shall not restrict a controller's or processor's ability to collect, use, or retain data for internal use to do any of the following:
(1) Conduct internal research to develop, improve, or repair products, service, or technology.
(2) Effectuate a product recall.
(3) Identify and repair technical errors that impair existing or intended functionality.
(4) Perform internal operations that are reasonably aligned with the expectationsoftheconsumerorreasonablyanticipatedbasedontheconsumer's existing relationship with the controller, or are otherwise compatible with processing data in furtherance of the provisions of a product or service specifically requestedby aconsumerortheperformanceof acontracttowhich the consumer is a party.
J.The obligations imposed on controllersorprocessorspursuanttothis Chapter shall not apply where compliance by the controller or processor with saidSectionswouldviolateanevidentiaryprivilegepursuant tothelaws of this state.
Nothing in this Chapter shall be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege pursuant to the laws of the state as part of Page 23 of 26 Coding:
Words which are struck through are deletions from existing law;
words in boldface type and underscored are additions.
SB NO.
386 ENROLLED a privileged communication.
K.
Nothing in this Chapter shall be construed to impose any obligation on a controllerorprocessorthatadverselyaffectstherightsorfreedomsofany person, including but not limited to the rights of any person to freedom of speech or freedom of the press guaranteed in the First Amendment to the United States Constitution.
L.(1) Personal data processed by a controller pursuant to this Section may be processed to the extent that such processing is both of the following:
(a)Reasonablynecessaryandproportionatetothepurposeslistedinthis Section.
(b)Adequate,relevant,andlimitedtowhatisnecessaryinrelationtothe specific purposes listed in this Section.
(2)Personaldatacollected,used,orretainedpursuanttoSubsectionIof this Section shall, where applicable, take into account the nature and purpose or purposes of such collection, use, or retention.
Such data shall be subject to reasonable administrative, technical, and physical measures to protect the confidentiality, integrity, and accessibility of the personal data and to reduce reasonably foreseeable risks of harm to consumers relating to such collection, use, or retention of personal data.
M.
If a controller processes personal data pursuant to an exemption in this Section, the controller bears the burden of demonstrating that such processing qualifies for the exemption and complies with the requirements in Subsection L of this Section.
N.
Processing personal data for the purposes expressly identified in Subsections G through I of this Section shall not solely make a legal entity a controller with respect to such processing.
O.(1) The consumer rights pursuant to R.S.
51:1780.3(A)(2)(a)through (e)andcontrollerdutiespursuanttothisSectiondonotapplytopseudonymous data in cases in which the controller is able to demonstrate any information necessary to identify the consumer is kept separately and is subject to effective Page 24 of 26 Coding:
Words which are struck through are deletions from existing law;
words in boldface type and underscored are additions.
SB NO.
386 ENROLLED technicalandorganizationalcontrolsthatpreventthecontrollerfromaccessing the information.
I.(1) A personorentitydescribedby R.S.
P.(1) A person or entity described by R.S.
51:1777(A)(3)may not engage inthesaleofpersonaldatathatissensitivedatawithoutreceivingpriorconsent from the consumer.
51:1780.2(A)(3) may not engagein thesaleof personal datathatis sensitivedata without receivingprior consent from the consumer.
51:1780.
51:1780.5.
§1780.
§1780.5.
Page 22 of 27 Coding:
B.
Words which are struck through are deletions from existing law;
words in boldface type and underscored are additions.
SLS 26RS-431 REENGROSSED SB NO.
386 B.
D.BeginningJanuary1,2027,andendingJuly31,2027,beforebringing an action pursuant to R.S.
D.BeginningJanuary1,2027,andendingJuly31,2027,beforebringing an action pursuant to this Section, the attorney general shall notify a person in writing, not later than the thirtieth calendar day before initiating an investigation, identifying the specific provisions of this Chapter the attorney general alleges is being violated.
51:1780, the attorney general shall notify a person in writing, not later than the thirtieth calendar day before initiating an investigation, identifying the specific provisions of this Chapter the attorney general alleges is being violated.
(1) Cures the alleged violation identified by the attorney general within the thirty-day period.
Page 25 of 26 Coding:
(2) Provides the attorney general with a written statement that the person cured the alleged violation and notified the consumer that the consumer's privacy violation was addressed provided the consumer's contact information has been made available to the person.
Words which are struck through are deletions from existing law;
words in boldface type and underscored are additions.
SB NO.
386 ENROLLED (1) Cures the alleged violation identified by the attorney general within the thirty-day period.
(2) Provides the attorney general with a written statement that the person cured the alleged violation.
(4) Changes are made to the internal policy, if necessary, to ensure that no further violations occur.
(4) Changes are made to the internal policy, if necessary, to ensure that no such further violations occur.
Page 23 of 27 Coding:
PRESIDENT OF THE SENATE SPEAKER OF THE HOUSE OF REPRESENTATIVES GOVERNOR OF THE STATE OF LOUISIANA APPROVED:
Words which are struck through are deletions from existing law;
Page 26 of 26 Coding:
words in boldface type and underscored are additions.
SLS 26RS-431 REENGROSSED SB NO.
386 The original instrument and the following digest, which constitutes no part of the legislative instrument, were prepared bySenate Legislative Services.
The keyword, summary, and digest do not constitute part of the law or proof or indicia of legislative intent.
[R.S.
1:13(B) and 24:177(E)] DIGEST SB 386 Reengrossed 2026 Regular Session Connick Proposed law creates the Louisiana Data Privacy Act.
Proposed law provides for definitions and terms.
Proposed law provides that proposed law applies only to a person that does business in the stateandmeetsoneormorespecifiedthresholds,includingannualgrossrevenuesexceeding $25 million, processing the personal data of 75,000 or more consumers, households, or devices, or deriving 50% or more of annual revenues from the sale of personal data.
Proposedlawexemptsstateagencies,politicalsubdivisions,financialinstitutions,nonprofit organizations,institutionsofhighereducation,electricpublicutilities,andentitiesgoverned by the privacy and security rules from proposed law.
Proposed law exempts certain information including, but not limited to protected health information, patient identifying information, and certain employment related data, from proposed law.
Proposed law excludes personal or household activities from applicabilityof proposed law and requires a controller or processor to use verifiable parental consent with respect to data collection online.
Proposed law allows a consumer, or a parent or legal guardian of a known child, to submit a request to a controller to confirm and access personal data, correct inaccuracies, delete personal data, obtain portable copy of previously provided data, and opt out of targeted advertising, sale of personal data or certain profiling.
Proposed law requires a controller to respond to a consumer's request within 45 days, or extended once for 45 days, and to provide notice and appeal instructions if a request is denied.
Proposed law allows up to two free responses annuallyand permits reasonable fees for administrative costs for manifestly unfounded, excessive, or repetitive requests.
Proposed law provides that if a controller is unable to authenticate the request using commercially reasonable efforts, the controller is not required to comply with a consumer request.
Proposed law provides methods by which a controller may comply with deletion requests for data obtained from a source other than the consumer.
Proposedlawrequiresacontrollertoestablishaprocessforappealandtorespondtoappeals within 60 days, and if denied, the controller must provide a mechanism for the consumer to submit a complaint to the attorney general.
Proposedlawprovidesthatanycontractualprovision waivingorlimitingaconsumer'sright is against public policy and is void and unenforceable.
Proposed law requires a controller to establish at least two secure and reliable methods for consumers to submit requests to exercise their rights, taking into account customary consumer interactions, secure communication, and authentication needs.
Page 24 of 27 Coding:
Words which are struck through are deletions from existing law;
words in boldface type and underscored are additions.
SLS 26RS-431 REENGROSSED SB NO.
386 Proposed law prohibits a controller from requiring a consumer to create a new account to exercise rights.
Requires a website mechanism for submitting requests if the controller maintains a website.
Requires exclusively online controller with a direct consumer relationship to provide only an email address for submission of requests.
Proposed law allows a consumer to designate an authorized agent, including through technology-basedopt-out signals such as a browsersettingor device-levelsignals, to act on the consumer's behalf for opt-out requests.
Proposedlawprovidesthattechnologyusedbyaconsumerto designateanauthorizedagent or communicate an opt-out request shall not unfairlydisadvantage a controller.
Proposed law requires that such technologynot relyon a default setting and instead require an affirmative, freely given, and unambiguous choice by the consumer to opt-out of the processing of personal data.
Further requires that the technology be consumer friendlyand easy to use.
Proposed law requires a controller to limit collection of personal data to what is adequate, relevant, and reasonably necessary for disclosed purposes and to maintain reasonable administrative, technical, and physical safeguards appropriate to the volume and nature of the data.
Proposedlawprohibitsacontrollerfromprocessingpersonaldataforpurposesincompatible with disclosed purposes without consumer consent.
Proposed law clarifies that a controller is not required to provide goods or services that require personal data it does not collect or maintain and mayoffer different prices, rates, or benefits in connection with a consumer's opt-out or participation in a loyalty or rewards program.
Proposed law requires a controller to provide consumers with a reasonably accessible and clear privacy notice.
Provides that the notice must disclose the categories of personal data processed, including sensitive data, the purpose for processing, the process for exercising consumer rights and appealing decisions, the categories of personal data, the categories of third parties receiving data, and the methods available for submitting consumer rights requests.
Proposed law requires that a controller engaging in the sale of sensitive personal data and the sale of biometric personal data post a conspicuous notice.
Proposed law requires that if a controller sells personal data to third parties or processes personaldatafortargetedadvertising,thecontrollermustclearlyandconspicuouslydisclose such processing and provide notice of the manner in which a consumer may exercise the right to opt-out.
Proposed law requires a processor to adhere to the instructions of a controller and to assist the controller in complying with duties under proposed law.
Further requires a processor to assist the controller in responding to consumer rights requests using appropriate technical and organizational measures, taking into account the nature of processing and the information available to the processor.
Proposed law requires the processor to provide information necessary for the controller to conduct and document required data protection assessments.
Proposed law requiresthatprocessingperformedbya processoron behalf of a controller be governed by a written contract with specific requirements.
Further allows a processor to obtain an independent assessment using an accepted control standard or framework and to provide the report to the controller upon request.
Page 25 of 27 Coding:
Words which are struck through are deletions from existing law;
words in boldface type and underscored are additions.
SLS 26RS-431 REENGROSSED SB NO.
386 Proposed law clarifies that proposed law does not relieve either a controller or processor of liability arising from its respective role under proposed law.
Further provides that when a person is acting as a controller or processor is determined by a fact-based analysis of the specific processingcontext and that a processorremains a processorso long as it adheres to the controller's instructions.
Proposedlawrequiresacontrollertoconductanddocumentadataprotectionassessmentfor specifiedprocessingactivities.Furtherrequiresthattheassessmentweighthebenefitsofthe processing against potential risks to consumer rights, taking into account safeguards to mitigate risks.
Proposed law requires a controller to provide a data protection assessment that shall be confidentialandexemptfrompublicrecordsdisclosureto theattorneygeneraluponrequest pursuant to a civil investigative demand.
Proposed law provides that proposed law shall be construed to prevent a controller or processorfrompreventing,detecting,protectingagainst,orrespondingtosecurityincidents, identity theft, fraud, harassment, malicious or deceptive activity, or illegal activity, or from preserving system integrity or investigating, reporting, or prosecuting such conduct.
Proposed law requires controllers possessing deidentified data to take reasonable measures topreventreidentification,publiclycommitnottoreidentifythedata,andbindrecipientsby contrast to comply with proposed law.
Proposed law provides that controllers and processors are not required to reidentifydata or comply with certain consumer requests when the data cannot reasonably be linked to a specific consumer and is not sold or disclosed.
Further requires reasonable oversight of contracts related to deidentified or psendonymous data.
Proposed law prohibits the sale of sensitive personal data without prior consumer consent.
Proposed law authorizes the attorney general to enforce any violations of proposed law.
Requirestheattorneygeneraltopostonitswebsiteinformationregardingtheresponsibilities of controllers and processors and consumer rights.
Proposed law provides that a violation under proposed law constitutes an unfair and deceptive trade practice.
Further, excludes a private right of action, and requires that any monies received from enforcement bythe attorneygeneral be used for consumer protection and education efforts.
Proposed law requires the attorney general beginning January1, 2027, and ending July 21, 2027, to provide written notice of an alleged violation at least 30 days prior to initiating an investigation.
Further provides that the attorneygeneral shall not initiate an investigation if the person cures the violation by providing written certification and supporting documentation of the cure, notifies affected consumers when applicable, and makes necessary internal policy changes to prevent future violations.
Effective January 1, 2027.
(Adds R.S.
51:1776-1780) Summary of Amendments Adopted by Senate Committee Amendments Proposed bySenate Committee on Commerce,Consumer Protection, and International Affairs to the original bill 1.
Limits applicability of proposed law to persons that do business in the state and meet specified revenue or data-processingthresholds.
Page 26 of 27 Coding:
Words which are struck through are deletions from existing law;
words in boldface type and underscored are additions.
SLS 26RS-431 REENGROSSED SB NO.
386 2.
Adds an exception allowing controllers and processors to take necessary actions to prevent and respond to fraud, security threats, and illegal activity and to protect system integrity.
3.
Creates an unfair trade practice for any violations of proposed law and provide for enforcement bythe attorney general.
4.
Establishes a temporary cure period before enforcement of proposed law.
5.
Removesprovisionsauthorizingtheattorneygeneralto bringcivilactionfor penalties.
6.
Eliminates the private right of action for consumers.
7.
Makes effective date January 1, 2027.
8.
Makes technical changes.
Senate Floor Amendments to engrossed bill 1.
Makes technical changes.
Page 27 of 27 Coding:
⬇ Download PDF
View plain text versions (6)

Amendments

7 amendments

Click Show changes on an amendment above to see how it modifies the bill.

Action History

  1. Signed by the Governor. Becomes Act No. 502.

  2. Effective date 1/1/2027.

  3. Signed by the Speaker of the House.

  4. Enrolled. Signed by the President of the Senate.

  5. Sent to the Governor by the Secretary of the Senate.

  6. Amendments proposed by the House read and concurred in by a vote of 34 yeas and 0 nays.

  7. Scheduled for floor debate on 05/18/2026.

  8. Read third time by title, amended, roll called on final passage, yeas 94, nays 0. Finally passed, ordered to the Senate.

  9. Received from the House with amendments.

  10. Read by title, amended, passed to 3rd reading.

  11. Reported without Legislative Bureau amendments.

  12. Reported with amendments (9-0). Referred to the Legislative Bureau.

  13. Read by title, under the rules, referred to the Committee on Commerce.

  14. Received in the House from the Senate, read by title, lies over under the rules.

  15. Senate floor amendments read and adopted. Read by title and passed by a vote of 36 yeas and 0 nays; ordered reengrossed and sent to the House. Motion to reconsider tabled.

  16. Read by title. Committee amendments read and adopted. Ordered engrossed and passed to third reading and final passage.

  17. Reported with amendments.

  18. Introduced in the Senate; read by title. Rules suspended. Read second time and referred to the Committee on Commerce, Consumer Protection and International Affairs.

  19. Prefiled and under the rules provisionally referred to the Committee on Commerce, Consumer Protection and International Affairs.

Sponsors

Sponsorship breakdown

Export CSV (upgrade) →

1 sponsors · 11 co-sponsors · 135 not signed on

Sponsors (1)

Co-sponsors (11)

Not signed on (135)

135 members have not signed on to this bill.

Show all 135 →

"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.

Whip count is in markup. Polling the chamber and every recorded vote this session. Only the first open is slow. It’s instant for you after this. Calling the roll · Tallying · Engrossing

Votes

CONCUR (#1044)

Passed 34 Yea · 0 Nay · 5 Other
Party YeaNayPresentNot Voting
Unaffiliated 1000
Republican 26001
Democrat 7004
Total 34005
% of votes cast 87%0%0%13%
How each member voted (39)
Member Party Vote
Mr. President — Yea
Edward J. Price Democrat Yea
Gary Carter Democrat Yea
Gerald Boudreaux Democrat Yea
Jay Luneau Democrat Yea
Jimmy Harris Democrat Yea
Katrina R. Jackson-Andrews Democrat Not Voting
Larry Selders Democrat Not Voting
Regina Barrow Democrat Not Voting
Royce Duplessis Democrat Not Voting
Sam Jenkins Democrat Yea
Sidney Barthelemy II Democrat Yea
Adam Bass Republican Yea
Alan Seabaugh Republican Yea
Beth Mizell Republican Yea
Blake Miguez Republican Yea
Bob Hensgens Republican Yea
Brach Jerad Myers Republican Not Voting
Caleb Kleinpeter Republican Yea
Eddie J. Lambert Republican Yea
Franklin J. Foil Republican Yea
Glen Womack Republican Yea
Gregory A. Miller Republican Yea
Heather Cloud Republican Yea
Jeremy Stine Republican Yea
John C. "Jay" Morris Republican Yea
Jr., William "Bill" Wheat Republican Yea
Kirk Talbot Republican Yea
Mark Abraham Republican Yea
Michael "Big Mike" Fesi Republican Yea
Mike Reese Republican Yea
Patrick Connick Republican Yea
Patrick McMath Republican Yea
Rick Edmonds Republican Yea
Robert "Bob" Owen Republican Yea
Robert Allain Republican Yea
Stewart Jr. Cathey Republican Yea
Thomas A. Pressly Republican Yea
Valarie Hodges Republican Yea

Official roll call →

FINAL PASSAGE (#1341)

Passed 94 Yea · 0 Nay · 11 Other
Party YeaNayPresentNot Voting
Democrat 27003
Republican 61007
Unaffiliated 6001
Total 940011
% of votes cast 90%0%0%10%
How each member voted (105)
Member Party Vote
Amedee — Yea
Galle — Yea
Stagni — Yea
Mr. Speaker — Not Voting
Johnson, T. — Yea
Landry, T. — Yea
St. Blanc — Yea
Adrian Fisher Democrat Yea
Aimee Adatto Freeman Democrat Yea
Alonzo L. Knox Democrat Yea
Barbara Carpenter Democrat Yea
C. Denise Marcelle Democrat Yea
Candace N. Newell Democrat Yea
Chasity Martinez Democrat Yea
Dana Henry Democrat Yea
Delisha Boyd Democrat Yea
Ed Murray Democrat Yea
Edmond Jordan Democrat Yea
Gerald Boudreaux Democrat Yea
III, Ed Larvadain Democrat Yea
Joy Walters Democrat Not Voting
Jr., Kyle M. Green Democrat Yea
Ken Brass Democrat Yea
Mandie Landry Democrat Not Voting
Marcus Anthony Bryant Democrat Yea
Pat Moore Democrat Yea
Rashid Armand Young Democrat Not Voting
Robby Carter Democrat Yea
Rodney Lyons Democrat Yea
Roy Daryl Adams Democrat Yea
Shaun Raphael Mena Democrat Yea
Sr., Wilford Carter Democrat Yea
Steven Jackson Democrat Yea
Sylvia Elaine Taylor Democrat Yea
Tammy T. Phelps Democrat Yea
Tehmi Jahi Chassion Democrat Yea
Vanessa Caston LaFleur Democrat Yea
Annie Spell Republican Yea
Barbara Reich Freiberg Republican Yea
Beth Anne Billings Republican Yea
Brett F. Geymann Republican Yea
Brian Leonard Glorioso Republican Yea
Bryan Fontenot Republican Yea
Chad Michael Boyer Republican Yea
Chance Keith Henry Republican Yea
Christopher Turner Republican Yea
Danny McCormick Republican Yea
Daryl Andrew Deshotel Republican Yea
Debbie Villio Republican Yea
Dixon Wallace McMakin Republican Yea
Dodie Horton Republican Yea
Emily Chenevert Republican Yea
Foy Bryan Gadberry Republican Yea
Francis C. Thompson Republican Not Voting
Gregory A. Miller Republican Yea
III, Roger William Wilder Republican Yea
III, Vincent E. Cox Republican Yea
IV, Gerald "Beau" Beaullieu Republican Yea
Jack McFarland Republican Not Voting
Jacob Braud Republican Yea
Jacob Jules Landry Republican Yea
Jason Brian DeWitt Republican Yea
Jeffrey "Jeff" Fons Wiley Republican Yea
Jeremy LaCombe Republican Yea
Jerome Zeringue Republican Not Voting
Jessica Domangue Republican Yea
John E. Wyble Republican Yea
Joseph A. Orgeron Republican Yea
Josh Carlson Republican Yea
Jr., Dennis Bamburg Republican Yea
Jr., John R. Illg Republican Yea
Jr., Michael Robert Bayham Republican Yea
Kathy Edmonston Republican Yea
Kellee Hennessy Dickerson Republican Yea
Kim Carver Republican Yea
Kimberly Landry Coates Republican Yea
Larry A. Bagley Republican Not Voting
Lauren Ventrella Republican Yea
Laurie Schlegel Republican Yea
Les Farnum Republican Not Voting
Mark Wright Republican Not Voting
Michael "Gabe" Firment Republican Yea
Michael Charles Echols Republican Yea
Michael Melerine Republican Yea
Mike Johnson Republican Yea
Neil Riser Republican Yea
Nicholas Muscarello Republican Yea
Paul Sawyer Republican Yea
Phillip Eric Tarver Republican Yea
Polly Thomas Republican Yea
R. Dewith Carrier Republican Yea
Raymond J. Crews Republican Yea
Reese "Skip" Broussard Republican Yea
Rhonda Gaye Butler Republican Yea
Robert "Bob" Owen Republican Yea
Rodney Schamerhorn Republican Yea
Ryan Bourriaque Republican Yea
Shane Mack Republican Yea
Sr., Peter F. Egan Republican Yea
Stephanie H. Berault Republican Yea
Stephanie Hilferty Republican Not Voting
Timothy P. Kerner Republican Yea
Tony Bacala Republican Yea
Troy Jude Hebert Republican Yea
Wayne McMahen Republican Yea

Official roll call →

CO-AUTHORS (#285)

Failed 10 Yea · 0 Nay · 29 Other
Party YeaNayPresentNot Voting
Unaffiliated 1000
Democrat 6005
Republican 30024
Total 100029
% of votes cast 26%0%0%74%
How each member voted (39)
Member Party Vote
Mr. President — Yea
Edward J. Price Democrat Yea
Gary Carter Democrat Not Voting
Gerald Boudreaux Democrat Not Voting
Jay Luneau Democrat Yea
Jimmy Harris Democrat Not Voting
Katrina R. Jackson-Andrews Democrat Yea
Larry Selders Democrat Yea
Regina Barrow Democrat Yea
Royce Duplessis Democrat Not Voting
Sam Jenkins Democrat Yea
Sidney Barthelemy II Democrat Not Voting
Adam Bass Republican Not Voting
Alan Seabaugh Republican Not Voting
Beth Mizell Republican Not Voting
Blake Miguez Republican Not Voting
Bob Hensgens Republican Not Voting
Brach Jerad Myers Republican Not Voting
Caleb Kleinpeter Republican Not Voting
Eddie J. Lambert Republican Not Voting
Franklin J. Foil Republican Not Voting
Glen Womack Republican Yea
Gregory A. Miller Republican Yea
Heather Cloud Republican Not Voting
Jeremy Stine Republican Yea
John C. "Jay" Morris Republican Not Voting
Jr., William "Bill" Wheat Republican Not Voting
Kirk Talbot Republican Not Voting
Mark Abraham Republican Not Voting
Michael "Big Mike" Fesi Republican Not Voting
Mike Reese Republican Not Voting
Patrick Connick Republican Not Voting
Patrick McMath Republican Not Voting
Rick Edmonds Republican Not Voting
Robert "Bob" Owen Republican Not Voting
Robert Allain Republican Not Voting
Stewart Jr. Cathey Republican Not Voting
Thomas A. Pressly Republican Not Voting
Valarie Hodges Republican Not Voting

Official roll call →

FINAL PASSAGE (#284)

Passed 36 Yea · 0 Nay · 3 Other
Party YeaNayPresentNot Voting
Unaffiliated 1000
Republican 24003
Democrat 11000
Total 36003
% of votes cast 92%0%0%8%
How each member voted (39)
Member Party Vote
Mr. President — Yea
Edward J. Price Democrat Yea
Gary Carter Democrat Yea
Gerald Boudreaux Democrat Yea
Jay Luneau Democrat Yea
Jimmy Harris Democrat Yea
Katrina R. Jackson-Andrews Democrat Yea
Larry Selders Democrat Yea
Regina Barrow Democrat Yea
Royce Duplessis Democrat Yea
Sam Jenkins Democrat Yea
Sidney Barthelemy II Democrat Yea
Adam Bass Republican Yea
Alan Seabaugh Republican Yea
Beth Mizell Republican Yea
Blake Miguez Republican Not Voting
Bob Hensgens Republican Yea
Brach Jerad Myers Republican Yea
Caleb Kleinpeter Republican Yea
Eddie J. Lambert Republican Yea
Franklin J. Foil Republican Yea
Glen Womack Republican Yea
Gregory A. Miller Republican Yea
Heather Cloud Republican Not Voting
Jeremy Stine Republican Yea
John C. "Jay" Morris Republican Yea
Jr., William "Bill" Wheat Republican Yea
Kirk Talbot Republican Yea
Mark Abraham Republican Yea
Michael "Big Mike" Fesi Republican Yea
Mike Reese Republican Yea
Patrick Connick Republican Yea
Patrick McMath Republican Not Voting
Rick Edmonds Republican Yea
Robert "Bob" Owen Republican Yea
Robert Allain Republican Yea
Stewart Jr. Cathey Republican Yea
Thomas A. Pressly Republican Yea
Valarie Hodges Republican Yea

Official roll call →

Subjects

civil-rights technology
Cross-referencing the record. Reading this bill against every other bill in the corpus by meaning, not keywords. Only the first open is slow. It’s instant for you after this. Matching · Ranking · Engrossing

Frequently asked questions

Who sponsors SB 386?
SB 386 is sponsored by Tehmi Jahi Chassion (Democrat), Glen Womack (Republican), Jeremy Stine (Republican), Larry Selders (Democrat), Edward J. Price (Democrat), Gregory A. Miller (Republican), Jay Luneau (Democrat), Sam Jenkins (Democrat), Katrina R. Jackson-Andrews (Democrat), Cameron Henry (Republican), Regina Barrow (Democrat), and Patrick Connick (Republican).
What is the current status of SB 386?
This bill has been enacted into law. Introduced February 27, 2026. Enacted.
Where can I track SB 386?
Track SB 386 free on One Click Politics — get push/email alerts when it moves.

Make your voice heard on SB 386

Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.

Find my representatives → Run a campaign

Stay ahead of SB 386

Last checked for changes 3 months ago · updated continuously

One Click Politics tracks every bill in Congress and all 50 states.

Track this bill →