State privacy laws have been arriving steadily for a few years now, and it's easy to let them blur together. This one is worth a closer look — partly because of what it says about biometric data, and partly because of an enforcement detail that gives it unusually sharp teeth unusually fast.
What actually passed
The Louisiana Data Privacy Act (Senate Bill 386) was signed by Governor Jeff Landry on May 29, 2026, after passing the Louisiana House unanimously — 94 to 0. It takes effect January 1, 2027.
It applies to businesses operating in Louisiana that clear at least one of three bars: more than $25 million in annual revenue, personal data on 75,000+ consumers, households or devices a year, or half their revenue coming from selling personal data. That last threshold matters more than it looks — data brokers and people-search operations are exactly the businesses that derive most of their revenue from selling personal information, which puts them squarely in scope regardless of size.
The rights Louisiana residents get
From January 1, 2027, if you live in Louisiana you can legally require a covered business to:
- Confirm whether it's processing your personal data at all;
- Access that data and get a portable copy of it;
- Correct data that's wrong;
- Delete your personal data — the big one;
- Opt out of targeted advertising, data sales, and automated decision-making that produces significant effects.
Enforcement belongs exclusively to the Louisiana Attorney General — there's no private right of action, so individuals can't sue directly. That's typical of the recent wave of state laws, and it means the practical value of these rights comes from exercising them: filing the requests, keeping the records, and escalating to the AG when a business ignores you.
The biometric part — opt-in, not opt-out
Here's the piece that matters most for readers of this blog. The LDPA classifies biometric data processed for the purpose of uniquely identifying a person as sensitive data — the same protected tier as health diagnoses and genetic information. And sensitive data doesn't get the opt-out treatment. It requires affirmative opt-in consent before processing.
Think about what a faceprint is: a biometric template built specifically to uniquely identify you. That's not an edge case of this definition — it's the bullseye. A face-search engine that scraped a Louisiana resident's photos and built a searchable faceprint never obtained opt-in consent, because these engines don't ask anyone. From January 2027, that's not a grey area in Louisiana. It's a defined category of sensitive data processed without the required consent.
The seven-month clock nobody's talking about
Most state privacy laws launch with a long "cure period" — a grace window where businesses get formal notice and time to fix violations before enforcement. Louisiana's is unusually short and unusually pointed: from January 1 through July 31, 2027, the Attorney General must give 30 days' written notice before opening a formal investigation. After July 31, that courtesy ends. No notice, no cure — straight to enforcement.
The signal is deliberate: Louisiana wants compliance fast. For businesses holding Louisianans' data — including biometric databases — the window to get clean is short.
What this means for your face
Laws like this are only as useful as the requests filed under them. A right to deletion doesn't delete anything by itself — someone has to send the request, cite the statute, meet each database's process, and follow up when they're ignored or re-added.
That's the job we already do. Our removal requests to face-search engines cite the strongest legal basis available for each person — GDPR for Europeans, CCPA for Californians, BIPA in Illinois. When the LDPA takes effect in January 2027, Louisiana residents get their own statutory backing added to that list: a deletion right, plus the opt-in consent rule their faceprints almost certainly never satisfied.
This article is general information, not legal advice. If you need advice about your specific situation, talk to a lawyer licensed in Louisiana.
Your rights only work if someone exercises them.
FacePrivacy files removal requests with the major face-search engines, citing the privacy laws that apply to you — and keeps filing as new laws like the LDPA take effect.
Protect your face →