Louisiana

No student, faculty member, member of the administrative staff, or other employee at an elementary or secondary school may use deepfake material against a student enrolled in kindergarten through grade twelve with the intent to coerce, harass, intimidate, or maliciously disseminate or sell the material.

Deepfake means audio or visual media in an electronic format that is created, altered, or digitally manipulated so that it would falsely appear to a reasonable observer to be an authentic record of an individual's actual speech or conduct, or that replaces an individual's likeness with another individual's. The State Board of Elementary and Secondary Education, in collaboration with the state Department of Education, adopts the implementing rules. Senate Bill 346 was signed as Act 496 on May 29, 2026. The act sets an effective date of August 1, 2026.

Senate Bill 42 of the 2026 Regular Session, signed as Act No. 892, amends the definitions in Revised Statutes 14:81.1, the child sexual abuse materials offense, to prohibit the use of artificial intelligence to create child sexual abuse materials. The offense makes it unlawful for a person to produce, promote, advertise, distribute, possess, or possess with the intent to distribute child sexual abuse materials.

Child sexual abuse materials include any photograph, film, video, picture, digital image or picture, computer image or picture, or computer-generated image or picture, whether made or produced by electronic, mechanical, or other means, of any sexual performance involving a child under the age of seventeen.

For that definition, a child includes both a natural person under the age of seventeen years and an image or other visual representation of a child under the age of seventeen years that is created or generated by electronic or digital means, including artificial intelligence, and that, to a reasonable person, is a virtually indistinguishable depiction of a child under the age of seventeen years.

To produce child sexual abuse materials means to photograph, videotape, film, cause to be digitally generated, including by artificial intelligence, or otherwise reproduce them, or to solicit, promote, or coerce any child for the purpose of child sexual abuse materials.

Whoever intentionally possesses child sexual abuse materials shall be fined not more than fifty thousand dollars and imprisoned at hard labor for not less than five years or more than twenty years, without benefit of parole, probation, or suspension of sentence.

Whoever distributes or possesses with the intent to distribute child sexual abuse materials shall be fined not more than fifty thousand dollars and imprisoned at hard labor for not less than five years or more than twenty years, without benefit of parole, probation, or suspension of sentence.

Whoever engages in the promotion, advertisement, or production of child sexual abuse materials shall be fined not more than fifty thousand dollars and imprisoned at hard labor for not less than ten years nor more than twenty years, without benefit of probation, parole, or suspension of sentence. The Governor signed Senate Bill 42 on June 9, 2026, and it became Act No. 892. The act's effective date is August 1, 2026.

As part of a broad, Louisiana State Law Institute-recommended revision of the Code of Civil Procedure, Article 371 was amended to add that an attorney shall not knowingly encourage or produce false evidence, including evidence that is artificially generated or altered by any means, and shall exercise reasonable diligence to verify the authenticity of evidence before offering it to a court.

Offering evidence that the attorney knew or should have known through reasonable diligence was false or artificially manipulated, without disclosing that fact, is a violation of the Article, subjecting the attorney to punishment for contempt of court and other professional discipline. Signed by Governor Landry on June 11, 2025 as Act 250 (House Bill 178) and in effect since August 1, 2025.

No person may make or cause to be made a telephone call or automated call in a political campaign that is created using artificial intelligence and uses the voice of a public figure, an elected official, or a limited public figure, without a clear and understandable disclosure at the beginning of the call that it was created using artificial intelligence.

An interactive computer service, internet or telecommunications service provider, or broadcaster is not liable for content provided by another person. A first violation is punishable by a civil fine of not more than $2,500 and a second or subsequent violation by a civil fine of not more than $5,000; the Board of Ethics administers and enforces this Section. Signed by Governor Landry on May 29, 2026 as Act 559 and in effect since August 1, 2026.

No person may make or cause to be made an electioneering communication that portrays a candidate for elective office or an elected official subject to recall and that is created, altered, or digitally manipulated using artificial intelligence in a manner that would falsely appear to a reasonable observer to be an authentic record of that person's actual speech or conduct, without a clear and understandable disclosure that it was created using artificial intelligence.

Artificial intelligence is defined by cross-reference to R.S. 14:73.14. A media entity that broadcasts a paid political communication over which it had no input or control is exempt. Signed by Governor Landry on June 9, 2026 as Act 806 and in effect since August 1, 2026; a substantially similar bill, SB 97 of the 2024 Regular Session, passed both chambers but was vetoed by the Governor on June 20, 2024.

Louisiana's pre-existing Database Security Breach Notification Law (La. R.S. 51:3071 to 51:3077), first enacted 2005 (effective January 1, 2006) and last substantively amended 2018, is independent of the LDPA and already in force.

Personal information is an individual's name combined with a Social Security number, driver's license or state ID number, financial account or card number with an access code, passport number, or biometric data used to uniquely authenticate identity when accessing a system or account (a narrower, authentication-scoped biometric definition than the LDPA's, with no recording-derived exclusion or clawback of its own), and excludes publicly available government-record information. The provisions this entry describes came into force on different days.

Notice to affected Louisiana residents is required in the most expedient time possible and without unreasonable delay, no later than 60 days after discovery, with written reasons for any delay owed to the Attorney General. No notice at all is required if, after investigation, there is no reasonable likelihood of harm, subject to a five-year document-retention duty for that determination. The provisions this entry describes came into force on different days.

Under Revised Statutes 22:2506, a licensee must notify the commissioner of insurance without unreasonable delay, and in no event later than three business days, from a determination that a cybersecurity event involving nonpublic information in the licensee's possession has occurred when a listed criterion is met.

Under section 22:2503 of the Revised Statutes, a licensee is any person licensed, authorized to operate, or registered or required to be licensed, authorized, or registered pursuant to the insurance laws of this state.

Revised Statutes 22:2506 applies when this state is the licensee's state of domicile (an insurer) or home state (a producer or adjuster) and the event has a reasonable likelihood of materially harming a consumer residing in this state or a material part of the licensee's normal operations, or when the licensee reasonably believes the nonpublic information involved is for 250 or more consumers residing in this state and a listed event has occurred.

Under Revised Statutes 22:2506, a licensee has a continuing obligation to update and supplement its initial and subsequent notifications to the commissioner regarding material changes to previously provided information. Revised Statutes 22:2506 requires a licensee to comply with the Database Security Breach Notification Law and to give the commissioner a copy of the notice sent to consumers if the licensee must notify the commissioner.

Under Revised Statutes 22:2509(C), a licensee subject to Revised Statutes 51:3076 is exempt from Revised Statutes 22:2506 if it notifies affected consumers and the commissioner consistently with the Gramm-Leach-Bliley Act and at the same time as it notifies federal regulatory authorities. Under Revised Statutes 22:2510, the commissioner may impose a penalty for a violation of the Insurance Data Security Law pursuant to Revised Statutes 22:18.

Under section 22:18 of the Revised Statutes, the commissioner of insurance may, in lieu of suspension or revocation of a certificate of authority or license, levy a fine not to exceed $1,000 for each violation per insurer, person or entity violating any provision of the Insurance Code.

Act 325 of the 2026 Regular Session increased the aggregate annual cap on the commissioner's fines under section 22:18 from $100,000 to $1,000,000 for insurers, persons, entities, health insurance issuers and limited licensees per calendar year. Act 325 of the 2026 Regular Session is effective May 22, 2026.

A licensee must maintain records concerning all cybersecurity events for at least five years from the date of each event and must produce those records upon demand of the commissioner. Where a cybersecurity event has or may have occurred in a system maintained by a third-party service provider, the licensee must make reasonable efforts to complete the investigation steps in Subsection B or to confirm and document that the provider has completed them.

A licensee is any person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Louisiana.

The Louisiana Data Privacy Act, enacted as Act No. 502 of the 2026 Regular Session (formerly SB 386) and signed by Governor Landry on May 29, 2026, applies to a person or entity doing business in Louisiana that meets any one of three independent thresholds: annual gross revenue exceeding $25 million, annually buying, receiving, selling, or sharing for commercial purposes the personal data of 75,000 or more consumers, households, or devices, or deriving 50% or more of annual revenue from selling personal data.

Exemptions include state agencies and political subdivisions, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions, nonprofits, higher-education institutions, and Health Insurance Portability and Accountability Act (HIPAA)-covered entities and business associates, plus a separate household or personal-activity carve-out. Controllers and processors carry General Data Protection Regulation (GDPR) and VCDPA-style duties, including data protection assessments, processor contracts, and purpose limitation, under Sec. 1780.4. The Act takes effect January 1, 2027.

Under Revised Statutes 51:3184, a medical facility, human genomic research facility or company must restrict the storage of human genetic sequencing data to geographic locations outside of a foreign adversary country, and remote access to data storage, other than open data, from a foreign adversary country is prohibited.

Under Revised Statutes 51:3184, a medical facility, human genomic research facility or company storing human genetic sequencing data, including through contracts with third-party data storage companies, must ensure its security by using reasonable encryption methods, restrictions on access and other cybersecurity best practices.

Under Revised Statutes 51:3185, a medical facility, human genomic research facility or company that knowingly violates the chapter by storing human genetic sequencing data in a foreign adversary country is fined $10,000 per violation. Under Revised Statutes 51:3185, the attorney general has the sole authority to investigate allegations of violations of the Louisiana Human Genomic Security Act and to enforce Revised Statutes 51:3183 and 3184.

Under Revised Statutes 40:1165.1, each health care provider must furnish each patient, on request, a copy of any information related in any way to the patient that the provider has transmitted to any company, public or private agency, or person. Under Revised Statutes 40:1165.1, a patient or his legal representative has a right to obtain a copy of the entirety of the patient's treatment records in the form in which they exist on furnishing a signed authorization.

Under Revised Statutes 40:1165.1, a violation of the record-copy and charge provisions that is not corrected within fifteen days of receipt of written notice is subject to a civil penalty of $500 per violation, plus attorney fees and costs at the court's discretion, payable to the requestor of the medical records. Under Revised Statutes 40:1165.1, medical and dental records must be retained by a physician or dentist for a minimum of six years from the date a patient is last treated. The provisions this entry describes came into force on different days.

Regulation 76 governs the treatment of nonpublic personal financial information about individuals by all licensees of the state insurance department.

It applies to nonpublic personal financial information about individuals who obtain or are claimants or beneficiaries of products or services primarily for personal, family or household purposes from licensees, and does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes.

A licensee is any licensed insurer, producer or other person licensed or required to be licensed, authorized or required to be authorized, or registered or required to be registered with the Commissioner of Insurance.

A licensee must give an individual who becomes its customer a clear and conspicuous notice that accurately reflects its privacy policies and practices not later than when it establishes the customer relationship, and must give a consumer such a notice before it discloses any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as the regulation's exceptions authorize.

A licensee must give its customers such a notice not less than annually during the continuation of the customer relationship, meaning at least once in any period of 12 consecutive months during which that relationship exists.

A licensee that has not changed its policies and practices on disclosing nonpublic personal information from those disclosed in the most recent disclosure sent to consumers, and that provides the information to nonaffiliated third parties only in accordance with the regulation, is not required to provide an annual disclosure until it fails to meet those criteria.

Each initial, annual and revised privacy notice must include the categories of nonpublic personal financial information the licensee collects, the categories it discloses, and the categories of affiliates and nonaffiliated third parties to whom it discloses.

Each such notice must also include an explanation of the consumer's right to opt out of the disclosure of nonpublic personal financial information to nonaffiliated third parties, including the methods by which the consumer may exercise that right. Each such notice must also include the licensee's policies and practices with respect to protecting the confidentiality and security of nonpublic personal information.

An opt out notice must state that the licensee discloses or reserves the right to disclose nonpublic personal financial information about its consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means by which the consumer may exercise the opt out right.

A licensee may not, directly or through any affiliate, disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has provided the initial notice and the opt out notice, has given the consumer a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out.

A licensee that mails the notices gives a reasonable opportunity to opt out if it allows the consumer to opt out by mailing a form, calling a toll-free telephone number or any other reasonable means within 30 days from the date it mailed the notices.

A licensee may not, directly or through an affiliate, disclose a policy number or similar form of access number or access code for a consumer's policy or transaction account, other than to a consumer reporting agency, to a nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail to the consumer.

A licensee may not unfairly discriminate against a consumer or customer because the consumer or customer has opted out from the disclosure of nonpublic personal financial information. Any failure to comply with the regulation is a violation of Revised Statutes title 22, section 1214 and the sections that follow, and subjects the violator to the penalties provided in sections 22:1217 and 22:1217.1 of the Revised Statutes and any other applicable provision of law.

Regulation 76 was promulgated by the Department of Insurance in April 2001 and amended in March 2017. The regulation is effective upon adoption.

The LDPA gives a Louisiana consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, sale of personal data, and profiling producing a legal or similarly significant effect.

A controller must respond without undue delay and no later than 45 days after receipt, with one additional 45-day extension available if the controller notifies the consumer of the extension and its reason within the initial period. An appeal of a denial must be answered within 60 days, and a denial must include an online mechanism to reach the Attorney General. Any contract provision waiving or limiting a consumer's rights under this section is void and unenforceable as against public policy.

A violation of the Database Security Breach Notification Law is deemed an unfair act or practice under R.S. 51:1405(A), with no carve-out of the Unfair Trade Practices and Consumer Protection Law's own private-action provision. This is the opposite private-right-of-action answer from the LDPA in the same title of the same code: the LDPA expressly excludes R.S. 51:1409 and 1409.1, while this breach statute's deeming clause carries no such exclusion. Subsection (J)'s deeming clause was added by Acts 2018, No. 382, effective August 1, 2018.

The Louisiana Attorney General has exclusive authority to enforce the LDPA. A violation constitutes an unfair and deceptive trade practice under the Unfair Trade Practices and Consumer Protection Law (UTPCPL), R.S. 51:1401 et seq., but the Act expressly excludes the UTPCPL's own private-action provisions, R.S. 51:1409 and 1409.1, foreclosing a private right of action under the LDPA.

From January 1 to July 31, 2027, before bringing an action the Attorney General must give a person 30 days' written notice identifying the specific provisions violated, and may not initiate an investigation if the person cures the violation and confirms the cure in writing within that period.

R.S. 51:1409(A) lets any person who suffers an ascertainable loss from an unfair or deceptive practice declared unlawful by R.S. 51:1405 bring an individual action for actual damages, trebled if the practice was knowingly used after Attorney General notice, plus attorney fees and costs.

Because the Database Security Breach Notification Law's own deeming clause, R.S. 51:3074(J), routes a breach-notice violation into R.S. 51:1405(A) without excluding this section, a Louisiana resident harmed by a breach-notice violation can sue directly under this provision. A breach-notice violation became actionable under this provision when Act 382 of 2018 added the deeming clause to the Database Security Breach Notification Law, effective August 1, 2018.

Under Revised Statutes 23:368, an employer, labor organization or employment agency may not discharge, fail or refuse to hire, or otherwise discriminate against an employee with respect to compensation, terms, conditions or privileges of employment because of protected genetic information or information about a request for or receipt of genetic services.

Under Revised Statutes 23:368, an employer, labor organization or employment agency may not require, collect or purchase protected genetic information with respect to an employee, or information about a request for or receipt of genetic services by the employee, subject to the exceptions the section states.

Under Revised Statutes 23:368, an employer may not disclose protected genetic information about an employee except to the employee on request, to a qualifying health researcher, as required by a federal or state statute, subpoena or court order, or to executive branch officials investigating compliance.

Under Revised Statutes 23:368, an employer may not maintain protected genetic information in general personnel files, and must treat it as confidential medical records kept separate from personnel files. Under Revised Statutes 23:368, genetic monitoring of the biological effects of toxic substances in the workplace is permitted only if the employee has given prior knowing, voluntary and written authorization, is notified of the results, and the employer receives results only in aggregate terms.

Under section 23:303 of the Revised Statutes, a plaintiff who has a cause of action against an employer, employment agency or labor organization for a violation of the chapter may file a civil suit in a district court seeking compensatory damages, back pay, benefits, reinstatement or, if appropriate, front pay, reasonable attorney fees and court costs.

Under section 23:303 of the Revised Statutes, a plaintiff who intends to pursue court action must give the person who allegedly discriminated written notice at least thirty days before initiating court action. Under section 23:303 of the Revised Statutes, any cause of action provided in the chapter is subject to a prescriptive period of one year.

Under section 23:302 of the Revised Statutes, the chapter's provisions apply only to an employer who employs twenty or more employees within this state for each working day in each of twenty or more calendar weeks in the current or preceding calendar year. No day on which the provisions this entry describes came into force has been located.

Under Revised Statutes 22:1023, an insurer may not, on the basis of genetic information or a request for or receipt of genetic services, terminate, restrict, cancel, refuse to renew, deny or exclude coverage, impose an excluding rider, establish differentials in premium rates or cost sharing, or otherwise discriminate in the provision of insurance.

Under Revised Statutes 22:1023, an insurer may not request or require that an individual, a family member or a group member undergo a genetic test, subject to the research and treating-professional exceptions the section states. Under Revised Statutes 22:1023, an insurer may not obtain genetic information from an insured or enrollee, or from their DNA sample, without first obtaining written informed consent.

Under Revised Statutes 22:1023, an insured's or enrollee's genetic information is the property of the insured or enrollee, and no person may retain it without authorization from the insured, enrollee or their representative, unless retention is for a criminal or death investigation or proceeding or to determine paternity.

Under Revised Statutes 22:1023, a person who through negligence collects, stores or analyzes a DNA sample, or discloses genetic information, in violation of the section is liable to the individual for actual damages or $50,000, whichever is greater, and for treble damages where the violation resulted in profit, and a person who does so willfully is liable for actual damages or $100,000, whichever is greater.

Revised Statutes 22:1023 does not apply to actions of an insurer or third parties dealing with an insurer in the ordinary course of business in connection with the sale, issuance or administration of a life, disability income, long-term care or critical illness insurance policy.

Under section 22:18 of the Revised Statutes, the commissioner of insurance may, in lieu of suspension or revocation of a certificate of authority or license, levy a fine not to exceed $1,000 for each violation per insurer, person or entity violating any provision of the Insurance Code.

Act 325 of the 2026 Regular Session increased the aggregate annual cap on the commissioner's fines under section 22:18 from $100,000 to $1,000,000 for insurers, persons, entities, health insurance issuers and limited licensees per calendar year. No day on which the provisions this entry describes came into force has been located.

A covered platform, meaning an online platform, online video game, messaging application or video streaming service that accesses the internet and is used by a minor, owes a duty of care to a minor with whom it contracts.

The duty requires reasonable measures to prioritize the privacy of the minor's account, including a default that prohibits the platform from disclosing or sharing the minor's precise geolocation with anyone other than the minor's legal representative or a law enforcement representative authorized by law to receive it. A minor's legal representative may opt out of the protections by giving the platform express consent.

The Attorney General enforces the Section by a civil action for a fine of up to $10,000 per violation, after written notice of each alleged violation, and the owner or operator may cure within forty-five days of the notice.

Sensitive data under the LDPA includes personal data revealing racial or ethnic origin, religious belief, a mental or physical health diagnosis, sexuality, or citizenship or immigration status; genetic or biometric data processed to uniquely identify an individual; a known child's personal data; and precise geolocation data.

Biometric data means data generated by automatic measurement of an individual's biological characteristics used to identify a specific individual, such as a fingerprint, voiceprint, or eye retina or iris scan.

The definition excludes a physical or digital photograph, or data generated from a photograph, video, or audio recording, but claws that exclusion back whenever the data is generated to identify a specific individual, so a voiceprint or faceprint deliberately extracted from a recording for identification purposes remains biometric and sensitive data regardless of the recording's own origin or public status.

A person selling sensitive data under the Act's revenue-from-sale applicability threshold must first obtain the consumer's consent.

Under Revised Statutes 51:3183, a medical facility or research facility in this state may not put into service within this state any new or additional human genetic sequencers or operational and research software used for human genetic analysis produced by the government of a foreign adversary, a state-owned company of a foreign adversary or a foreign adversary company. Section 51:3183 took effect June 11, 2025.

Under Revised Statutes 51:3185, a medical facility or human genomic research facility that violates the chapter is fined $10,000 per violation, and a violation means each unique instance of an individual's genome having undergone genetic sequencing or analysis using a prohibited human genetic sequencer or prohibited operational or research software.

Under Revised Statutes 51:3185, the attorney general has the sole authority to investigate allegations of violations of the Louisiana Human Genomic Security Act and to enforce Revised Statutes 51:3183 and 3184.

Under Revised Statutes 13:3715.1, the exclusive method by which a person's medical, hospital or other treatment records may be obtained or disclosed by a health care provider is under Revised Statutes 40:1165.1, Code of Evidence Article 510, or a lawful subpoena or court order obtained as the section provides.

Under Revised Statutes 13:3715.1, records of the identity, diagnosis, prognosis or treatment of a patient maintained in a federally assisted substance or alcohol abuse program are confidential and may be disclosed only as 42 CFR Part 2 expressly authorizes. The page for Revised Statutes 13:3715.1 carries a note that the provision was included in the Unconstitutional Statutes Biennial Report to the Legislature dated March 14, 2016. The provisions this entry describes came into force on different days.

Under Revised Statutes 22:918, an insurer, in determining eligibility for coverage, establishing premiums, limiting coverage or making any other underwriting decision, may not take into consideration that an individual or family member participated in genetic research or testing, including a request for or receipt of genetic services, unless the individual provides the results for the insurer's consideration, and may not require or request that an individual or family member take a genetic test.

Under Revised Statutes 22:918, an insurer may not cancel, limit, refuse to renew, deny coverage or increase premium rates on an existing policy because an individual or family member requested or received genetic services or participated in genetic research, and may not purchase genetic information about an individual without the individual's written consent.

Revised Statutes 22:918 defines an insurer as an authorized insurer engaged in the business of making life insurance policies, long-term care insurance policies or annuity contracts, including a group insurance plan, or insurance agents and third-party administrators.

Revised Statutes 22:918 does not prevent an insurer from accessing an individual's medical record as part of the application process or from considering genetic information in an applicant's medical record that is relevant to a condition affecting mortality or morbidity, if based on sound actuarial principles or reasonably expected experience. Revised Statutes 22:918 was created by Act 242 of the 2021 Regular Session and amended by Act 224 of 2024 and Act 244 of 2025.

Under section 22:18 of the Revised Statutes, the commissioner of insurance may, in lieu of suspension or revocation of a certificate of authority or license, levy a fine not to exceed $1,000 for each violation per insurer, person or entity violating any provision of the Insurance Code.

Act 325 of the 2026 Regular Session increased the aggregate annual cap on the commissioner's fines under section 22:18 from $100,000 to $1,000,000 for insurers, persons, entities, health insurance issuers and limited licensees per calendar year.

Under Revised Statutes 17:3914, no city, parish or other local public school system, local or state governmental agency, public or private entity, or person with access to personally identifiable student information may sell, transfer, share or process student data for use in commercial advertising or marketing or any other commercial purpose, unless a contract for school services stipulates otherwise.

Under Revised Statutes 17:3914, a contractor to which a local school board transfers student information may not allow access to or release of student information except as the contract specifies, and may not use student information to conduct predictive modeling for the purpose of limiting the educational opportunities of students.

Under Revised Statutes 17:3914, a contract by which a local school board transfers student information must at a minimum provide for access guidelines, privacy compliance standards, privacy and security audits directed by the local school superintendent, breach planning, notification and remediation procedures, information storage, retention and disposition policies, and disposal of all information from the contractor's servers on termination.

Under Revised Statutes 17:3914, a person authorized to access a public school computer system on which student information is stored, other than a parent or legal guardian, must maintain the confidentiality of the student information to which he has access.

Under Revised Statutes 17:3914, a person who knowingly and willingly violates the contractor provisions is fined not more than $10,000 or imprisoned for not more than three years, or both, and any other violation is punishable by imprisonment for not more than six months or a fine of not more than $10,000. Section 17:3914 of the Revised Statutes was created by Act 837 of 2014 and was most recently amended by Act 478 of 2025, effective October 1, 2025.

Computer tampering under R.S. 14:73.7 is the intentional, knowing commission, without the authorization of the owner of a computer, of accessing or causing to be accessed a computer or any part of it, copying or otherwise obtaining a program or data, damaging or destroying a computer or its data, or introducing electronic information with the intent to damage or destroy.

Actions taken without authorization expressly include actions that intentionally exceed the limits of authorization, and using a confidential or proprietary access code that was not issued to the person creates a rebuttable presumption that the access was unauthorized or exceeded authorization.

Penalties are tiered: access or copying alone (paragraphs (A)(1) and (2)) is punishable by a fine of not more than five hundred dollars, imprisonment for not more than six months, or both; damage or destruction (paragraphs (A)(3) and (4)) by a fine of not more than ten thousand dollars, imprisonment with or without hard labor for not more than five years, or both; and damage or destruction intended to disrupt vital state, local, or utility services, or to cause death or great bodily harm, by a fine of not more than ten thousand dollars, imprisonment at hard labor for not more than fifteen years, or both.

Enacted by Acts 2001, No. 829, section 1.

Section 2504 of the Insurance Data Security Law requires a licensee to develop, implement, and maintain a comprehensive, written information security program based on its risk assessment that contains administrative, technical, and physical safeguards for the protection of nonpublic information and its information system.

A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, under the insurance laws of Louisiana, other than a purchasing group or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state.

A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information.

A licensee must exercise due diligence in selecting a third-party service provider and require the provider to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that the provider holds. Each insurer domiciled in Louisiana must submit to the commissioner a written statement by February 15, annually, certifying that the insurer is in compliance with the requirements of section 2504.

A licensee is exempt from section 2504 if it has fewer than twenty-five employees, less than five million dollars in gross annual revenue, or less than ten million dollars in year-end total assets. In the case of a violation of the chapter, the commissioner may impose a penalty pursuant to section 18 of Title 22 of the Revised Statutes.

A licensee that satisfies the chapter may assert an affirmative defense to a tort action alleging that its failure to implement reasonable information security controls resulted in a data breach concerning nonpublic information. Section 2504, other than subsection F, became effective on August 1, 2021. Subsection F of section 2504, on third-party service providers, became effective on August 1, 2022. The chapter does not create or imply a private cause of action for a violation of its provisions.

Any person that conducts business in Louisiana, or any person or agency that owns or licenses computerized data including personal information, must implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect it from unauthorized access, destruction, use, modification, or disclosure, and must take all reasonable steps to destroy or arrange for the destruction of records containing personal information no longer to be retained.

Because the same chapter's deeming clause, R.S. 51:3074(J), reaches a violation of this safeguards duty exactly as it reaches the chapter's breach-notice duty, and carries no exclusion of R.S. 51:1409, a Louisiana resident harmed by a violation can bring a private action for actual damages, trebled if the violation was knowing after Attorney General notice, plus attorney fees and costs.

A clerk of court must notify the secretary of state, or the secretary's designee, by telephone, electronic mail, or facsimile within twenty-four hours following the discovery of a cyber incident that impacts the office of the clerk of court related to any computer system connected to or maintained by the secretary of state. A cyber incident is an event that may jeopardize the confidentiality, integrity, or availability of digital information or information systems.

The legislature's bill history gives August 1, 2020 as the effective date of Act 217 of 2020, which enacted the section.

Commercial entities whose websites contain a substantial portion of material harmful to minors, as the Section defines that term, must perform reasonable age verification of Louisiana visitors. A companion statute enacted in 2023, section 51:2121 of the Louisiana Revised Statutes, separately lets the Attorney General sue for civil penalties alongside the private right of action in this Section.

Act 481 of 2025 had provided for these duties to begin on July 1, 2026. Act 185 of 2026 (HB 977) provides that Act No. 481 of the 2025 Regular Session shall not become effective. The Governor signed Act 185 on May 15, 2026. Act 185 enacts a replacement App Store Accountability Act as sections 51:1771 through 51:1775 of Title 51 of the Louisiana Revised Statutes. The sections of Act 185 that enact the replacement take effect on July 1, 2027.

A covered application store provider must, when an individual located in Louisiana creates an account, request age information and verify the individual's age category using commercially available methods reasonably designed to ensure accuracy.

If the individual is a minor, the provider must require the account to be affiliated with a parent account and obtain verifiable parental consent before the minor downloads an application, purchases an application, accesses a pre-loaded application, or enables in-application purchases. A provider may not enforce a contract or terms of service against a minor unless it has obtained verifiable parental consent.

A developer must verify through the covered application store's data sharing methods the age category of users located in Louisiana and, for a minor account, whether verifiable parental consent has been obtained.

The Attorney General may bring a civil action to enforce the law, and a covered application store or developer that violates it is subject to a civil fine of up to $10,000 per violation set by the Attorney General.

The Attorney General must give written notice at least forty-five days before initiating an enforcement action and may not initiate one if the person cures the violation within forty-five days after receiving the notice, with exceptions for a failure to cure and a repeat violation of the same provision.