Louisiana now has a consumer data privacy law. Senate Bill 386 (the “Louisiana Data Privacy Act”) was signed into law by Governor Jeff Landry on May 29, 2026, making the state the twenty-second to enact a comprehensive privacy law and the third this year (following Oklahoma and Alabama). It takes effect January 1, 2027.

National coverage has filed it accordingly: another Washington (State) Privacy Act-model law, broadly familiar to anyone already living under Texas’s or California’s regimes. That framing is correct, and for most readers it is enough. But for anyone tracking how artificial intelligence is being written into (or out of) state law, it misses the more telling development. The version of SB 386 the Senate passed in April carried explicit "artificial intelligence system" language, lifted from Texas. The version Landry signed does not. The clause was deleted on its way through the House, and the deletion is the story.

What SB 386 Does

Act No. 502 creates R.S. 51:1780.1 through 1780.5. It is a hybrid: the Texas Data Privacy and Security Act framework bolted onto a California-style coverage standard. It covers businesses doing business in Louisiana that meet one of three thresholds: $25 million in annual gross revenue, processing the personal information of 75,000 or more Louisiana consumers, households or devices, or deriving 50 percent or more of revenue from selling personal data. That freestanding revenue trigger (untethered to any data processing volume, and phrased in the CCPA’s “personal information” rather than the statute’s own defined “personal data”) is borrowed from California and is genuinely unusual among Washington Privacy Act-model laws. It can pull in business-to-business companies that most state privacy laws leave alone. Covered controllers must publish a privacy notice, honor now-standard consumer rights, obtain affirmative consent before processing sensitive data, and conduct data protection assessments for higher-risk processing.

The Louisiana Attorney General enforces the Act through the Unfair Trade Practices Act, with a 30-day cure period that sunsets July 31, 2027. There is no private right of action.

The Clause That Didn’t Survive

Here is what changed between the State Capitol Building and the Governor’s desk. The reengrossed bill the Senate passed (36-0) on April 8 contained, in its processor-duty section, a requirement that processors assist controllers in securing “the personal data collected, stored, and processed by an artificial intelligence system.” The phrasing was imported almost word-for-word from Texas Business and Commerce Code Section 541.104, as amended last year by the Texas Responsible AI Governance Act (TRAIGA, HB 149). Until SB 386, Texas stood alone in naming AI systems by term in a comprehensive privacy law's processor duty. Louisiana would have been the second jurisdiction to do so. Instead, it became the clearest example yet of how quickly that language can fall out of a bill before enactment. 

When SB 386 reached the House, the Commerce Committee rewrote the processor provision, and the AI-system reference came out with it. The House passed the amended bill (94-0) on May 18; the Senate concurred (34-0) on May 20. By the time the bill was enrolled, the operative processor duty (now R.S. 51:1780.4(D)(1)(b)) spoke only of the security of processing personal data and breach notification. The words “artificial intelligence system” appear nowhere in Act No. 502.

What remains is the indirect approach every other state has taken. AI reached through the profiling machinery rather than being named outright. The enacted law still defines profiling as “solely automated processing,” still gives consumers an opt-out from profiling that drives a "decision that produces a legal or similarly significant effect," and still requires a data protection assessment when the profiling presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, financial or reputational injury, or any other heightened risk of harm. The covered decisions are familiar ones (lending, housing, insurance, healthcare, education, employment, criminal justice, and access to basic necessities). AI systems that make or inform those decisions are squarely within reach. They are simply not called that.

The deletion did not happen in isolation. The same House amendments that removed the AI reference layered in a set of business-favorable savings provisions, including an express First Amendment savings clause and broad carve-outs for federal-law compliance and evidentiary privilege. The drafting moved in one direction: narrower, more deferential and less willing to fix AI as a named regulatory object. 

There is a quiet irony in it. The Governor, who might have hesitated to sign an AI mandate, never faced the question; the legislature had already removed the part that embedded AI governance. That edit was not a technical fix; it was a choice about whether to name AI as a regulated object.

That current is not local. It runs through Colorado’s repeal and replacement of its first-in-the-nation AI Act, the federal push toward preemption, and the slipping timelines in Brussels. Louisiana’s brush with explicit AI terminology (and its retreat) belongs in that story.

For deployers, the practical point is not that AI is unregulated in Louisiana. It plainly is, through profiling and assessment obligations that a Texas- or California-compliant program will largely already cover. The point is about the migration thesis itself. The idea that AI provisions are steadily moving out of dedicated AI statutes and into comprehensive privacy laws is real, but it is neither linear nor settled. Language that names AI can sit in a bill in March and be gone by May. 

At 450 feet and 34 stories, the Louisiana State Capitol that Huey Long built in 1932 is the tallest statehouse in the nation. Senate Bill 386 came out of it shorter than it went in. In Louisiana's new privacy law, the missing phrase “artificial intelligence system” is, perhaps, the edit that will matter most.

For questions about Louisiana’s Data Privacy Act, TRAIGA, or state privacy and AI governance compliance, please contact the Jones Walker Privacy, Data Strategy and Artificial Intelligence team. Stay tuned for continued insights from the AI Law and Policy Navigator.