The short answer
Louisiana (Act 502) and Oklahoma (SB 546) apply from 1 January 2027, and Alabama (HB 351) from 1 May 2027. They cover businesses above set thresholds, such as 75,000 consumers in Louisiana, 100,000 in Oklahoma and 25,000 in Alabama. All three give people rights to access, delete and opt out, and are enforced by the attorney general.
Key takeaways
- Louisiana: applies from 1 January 2027 to businesses with over $25 million in yearly revenue, data on 75,000 or more consumers, or 50% of revenue from selling personal data.
- Oklahoma: applies from 1 January 2027 at 100,000 consumers, or 25,000 consumers with over 50% of gross revenue from selling personal data. Penalties reach $7,500 per violation.
- Alabama: applies from 1 May 2027 at more than 25,000 consumers or over 25% of revenue from selling data. Penalties reach $15,000 per violation.
- All three are enforced by the attorney general only, with no private lawsuits.
- Louisiana gives a 30-day chance to fix a violation only until 31 July 2027; Oklahoma's 30-day period has no end date, and Alabama's is 45 days.
On this page
01
Which businesses do the Louisiana, Oklahoma and Alabama privacy laws cover?
Each law covers businesses that operate in the state or target its residents and pass a size test. The tests differ, so check all three if you have US users.
| Louisiana | Oklahoma | Alabama | |
|---|---|---|---|
| Law | Data Privacy Act, Act 502 (SB 386) | Consumer Data Privacy Act, SB 546 | Personal Data Protection Act, HB 351 |
| Starts | 1 January 2027 | 1 January 2027 | 1 May 2027 |
| Size test | Over $25M yearly revenue, or 75,000+ consumers, or 50% of revenue from selling data | 100,000+ consumers, or 25,000+ with over 50% of revenue from selling data | More than 25,000 consumers, or over 25% of revenue from selling data |
| Who is out | Nonprofits, state agencies, higher education, HIPAA and GLBA entities | State agencies and GLBA institutions, among others | Businesses under 500 employees unless they sell personal data; GLBA, HIPAA and state agencies |
| Fix period | 30 days, 1 Jan to 31 Jul 2027 only | 30 days, no end date | 45 days |
| Penalty | Set by the attorney general's enforcement action | Up to $7,500 per violation | Up to $15,000 per violation |
Sources: the Louisiana Act 502 enrolled text, Oklahoma SB 546 and Alabama HB 351.
02
What does a small app have to do under these laws?
If you are over a threshold, you need a privacy notice, working rights requests, an opt-out for targeted advertising and sale, consent for sensitive data and reasonable security. The three laws share this core.
- Privacy notice: the categories of data, the purposes, the rights and how to appeal, and who data is shared with.
- Rights: access, correct, delete and port data, and opt out of targeted ads, sale and profiling used for significant decisions. Louisiana requires an answer within 45 days (extendable by 45), with an appeal route and an attorney-general complaint route on a denial, and at least two ways to make a request without creating an account.
- Sensitive data: consent before processing it; known children's data is handled under COPPA rules.
- Security and minimisation: reasonable safeguards and only the data you need.
- Assessments: Louisiana and Oklahoma require data protection assessments for targeted ads, sale, profiling and sensitive data. Alabama has no assessment duty.
- Alabama extras: a clear link on your website to a page where people can opt out of targeted ads and sale (or up-to-date contact details for requests), and no targeted ads to, or sale of data of, people you know are 13 to 15 without their consent.
- Louisiana extra: if you sell sensitive or biometric data, post 'NOTICE: We may sell your sensitive personal data.' or 'NOTICE: We may sell your biometric personal data.' next to your privacy notice.
The rulebook does not list a universal opt-out signal duty for any of these three, but honouring Global Privacy Control is already required in several other states and costs little; the free Global Privacy Control prompt covers it. For the full 2027 calendar see privacy laws in 2027.
03
What should I do before 1 January 2027?
- 01
Count your users by state
Use account addresses, billing country and state, or analytics at state level to see whether you are near 25,000, 75,000 or 100,000 consumers. Revenue matters for Louisiana.
- 02
Update the privacy notice
Add the rights, the appeal route and the categories you collect. Add the Louisiana and Alabama extras if they apply.
- 03
Make requests work
Give two ways to ask, including a form, and test deletion and export. The data export prompt helps.
- 04
Offer an opt-out
If you sell data or run targeted ads, add the link and honour it on the next page load.
- 05
Plan the response clock and breach notice
Write who answers requests and when. Breach deadlines differ: Louisiana within 60 days of discovery, Oklahoma without unreasonable delay, Alabama within 45 days.
SafeLaunch has all three as markets, among 58 markets and 142 laws, with the section behind every finding. A free scan shows where your notice and opt-out stand; read the briefing and the coverage page for the other states.
One free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked, plus the Monday briefing on new laws and deadlines. No spam, unsubscribe in one click.
By signing up you agree to get these weekly emails. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
FAQ
Frequently asked questions.
Sources and further reading
- Louisiana Act 502 (SB 386), enrolled
- Oklahoma SB 546 (2026), enrolled
- Alabama HB 351 (Act 2026-552), enrolled
This article is general information, not legal advice. SafeLaunch is automated software, not a law firm; a report records what was checked on one version and is not a certificate of compliance. Read the disclaimer.
From the founder
SafeLaunch is built by Raghav R Handa, a lawyer-turned-builder in New Delhi. He writes plain-English guides to tech, data and AI law.
Read his writingSee what SafeLaunch finds on your product.
Paste a link and get your score, the most serious problems and what already passes, in about a minute.
Keep reading