Two Southern states joined the list of states with comprehensive consumer privacy laws in 2026. Louisiana's governor signed the Louisiana Data Privacy Act (SB 386) on May 29, 2026, making it the 22nd state with such a law; it takes effect January 1, 2027. Alabama enacted HB 351, the Alabama Personal Data Protection Act, which takes effect May 1, 2027. Both are summarized in law firm analyses collected on JD Supra, which also notes that Connecticut lowered its privacy law's applicability thresholds effective July 1, 2026.
For businesses in the Southeast that sell to consumers across state lines, the map is filling in close to home. Louisiana's law takes effect in less than three months. A Paul Hastings analysis listed on JD Supra points out that state laws enacted in 2026, including Louisiana's and Alabama's, require businesses to assess high-risk data processing activities, which adds documentation work beyond updating a website privacy notice.
Start by confirming whether you meet each law's applicability thresholds; the specifics vary by state, so check the statute or ask counsel rather than assuming. If you are covered, update privacy notices, set up a process to handle consumer requests to access or delete data, and identify which activities, such as targeted advertising or processing sensitive data, would need a documented risk assessment. Ask your marketing, CRM and analytics vendors whether their contracts and tools support these state requirements.
Expect more states to follow. Building a repeatable privacy process now is cheaper than reacting to each new law as its effective date arrives.
Sources
Does this affect your business?
Our advisors can help you figure out the right move, at no cost.