Privacy rules, state by state.

Louisiana Data Privacy Act · in force January 1, 2027

Louisiana

Does business in Louisiana and meets any one test: annual gross revenues in excess of $25 million; buys, receives, sells, or shares personal information of 75,000 or more consumers, households, or devices in a year; or derives 50 percent or more of annual revenue from selling consumers' personal information (§51:1780.2(A)).

Oklahoma consumer data privacy enactment (SB 546) · in force January 1, 2027

Oklahoma

Conducts business in Oklahoma or targets products or services to residents and, during a calendar year, processes personal data of at least 100,000 consumers; or at least 25,000 consumers and over 50 percent of gross revenue from the sale of personal data (75A O.S. §314(A)).

Alabama Personal Data Protection Act · in force May 1, 2027

Alabama

Conducts business in Alabama or targets products or services to residents and either processes personal data of more than 25,000 consumers (excluding payment-only processing), or derives more than 25 percent of gross revenue from the sale of personal data regardless of consumer count (HB 351 §3).