Louisiana Biometric Privacy Laws: Collection, Consent & Penalties (2026)

Louisiana has no standalone biometric privacy statute. The state's Database Security Breach Notification Law (La. R.S. 51:3071 et seq.) protects biometric data by requiring entities to notify affected residents within 60 days of a breach. A separate law (La. R.S. 17:100.8) requires written parental consent before schools collect student biometric information.

Louisiana does not have a standalone biometric privacy law. Unlike Illinois, Texas, and Washington, the state has not enacted legislation that specifically regulates how private businesses collect, store, use, or share biometric identifiers such as fingerprints, facial geometry, or iris scans.

What Louisiana does have is a breach notification law that includes biometric data in its definition of protected personal information, and a separate student-specific biometric law. These protections are limited compared to states with dedicated biometric statutes, but they do create real obligations for businesses and schools that handle biometric data in Louisiana.

This guide explains the current legal framework, what protections exist, where the gaps are, and what changes when the state's newly enacted privacy law takes effect in 2027.

For broader context on Louisiana's overall privacy framework, see the parent guide to Louisiana Data Privacy Laws.

How Louisiana Defines Biometric Data

Louisiana's Database Security Breach Notification Law defines "biometric data" under La. R.S. 51:3073 as:

Data generated by automatic measurements of an individual's biological characteristics, such as fingerprints, voice print, eye retina or iris, or other unique biological characteristic that is used by the owner or licensee to uniquely authenticate an individual's identity when the individual accesses a system or account.

This definition is narrower than what states like Illinois use. It only covers biometric data used for authentication purposes, meaning fingerprints or facial scans used to unlock a system or verify identity. Biometric data collected for other purposes, such as surveillance cameras using facial recognition to track foot traffic, may fall outside this definition.

The law also requires that the biometric data be paired with an individual's first name (or first initial) and last name to qualify as protected "personal information."

Database Security Breach Notification Law (La. R.S. 51:3071 et seq.)

Louisiana's primary biometric protection comes from the Database Security Breach Notification Law, originally enacted in 2005 and significantly amended in 2018 by Senate Bill 361. The 2018 amendments added biometric data to the list of protected personal information elements.

What the Law Requires

Any person or business that conducts business in Louisiana and owns or licenses computerized data containing personal information must take several steps under this law.

Reasonable security measures. Entities must implement and maintain "reasonable security procedures and practices appropriate to the nature of the information" to protect personal data from unauthorized access, destruction, use, modification, or disclosure (La. R.S. 51:3074).

Breach notification within 60 days. If a breach compromises biometric data (combined with an individual's name), the entity must notify affected Louisiana residents "in the most expedient time possible and without unreasonable delay but not later than sixty days from the discovery of the breach."

Attorney General notification. This duty comes from the Attorney General's own regulation, not from the breach notification statute. Under La. Admin. Code tit. 16, Pt. III, Sec. 701, an entity that has to notify Louisiana residents of a breach must also send written notice to the Attorney General's Consumer Protection Section, and that notice must include the names of all Louisiana citizens affected by the breach. Notice to the Attorney General is timely if it is received within 10 days of distributing notice to residents. La. R.S. 51:3074 itself imposes only two Attorney-General-facing duties: a written explanation of any delay in notifying residents (Subsection E), and, on written request, a copy of a no-harm determination (Subsection I).

Data destruction. When personal information (including biometric data) is no longer needed, entities must destroy or erase records so the data "cannot be read or reconstructed."

Penalties for Non-Compliance

Violations of the breach notification law carry real consequences.

A failure to comply is treated as an unfair trade practice under La. R.S. 51:1405(A). That section declares the conduct unlawful and opens the door to enforcement by the Louisiana Attorney General, but it sets no penalty amount of its own.

Two separate $5,000 figures are easy to confuse. Under the Attorney General's breach-reporting regulation, La. Admin. Code tit. 16, Pt. III, Sec. 701, failure to provide timely notice to the Attorney General "may be punishable by a fine not to exceed $5,000 per violation," and each day notice is not received by the Attorney General is deemed a separate violation. Separately, La. R.S. 51:1407(B) lets a court impose a civil penalty of up to $5,000 for each violation of the Unfair Trade Practices Act, but by the terms of that subsection the penalty is available where the court finds the practice was "entered into with the intent to defraud."

Individuals also have a private right of action. Louisiana residents can sue for actual damages caused by a failure to provide timely breach notification.

If a court finds that a violation was committed knowingly after the entity was put on notice by the Attorney General, the court can award treble damages (three times actual damages) plus reasonable attorney fees and costs.

Exemptions

The law includes several exceptions. Entities that determine after a reasonable investigation that there is "no reasonable likelihood of harm" to affected residents may skip notification, but they must keep written documentation of that determination for five years and provide it to the Attorney General within 30 days upon request.

Financial institutions that comply with the Gramm-Leach-Bliley Act and federal interagency guidance on data security are considered compliant with Louisiana's breach notification requirements.

Encrypted data is also exempt. The statute does not apply to personal information that has been encrypted or redacted.

Student Biometric Protections (La. R.S. 17:100.8)

Louisiana has a separate, more protective law specifically for student biometric data. La. R.S. 17:100.8 regulates the collection and use of biometric information by schools and school governing authorities.

This law defines "biometric information" more broadly than the breach notification statute. It covers "the noninvasive electronic measurement and evaluation of any physical characteristics that are attributable to a single person," including fingerprint characteristics, eye characteristics, hand characteristics, vocal characteristics, facial characteristics, and any other physical characteristics used for electronic identification.

Key Requirements for Schools

Schools that collect student biometric data must follow these rules:

Written parental consent. Schools must obtain written permission from a student's parent or legal guardian (or the student if 18 or older) before collecting any biometric information. The consent form must be a standalone document created specifically for this purpose and cannot be bundled with enrollment forms.

Full disclosure. Schools must develop policies that explain what biometric data will be collected, how it will be collected and stored, and how it will be used.

Limited use. Student biometric data can only be used for identification or fraud prevention purposes. Schools cannot repurpose it for other uses.

Encryption required. Student biometric information must be encrypted using an algorithmic process that transforms the data into a form with a "low probability of assigning meaning" without a confidential key.

Mandatory destruction. Schools must discontinue use and destroy all biometric data within 30 days when a student graduates, withdraws, or when a parent submits a written request to stop collection.

No denial of services. A student cannot be refused services because a parent declines to consent to biometric data collection.

What Louisiana Law Does Not Cover

Louisiana's existing laws leave significant gaps in biometric privacy protection.

No general consent requirement (changing for covered businesses in 2027). Outside of the school context, Louisiana does not currently require businesses or employers to obtain consent before collecting biometric data from adults. Starting January 1, 2027, the Louisiana Data Privacy Act (Act 502 of 2026) will require a covered controller to get opt-in consent before processing biometric data used to identify a consumer, though the law exempts data handled in an employment context. Because of that exemption, an employer can still implement fingerprint time clocks or facial recognition systems without notifying employees or getting their approval.

No retention or destruction timelines for private entities. The breach notification law requires destruction of data that is no longer needed, but it does not mandate specific retention schedules or destruction timelines for biometric data held by businesses.

No restrictions on biometric data sales (changing for covered businesses in 2027). Louisiana does not currently prohibit or restrict the sale or sharing of biometric data with third parties. Starting January 1, 2027, the Louisiana Data Privacy Act (Act 502 of 2026) adds sale-side duties: a controller that sells personal data that is biometric data must post a conspicuous notice reading "NOTICE: We may sell your biometric personal data," and an entity described in R.S. 51:1780.2(A)(3) may not sell personal data that is sensitive data, a category that includes biometric data processed to uniquely identify an individual, without first receiving the consumer's consent.

No private right of action for collection practices. While individuals can sue over a failure to notify them of a breach, there is no private right of action for the unauthorized collection, use, or storage of biometric data itself.

No law enforcement restrictions. Louisiana has not enacted limits on government or law enforcement use of facial recognition or other biometric surveillance technologies.

Employer Use of Biometric Data

Louisiana has no state law that restricts employers from collecting biometric data from employees. Companies operating in Louisiana that use fingerprint scanners for timekeeping, facial recognition for building access, or other biometric systems are not required by state law to:

• Provide written notice before collecting biometric data
• Obtain employee consent
• Establish data retention policies
• Limit sharing of employee biometric data with vendors or third parties

This stands in sharp contrast to Illinois, where employers face statutory damages of $1,000 to $5,000 per violation of the Biometric Information Privacy Act.

That said, employers in Louisiana should still implement reasonable security measures for biometric data. If a breach occurs that exposes employee biometric data alongside names, the employer must comply with the 60-day breach notification requirement or face penalties under the Unfair Trade Practices Act.

The Louisiana Data Privacy Act (Enacted 2026)

Louisiana has seen two major privacy bills in recent years: one that failed and one that became law.

Louisiana Consumer Privacy Act (HB 947, 2024). This bill was introduced in April 2024 and would have created a comprehensive consumer privacy framework. The bill was referred to the House Committee on Commerce but did not advance beyond committee.

Louisiana Data Privacy Act (SB 386, Act 502 of 2026). Governor Jeff Landry signed SB 386 into law as Act 502 on May 29, 2026, creating the Louisiana Data Privacy Act. The law takes effect January 1, 2027, and applies to businesses that do business in Louisiana and either have more than $25 million in annual gross revenue, buy, sell, or share the personal data of 75,000 or more consumers, households, or devices, or derive 50 percent or more of revenue from selling personal data.

Once effective, the law classifies biometric data processed to uniquely identify a person as sensitive data and bars a covered controller from processing it without the consumer's opt-in consent. That consent duty is separate from a narrower notice requirement: a controller that sells biometric personal data must post a conspicuous notice reading "NOTICE: We may sell your biometric personal data." The law defines "consumer" to exclude a person acting in an employment context, so it will not change the employer practices described below.

SB 386 brings Louisiana into the group of states, including Colorado, Connecticut, and Virginia, that classify biometric data as sensitive information requiring affirmative consent.

Federal Protections That Apply in Louisiana

Because Louisiana lacks a comprehensive biometric privacy law, federal statutes provide additional protections for residents.

Section 5 of the FTC Act allows the Federal Trade Commission to take enforcement action against companies engaged in unfair or deceptive practices involving biometric data, including failures to secure biometric information or deceptive collection practices.

HIPAA protects biometric data collected or used by covered healthcare entities and their business associates under the Privacy Rule.

FERPA restricts how schools handle student biometric data at the federal level, supplementing Louisiana's state-level student biometric protections under La. R.S. 17:100.8.

COPPA requires parental consent before collecting biometric data from children under 13, enforced by the FTC.

How Louisiana Compares to Other States

Louisiana falls into a lower tier of states for biometric privacy protection. While the inclusion of biometric data in the breach notification law is meaningful, the state lacks the collection-level protections found in more protective states.

• Illinois has the strongest biometric law in the nation (BIPA), with a private right of action and statutory damages of $1,000 to $5,000 per violation
• Texas and Washington have biometric-specific statutes enforced by their attorneys general
• States with comprehensive privacy laws (Colorado, Connecticut, Virginia, and Louisiana starting January 1, 2027) classify biometric data as sensitive and require opt-in consent
• Louisiana protects biometric data today through breach notification, student biometric rules, and general unfair trade practices enforcement, and will add opt-in consent requirements for covered businesses when the Louisiana Data Privacy Act (Act 502 of 2026) takes effect on January 1, 2027

This article provides general legal information about Louisiana biometric privacy laws. It is not legal advice. Laws and regulations change frequently, and this content may not reflect the most recent developments. Consult a qualified attorney licensed in Louisiana for advice about your specific situation.

More Louisiana Laws

• Louisiana Deepfake Laws
• Louisiana Employee Monitoring Laws
• Louisiana GPS Tracking Laws
• Louisiana Recording Laws