Vermont has passed Senate Bill 71, a comprehensive privacy law that will regulate how covered entities collect, use, disclose, sell, and protect personal data.

The law is scheduled to take effect on January 1, 2028.

To whom does the law apply?

The law applies to people who conduct business in Vermont or produce products or services targeted at Vermont residents and meet one of several thresholds during the preceding calendar year. A business may be covered if:

• It controls or processes the personal data of at least 35,000 consumers (not counting personal data controlled or processed solely to complete a payment transaction);
• Controls or processes the sensitive data of at least 3,000 consumers (not counting personal data controlled or processed solely to complete a payment transaction); or
• Offers for sale the personal data of at least 3,000 consumers.

The Act also contains specific provisions for consumer health data, which seem to be in line with efforts in other states to fill perceived gaps in the protection of health data left by HIPAA. Those provisions apply more broadly to people conducting business in Vermont or producing products or services targeted at Vermont residents.

The law includes numerous exemptions, including for certain government entities, certain HIPAA-regulated entities and data, financial institutions and data subject to the Gramm-Leach-Bliley Act, Fair Credit Reporting Act activities, and other regulated or limited categories.

Who is protected by the law?

The Act protects “consumers,” defined generally as Vermont residents.

However, the definition excludes individuals acting in a commercial or employment context, including employees, owners, directors, officers, contractors, or representatives of an organization when their communications or transactions occur solely within that role.

The law also includes heightened protections for children and minors, such as restricting targeted advertising and the sale of personal data.

What data is protected by the law?

The Act protects “personal data,” defined broadly to include information that is linked or reasonably linkable to an identified or identifiable individual or to a device associated with such an individual. This includes derived data and unique identifiers but excludes deidentified data and publicly available information.

The law provides heightened protections for “sensitive data.” Sensitive data includes data revealing racial or ethnic origin, religious beliefs, sex life, sexual orientation, nonbinary or transgender status, citizenship or immigration status, health conditions, disability, or treatment. It also includes consumer health data, genetic or biometric data, children’s data, precise geolocation data, neural data, certain financial account credentials, and government-issued identification numbers.

What are the rights of consumers?

Under the law, consumers may require a controller to do the following:

• Confirm whether the controller is processing the consumer’s personal data and accessing that data.
• Correct inaccuracies.
• Delete personal data.
• Provide a portable and, where technically feasible, readily usable copy of personal data previously provided by the consumer;
• Allow the consumer to opt out of processing for targeted advertising, sale of personal data, and profiling in furtherance of solely automated significant decisions; and
• Provide a list of third parties to whom the controller has sold personal information. 

What obligations do controllers have?

Controllers have several duties, including:

• Controllers must limit the collection of personal data to what is reasonably necessary and proportionate to disclosed purposes. Remember, data minimization.
• They may not process personal data for a materially new purpose (other than what is reasonably necessary and proportionate in relation to the purposes for which the data are processed, as disclosed to the consumer) unless they obtain consent.
• They also must maintain reasonable administrative, technical, and physical safeguards appropriate to the volume and nature of the personal data. For sensitive data, controllers generally must obtain consent before processing or selling the data.
• They must provide an effective mechanism for consumers to revoke consent and stop processing within 15 days after receiving the revocation request.
• Controllers also must avoid unlawful discrimination and refrain from discriminating against consumers for exercising privacy rights.
• Controllers must maintain certain contractual terms with processors.
• Controllers must provide clear, accessible (e.g., website homepage, app settings menu, etc.) privacy notices. Those notices must disclose, among other things, categories of data processed, processing purposes, consumer rights, categories of personal data sold to third parties, and the categories of those third parties, “clear and conspicuous” disclosures concerning targeted advertising, contact information, whether personal data is used to train large language models, and the date of the latest update.

Controllers must also provide secure methods for consumers to exercise their rights, honor qualifying opt-out preference signals, and conduct data protection assessments for certain high-risk processing activities, including targeted advertising, sales of personal data, sensitive data processing, and certain profiling.

How is the law enforced?

The Vermont Attorney General enforces the Act. The law does not create a private right of action, meaning consumers generally may not sue directly for violations under the Act.

The Attorney General must provide guidance to controllers and processors and submit annual reports to the General Assembly regarding enforcement activity. During the period from January 1, 2028, through June 30, 2029, the Attorney General must provide notice and a 60-day opportunity to cure when the Attorney General determines that a cure is possible before initiating an enforcement action.

Human Rights Watch on Thursday raised concerns surrounding the arbitrary detention of government critics by the Ugandan military, stating that the authorities hold the individuals in undisclosed locations and subsequently transfer them to civilian authorities for politically motivated prosecutions. The organization said the detentions form part of a broader campaign against opposition figures, lawyers, journalists, and independent media.

HRW deputy Africa director Carine Kaneza Nantulya commented on the alleged human rights violations perpetrated by the military, stating: “No military officer should be able to carry out serious violations with impunity… Uganda’s partners should urgently press President [Yoweri] Museveni’s government to end these abuses, uphold the rule of law, and ensure accountability for those responsible.”

According to HRW, Ugandan security forces have unlawfully detained at least five critics of President Museveni and his son, General Muhoozi Kainerugaba, the chief of the Uganda People’s Defence Force (UPDF), since mid-June 2026. The military has also surrounded the premises of Nation Media Group, Uganda’s largest independent media organization, reportedly forcing its television and newspaper to cease operations.

Among the documented cases was the June 15 detention of lawyer Erias Lukwago, who represents opposition politician Kizza Besigye in treason proceedings. Armed soldiers reportedly raided Lukwago’s home and took him to an undisclosed location.

Lukwago was transferred to police custody two days later, charged with treason-related offenses connected to Besigye’s case, and remanded in pretrial detention. Kenyan lawyer and former justice minister Martha Karua, the lead counsel for Besigye, was detained after traveling to Uganda to observe Lukwago’s court proceedings. However, authorities later deported her to Kenya.

Security forces also allegedly detained activist Miria Matembe, journalist Timothy Kalyegira, National Unity Platform deputy president Muwanga Kivumbi, and opposition supporter Andrew Nabimanya. Some revealed abuses suffered during detention, such as being humiliated by being forced to strip naked, pressured to surrender DNA samples, and repeatedly threatened. Kalyegira was charged with utilizing his digital platforms to share sensitive government information, a charge he says is politically motivated due to his role as a whistleblower in exposing corruption involving top government officials.

The reported detentions follow Museveni’s approval of the UPDF Amendment Act, legislation permitting military courts to exercise jurisdiction over civilians in specified circumstances. Rights groups have criticized the act for its role in undermining fundamental human rights, weakening constitutional independence, and existing in contravention of the ruling of Attorney General v. Hon. Michael Kabaziguruka, which ruled that civilians are not allowed to be subjected to military trials.

Previously, Ugandan security forces have been criticized for their use of excessive force against civilians, such as tear gas, pepper spray, arbitrary arrests, and beatings.

HRW said the detentions may violate Uganda’s Constitution and the state’s obligations under the African Charter on Human and Peoples’ Rights, the International Covenant on Civil and Political Rights (ICCPR), and the Convention Against Torture and Other Cruel, Inhuman or Degrading Treatment or Punishment.

Secretary of Labor Nominee Keith Sonderling Testifies at Senate Confirmation Hearing 

On Thursday, President Trump’s nominee to be the next Secretary of Labor, the Honorable Keith Sonderling, testified at the confirmation hearing before the Senate Committee on Health, Education, Labor and Pensions (HELP).  Currently serving as the Acting Secretary of Labor, Sonderling has extensive workplace policy experience, including private practice as a labor and employment attorney and, more recently, serving in various leadership positions at the U.S. Department of Labor and the Equal Employment Opportunity Commission during both the Trump and Biden administrations.  Throughout his public service in Washington, Sonderling has worked in a nonpartisan manner to restore regulatory certainty and clarity for American employers and employees, address workplace discrimination, promote apprenticeships to aid worker training, and help navigate workforce changes amid the digital revolution. Sonderling is currently working with Vice President Vance to combat federal waste, fraud, and abuse.  As the next step, the Committee will hold a meeting to vote on whether to favorably report his nomination to the full Senate floor for a vote.  Sonderling is widely expected to be confirmed. 

NLRB Nominees Advance in the Senate

On Wednesday, the Senate HELP Committee voted to approve the nominations of James Macy and David Prouty to be Members of the National Labor Relations Board, as well as nomination of Brett Matsumoto to be the Bureau of Labor Statistics Commissioner. These nominations will now move to the full Senate floor for a vote.  If confirmed, Macy will give the Board a 3-1 Republican majority, which could lead to major policy shifts from Biden-era decisions. 

House Committee on Education and Workforce to Mark-up Pending Legislation

The House Committee on Education and Workforce will hold a markup on Tuesday, July 21 at 10:15 AM to approve ten bills, including legislation that would make targeted reforms to the Labor-Management Reporting and Disclosure Act and one that would establish a joint employer legal standard specific to the franchise industry.  The complete list includes the following: H.R. 8781, Title IX Clarification Act of 2026; H.R. 4986, Parents Opt-in Protection Act; H.R. 8747, K-12 AI Literacy and Readiness Act of 2026; H.R. 8183, Modernizing Access to Talents, Credentials, and Hiring (MATCH) Act of 2026; H.R. 9723, Fit Future Act; H.R. 8660, Valuing Employee Stock Today (VEST) Act; H.R. 8347, Reinforcing Underserved, Rural, and Local (RURAL) Healthcare Act; H.R. 6213, Heat Workforce Standards Act of 2025; H.R. 8775, Ending Predator Access to Union Power Act; and H.R. 5267, American Franchise Act.

USCIS Issues Additional Updates to TPS-Related EAD Expirations 

On July 10, 2026, the United States Citizenship and Immigration Services (USCIS) issued an update regarding the expiration of Employment Authorization Documents (EAD) related to Temporary Protected Status (TPS) for certain countries, where the previous expiration date was listed as July 10, 2026.  For Littler’s insight, read here. 

IRS Increases Standard Mileage Rate for Second Half of 2026 to 76 Cents per Mile 

In Announcement 2026-11, 2026-29 I.R.B. 49, the IRS amended Notice 2026-10, 2026-4 I.R.B. 378, which sets the standard mileage rates for 2026. The IRS made the change to reflect the rising cost of fuel in 2026. These are the changed rates.  For Littler’s insight, read here.

When Victor Marx was 3 years old, he was forced into a voodoo ritual involving a beheaded cat. At age 7, he killed a man.

Or so Marx says.

But he was not just a precocious child.

As an adult running a “high-risk” Christian ministry, Marx says he rescued 45,000 women and children from captivity and abuse. As a civilian, he supposedly called in a U.S. military airstrike that killed 70 ISIS fighters. He’s exorcised demons — and can do so over the telephone, he says, if need be.

True or, most likely, false, those woolly claims and epic tales of derring-do aren’t the weirdest thing about Marx.

The weirdest thing is that Marx is the Republican nominee for governor of Colorado, an actual part of these United States.

A political newcomer, Marx eked out his victory in a three-way race by less than 2,500 votes out of more than 520,000 cast. (It took almost nine days to declare a winner, but surely you knew that already, given the national outcry over how long it took Colorado to count its ballots. Oh, wait. Never mind.)

Although slender, Marx’s victory delivered a strong statement: about the grave condition of mainstream Republicanism; about the increasing embrace of oddity and extremism by a deeply disaffected slice of the American electorate; about the unsettled and unsettling nature of today’s politics.

“It’s almost cult-like,” Dick Wadhams, a former Colorado GOP chairman, said of Marx’s support. “You talk to some of these people, and there is no doubt in their mind he will be governor, because God has decided that he’s going to be governor.”

There’s fat chance of that. (Please don’t smite me.)

Colorado has elected only one Republican governor in the last 55 years, and that was back in 2002. It’s been 10 years since a Republican won any statewide office. The Democratic nominee, Atty. Gen. Phil Weiser, is as close to a November shoo-in — after stomping U.S. Sen. Michael Bennet in the primary — as it gets.

But Marx, 61, a former Marine and expert in martial arts, is nothing if not swaggering. His role model is, of course, the political disrupter and fabulist-in-chief currently occupying the White House.

Like President Trump, Marx relies heavily on personal charisma, a strong social media presence and the purposeful shunning of campaign norms which, to the politically alienated, speaks to his independence from the establishment and offers a welcome break from the same old, same old.

He casts himself as a problem-solver and negotiator par excellence. He skimps on policy and skipped most of the preprimary debates; at the one he did attend, Marx brought his dog, a Dutch shepherd, onstage. In lieu of a closing statement, Marx prayed.

When asked, he hasn’t backed off his fantastical claims. But Marx hasn’t done a very good job substantiating them.

As a young boy growing up in Louisiana, he says, his abusive stepfather — the one who supposedly involved him in a satanic feline decapitation — drove him to rural Mississippi, where Marx shot and killed a man. Police told Colorado Public Radio they had no record of any unsolved homicides from that time.

“How many people have you killed?” Kyle Clark, an anchorman on Denver’s 9News, asked the candidate in a persistent and revealing sit-down interview.

“I don’t think that’s important,” Marx replied. “It’s actually kind of — it’s an odd question to me.”

Actually, it’s not.

(Conceding the Republican race, state Sen. Barbara Kirkmeyer — the runner-up — conspicuously declined to endorse Marx, urging voters to “choose the path that is best for Colorado” in November. “For the record,” she added. “I still haven’t killed anyone.”)

In many ways, Marx is a mainstream conservative Republican. He founded All Things Possible Ministries, a Christian nonprofit that tends to refugees and other victims of trauma. His focus on law and order, tax relief, small government and deregulation are all standard GOP fare.

But his florid tales of youthful homicide, telephonic exorcisms, personally intercepting human smugglers on the U.S.-Mexico border — well, not so much.

Most voters will probably have a hard time getting past those autobiographical extravagances, which could spell trouble — depressed GOP turnout, guilt by association — for other Colorado Republicans, including freshman Rep. Gabe Evans, who’s fighting to hang onto a closely fought congressional seat in the north-central part of the state.

It’s a loss Republicans can ill afford as they desperately seek to preserve their bare House majority.

Despite its preference for Democratic governors, Colorado was, until not that long ago, a competitive two-party state. It was a presidential battleground as recently as 2012. Republicans held a majority in the state Senate as recently as 2018.

But the MAGA-fication of the state GOP has hastened Colorado’s evolution from political battleground to a solidly blue bastion.

“The Colorado Republican Party right now is impotent and irrelevant,” said Wadhams, who fought unsuccessfully against its takeover by Trump-worshiping zealots. “The ironic twist to this story is that polling has shown over the past several months that voters are getting restless about what they see as the decline of Colorado in terms of education, energy, roads and transportation.”

Just last week, the annual Colorado Health Foundation issued its annual Pulse Poll, a dour report card on the state of the state that found three-quarters of respondents were concerned they may not be able to live there in the future.

But don’t expect Democrats to lose their sovereignty anytime soon.

That’s what happens when a party and its voters stop seriously competing and instead indulge their passions and fever dreams. You get candidates, and political caricatures, like Victor Marx.

God help us.

WASHINGTON — The U.S. Department of Justice civil rights division was created in 1957 with an initial focus on combating racial inequality and protecting voting rights.

But in the first two years of President Trump’s second term, its mission has been reimagined.

Now, the division is focused on combating diversity initiatives, rolling back pro-transgender policies and rooting out allegations of election fraud.

It had for decades investigated police departments for using excessive force. Now it investigates police departments with excessive delays in approving gun permits.

California has served as the division’s laboratory for all of these changes, or, as one former civil rights staffer put it, its “punching bag.”

The civil rights division has been involved in twice as many cases in California as in any other state, according to a Times analysis of cases brought by the Justice Department.

And an examination of press statements by the civil rights division shows that California has accounted for a higher proportion of actions in the second Trump administration than during the same time period in the Biden administration.

The division is led by Harmeet Dhillon, a Californian and a conservative legal crusader, who made her name bringing legal challenges against many of the state’s institutions and once served as the chair of the San Francisco Republican Party.

More recently, she was a leading legal figure in challenges to COVID-19 mandates and has shown steadfast support for Trump; her firm represented him in his successful 2024 fight to remain on the ballot in Colorado.

The Times spoke with a dozen former attorneys in the division, nearly all of whom said that the division has taken on a more partisan approach under Dhillon’s leadership and that the changes in the second Trump administration are far more dramatic than anything that occurred during Trump’s first term.

“It is an ideological civil rights division in a way that we’ve never seen before,” said Regan Rush, the former chief of the division’s special litigation section, which largely focused on investigations into police departments and prisons.

Rush is now director of the Red Line for Civil Rights at Democracy Forward, a nonprofit group that tracks the division’s activities.

In response to questions from The Times, Dhillon wrote that the division’s actions aren’t political.

“This Department speaks plainly and directly when we identify violations of federal law. Being clear about violations of federal civil rights law isn’t political or combative — it’s transparent,” Dhillon said. “I stand behind the work we’ve done since I took over the Civil Rights Division.”

While California produced President Reagan — a hero on the right who as governor frequently sparred with UC Berkeley, as Dillon does today — the state has now become, in conservative circles, a symbol of everything wrong in America.

“If there’s any state that is the antithesis of the Trump administration, it’s California,” said Erwin Chemerinsky, dean of the law school at UC Berkeley.

Dhillon said the division brings cases wherever it sees violations of federal law.

“California is where some of the most significant violations of federal civil rights law have occurred, as our enforcement actions demonstrate,” she said.

Former attorneys in the division said the desire to target California was obvious to them.

As one example, the division has announced more than a dozen actions involving universities in California, largely focused on allegations of antisemitism — the subject of an earlier Trump executive order — at University of California campuses and alleged racial preferences in hiring in the UC system and in the admissions practices at several medical schools in the state.

The division concluded that the medical schools at UC Davis and UCLA racially discriminated against white and Asian applicants and that UCLA failed to adequately respond to complaints of antisemitic harassment of Jewish and Israeli students. Other investigations are ongoing.

“We were never explicitly told that California institutions are of a particular interest, but it was something that was very easy to notice,” said Ejaz Baluch, a former Justice Department attorney who worked on the employment litigation team that looked into allegations that antisemitism at UC campuses had created a hostile work environment.

Trump’s priorities

Dhillon told podcast host Michael Malice in May that she was in “constant contact” with the White House on a “daily, sometimes several-times-a-day basis.”

That represents a major shift from how the division previously operated, said her predecessor, Kristen Clarke, who was the assistant attorney general overseeing the division during the Biden administration.

“There was a fairly sturdy and necessary wall between the Justice Department and the White House,” Clarke said. “This is a complete 180.”

Dhillon has said she sees her job as enforcing civil rights law through the lens of Trump’s executive orders, which took aim at diversity, equity and inclusion efforts, immigration and pro-transgender policies, among other conservative priorities.

She said that while the division “operates within the administration’s law enforcement priorities … investigative and prosecutorial decisions, including which matters to pursue and how, are made by the Division based on the law and the facts.”

Sen. Adam Schiff (D-Calif.), a former federal prosecutor in Los Angeles, said that the division’s changes under Dhillon represent a stark shift from how it operated in the past.

“It is now very much the anti-civil rights department,” Schiff said. “We’re living in this upside-down world where departments that were set up for one purpose are acting in a way that’s antithetical to the purpose of the department.”

Dhillon said that under her leadership, the division “enforces federal civil rights laws evenhandedly, on behalf of all Americans.

“That includes protecting religious liberty, Second Amendment rights, and women’s and girls’ spaces, standing against illegal race-based policymaking and DEI, and defending parents’ fundamental right to direct their children’s upbringing and education.”

Her reorientation of the division led to a mass exodus of career staff — nearly three-quarters of the roughly 400 attorneys who were there at the beginning of 2025, by Dhillon’s telling.

That’s far more departures than in the first Trump administration.

“I said, ‘My way or the highway,’ and my way isn’t my way, it’s President Trump’s way,” Dhillon told Malice.

Dhillon told The Times that the division has added 100 new lawyers and staff in the last 15 months and plans to hire 100 more.

Prisons and police

As the division has shifted its focus to align with the priorities laid out in Trump’s executive orders, it has shut down a number of cases brought during prior administrations.

Former attorneys in the division worry that other preexisting cases are languishing.

In March, the division opened an investigation into two women’s prisons in California — California Institution for Women in Chino and the Central California Women’s Facility in Chowchilla, 35 miles northwest of Fresno — over whether they had violated the rights of other female inmates by housing transgender women in the facilities.

“There have been allegations of sexual assaults, rape, voyeurism and a pervasive climate of sexual intimidation due to the presence of males in the women’s prison,” the Justice Department said in announcing the investigation, misgendering transgender inmates.

Former attorneys in the division said that leadership also sought to open an investigation into the impact of transgender housing policies on juvenile institutions in California, but didn’t find sufficient evidence to warrant opening an investigation.

The investigation into transgender inmates at the women’s prisons came as a prior investigation into the same two prisons remains unresolved over reports from hundreds of women that they had been sexually abused by guards, even as evidence supporting the allegations mounts.

Separate from the civil rights investigation, one of the former guards at the Chowchilla facility was found guilty in January 2025 of more than 60 counts of sexual abuse of inmates and sentenced to 224 years in prison.

“We haven’t seen any kind of relief,” said Megan Marks, former deputy chief in the division’s special litigation section and the deputy director and managing editor for the Red Line for Civil Rights at Democracy Forward.

Dhillon said both investigations into the two women’s prisons are “being pursued vigorously and simultaneously.”

For the last three decades, the division has investigated allegations of police misconduct, authority it was granted by Congress after the 1991 beating of Rodney King by Los Angeles Police Department officers.

But in the second Trump administration, the division has closed a number of active police investigations and moved away from what Dhillon characterized to Malice as a “standing order to persecute police departments and impose nonsense restrictions on them.”

Instead, the division has brought actions against law enforcement agencies deemed to have failed to protect the rights of gun owners.

California was the first target.

The division filed a first-of-its-kind lawsuit in September 2025, alleging that the Los Angeles County Sheriff’s Department had systemically denied people their 2nd Amendment rights because of long delays in approving concealed carry permits.

Last month, it filed a second gun rights lawsuit in California, this time against the state and Atty. Gen. Rob Bonta, over the state’s ban on Glock pistols, which acting U.S. Atty. Gen. Todd Blanche characterized as a “blatant trampling of our rights by the California government.”

Changing tone

Former attorneys in the civil rights division say the pugnacious tone in press releases, such as the one announcing the lawsuit opposing the Glock ban, and in numerous social media posts by Dhillon announcing her intent to open investigations, represents a major shift from how the department has operated in the past.

“What really stands out more than any other civil rights division is how much they demonize and personalize,” said Christy Lopez, a former attorney in the division who is now a professor at Georgetown Law. “We tried to build rapport with the jurisdiction.”

Dhillon defended the approach she and the division have taken.

“Our job is to enforce the law and ensure compliance,” Dhillon said. “That includes public messaging to ensure the public is both aware of what the law requires and knows when others violate the law. We’ve designed our messaging strategy with this goal in mind, and we are pleased with the effect it’s had.”

Numerous former lawyers in the division also said that the current leadership has put its thumb on the scale at the outset of investigations.

“We were basically fed an answer before we conducted an investigation, which is the total antithesis of how these investigations are supposed to be conducted,” said one former Justice Department attorney who worked on the investigation into allegations of antisemitism in the UC system and requested anonymity for fear of reprisal.

Attorneys visited UC Berkeley and UC Davis, but found enough evidence only at UCLA to bring a lawsuit on claims that antisemitism created a hostile work environment.

One of Dhillon’s early top deputies, former Huntington Beach City Atty. Michael Gates, denied that politics played a role in decision-making in his time in the division.

“We evaluated every case on a case-by-case basis,” he said. “There was nothing about politics that influenced any of that.”

Gates, who left the department in November, is now the Republican candidate challenging Bonta to be state attorney general.

Dhillon said to The Times that she is “proud of the record we’ve built” and believes the division has been “active and effective.”

But its former leaders worry that with the exodus of attorneys and the changing nature of the division’s approach, it has lost the ability to fulfill its mission.

“Where does it leave the division today?” said Clarke, its former leader. “It’s a broken agency not able to adequately stand up and defend the civil rights of all Americans.”

With the Governor of Louisiana’s signature on Senate Bill 386, Louisiana becomes one of the latest states to enact a comprehensive consumer privacy law, joining more than twenty states that have adopted similar frameworks in recent years. Like laws in Texas, Virginia, Colorado, and other states, the Louisiana Data Privacy Act (LDPA) adopts a controller/processor framework, grants consumers rights over their personal data, and authorizes enforcement by the state attorney general rather than private litigants. The Act takes effect January 1, 2027.

To whom does the law apply?

The law applies to a person or entity that does business in the state and meets at least one of these thresholds:

• Annual gross revenues over $25 million
• Annually buys, receives, sells, or shares for commercial purposes the personal information of 75,000 or more consumers, households, or devices.
• Derives 50 % or more annual revenues from selling consumers’ personal information.

Notably, Louisiana’s applicability thresholds differ from many recent state privacy laws that focus primarily on the volume of consumer data processed. Instead, the LDPA incorporates revenue-based thresholds similar to those found in California’s privacy framework, applying to businesses with annual gross revenues exceeding $25 million regardless of the amount of personal data processed.

The law does not apply to various categories, including state agencies, certain financial institutions, and GLBA-regulated data, HIPAA-covered entities and business associates, nonprofits, and institutions of higher education.

Who is protected by the law?

The law protects consumers, defined as Louisiana residents acting only in an individual or household context. The law expressly excludes individuals acting in a commercial or employment context.

Under the law, a child’s parent or legal guardian may exercise the child’s consumer rights on the child’s behalf.

What data is protected by the law?

The law protects personal data, which is information that is linked or reasonably linkable to an identified or identifiable individual. It excludes deidentified data or publicly available information.

Under the law, “sensitive data” is protected and includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, citizenship or immigration status, genetic or biometric data used to uniquely identify an individual, personal data collected from a known child, and precise geolocation data. Businesses should pay particular attention to the law’s treatment of sensitive data. Like many recently enacted state privacy laws, Louisiana generally requires consumer consent before processing sensitive data.

What rights do consumers have?

Under the law, consumers may require a controller to do the following:

• Confirm whether the controller is processing the consumer’s personal data and access that data;
• Correct inaccuracies;
• Delete personal data;
• Provide a portable and, where technically feasible, readily usable copy of personal data previously provided by the consumer; and
• Allow the consumer to opt out of processing for targeted advertising, sale of personal data, and profiling in furtherance of solely automated significant decisions. 

Controllers generally must respond within 45 calendar days, with one additional 45-day extension when reasonably necessary to such requests.

What obligations do controllers have?

Under the law, controllers must limit the collection of personal data to what is adequate, relevant, and reasonably necessary for the disclosed purpose and must maintain reasonable administrative, technical, and physical security practices appropriate to the data.

Controllers must provide a reasonably accessible and clear privacy notice describing categories of personal data processed, processing purposes, how consumers may exercise rights and appeal decisions, categories of personal data sold, categories of third parties to whom data is sold, and request submission methods.

If a controller sells sensitive data or biometric data, it must have a specific notice to that effect.

A contract between a controller and a processor must address the processor’s data processing procedures with respect to processing performed on behalf of the controller. Similar to other state privacy laws, the LDPA requires such contracts to include certain provisions, such as:

• clear instructions for processing data;
• the type of data subject to processing;
• the duration of processing; and
• a requirement that the processor make available to the controller, on reasonable request, all information in the processor’s possession necessary to demonstrate the processor’s compliance with the requirements of the LDPA.

Controllers must also conduct and document data protection assessments for targeted advertising, the sale of personal data, certain risky profiling, the processing of sensitive data, and other activities. Controllers that already maintain privacy impact assessments under other state laws may be able to leverage existing compliance processes.

How is the law enforced?

The state attorney general may enforce the law. And violations shall constitute an unfair and deceptive trade practice pursuant to the Unfair Trade Practices and Consumer Protection law, excluding private rights of action. Note, however, that the LDPA provides a 30-day cure period that sunsets on July 31, 2027, providing organizations with a limited opportunity to address alleged violations during the law’s early implementation period.

Although the LDPA largely follows the increasingly familiar state privacy law framework, businesses should not assume existing compliance programs automatically satisfy Louisiana’s requirements. Organizations with multi-state privacy compliance programs should review their privacy notices, consumer rights request procedures, consent mechanisms for sensitive data, and data protection assessment processes before the law takes effect on January 1, 2027.

A federal judge ruled Thursday that US Customs and Border Protection (CBP) agents violated the Fourth Amendment rights of Osama Abu Irshaid, the executive director of American Muslims for Palestine, when they searched his cell phones twice at a US international airport in 2024. The court did not find, however, that the searches amounted to retaliation in violation of the First Amendment.

US District Judge Michael Nachmanoff of the Eastern District of Virginia issued the ruling following a bench trial held in May. Dr. Irshaid, a US citizen, sued the government after CBP officers subjected his phones to forensic searches upon his return to the country in 2024. At the time, Irshaid was carrying two cell phones and offered one of his phones for officers to search. One of the CBP officers at the scene remarked that “people who are traveling with burner phones are trying to hide something.”

The court found that among the factors CBP Officer Scott Cowles cited in requesting approval for the forensic search was a May 2024 letter from Congressman James Comer of the House Committee on Oversight and Accountability. The letter alleged misconduct by Irshaid’s organization as well as financial ties to Hamas.

The court found that the letter, along with the other information Cowles relied on, did not amount to the reasonable suspicion required to justify a non-routine forensic search of a US citizen’s phone. Judge Nachmanoff wrote that the evidence connecting Irshaid to any national security concern was too attenuated to justify the searches.

On the First Amendment retaliation claim, however, Judge Nachmanoff ruled in the government’s favor. He held that although the searches were constitutionally unreasonable, the evidence did not establish that the CBP officers harbored any “retaliatory animus” toward Irshaid’s pro-Palestinian advocacy. The court found the officers had acted on “well-intentioned independent misjudgment” rather than hostility to protected speech.

The court ordered both parties to submit a briefing within 21 days on the question of appropriate remedies.