Three new state privacy laws take effect in 2027. Louisiana and Oklahoma go live January 1, 2027, and Alabama follows May 1; Vermont arrives January 1, 2028. Louisiana and Alabama require businesses to honor Global Privacy Control signals; Oklahoma does not. Here is what each law gives you.
The 2027 Class: Who's New
2026 was the busiest year yet for state privacy legislation. Oklahoma and Alabama enacted comprehensive privacy laws early in the year, and Louisiana Governor Jeff Landry signed the Louisiana Data Privacy Act on May 29, 2026 — making Louisiana the twenty-second state with a comprehensive consumer privacy law. All three take effect in 2027.
- Louisiana Data Privacy Act (LDPA) — effective January 1, 2027
- Oklahoma Consumer Data Privacy Act (OCDPA) — effective January 1, 2027
- Alabama's consumer privacy law — effective May 1, 2027
- Vermont — effective January 1, 2028 (worth knowing about now)
Two other January 1, 2027 dates matter alongside them: Connecticut begins requiring covered data brokers to register before selling or licensing personal information, and Colorado's amended AI law takes effect.
Louisiana Data Privacy Act: What You Get
The LDPA follows the controller/processor model used by most state privacy laws. It applies to entities that annually buy, receive, sell or share the personal information of 75,000 or more consumers, households or devices, or that derive 50% or more of their annual revenue from selling consumers' personal information — a threshold aimed squarely at data brokers and ad-tech firms rather than small local businesses.
Your rights under the LDPA include:
- Access — confirm whether a company is processing your personal data and get a copy
- Correction — fix inaccurate personal data
- Deletion — have your personal data erased
- Portability — receive your data in a usable format
- Opt out of processing for targeted advertising, the sale of personal data, and profiling in furtherance of significant decisions
Enforcement sits with the Louisiana Attorney General. There is no private right of action, so you cannot sue a company yourself under the LDPA — complaints go to the AG's office.
Oklahoma Consumer Data Privacy Act: What You Get
The OCDPA is built on the Virginia model. Oklahomans will be able to access, correct, delete and obtain copies of their personal data, and opt out of the sale of personal data and certain targeted advertising practices. Businesses must publish transparent privacy notices, maintain reasonable data security practices, and obtain consent before processing sensitive personal information such as health, biometric or precise location data.
Oklahoma Won't Honor Your Browser Opt-Out Signal
This is the biggest practical difference between the two January 2027 laws. Louisiana requires controllers to accept a universal opt-out mechanism — an opt-out preference signal such as Global Privacy Control, sent automatically by browsers like Brave, Firefox and DuckDuckGo. Oklahoma's law contains no such requirement. If you live in Oklahoma, turning on GPC is still worthwhile for the other states that honor it, but you will have to submit opt-out requests to Oklahoma-covered businesses individually.
Skip the manual work
PrivacyOn removes your personal information from 100+ data broker sites and keeps it removed — automatically.
Start your free scan★★★★★ 4.8/5 · Trusted by thousands of families
Alabama and Vermont: What's Coming
Alabama's law takes effect May 1, 2027, four months after the January cohort, and — like Louisiana and Vermont — requires controllers to provide consumers with an opt-out preference signal. Vermont's law follows on January 1, 2028. Both give consumers the familiar access, correction, deletion, portability and opt-out rights.
One nuance worth understanding about universal opt-out signals: the statutes generally specify that the signal must reflect an affirmative consumer choice rather than being on by default. In practice that means enabling GPC yourself in your browser settings, not relying on a browser that ships it silently.
How to Actually Use These Rights
Step 1: Turn On Global Privacy Control Now
GPC is a signal your browser sends to every site you visit saying "do not sell or share my personal information". It is already legally binding in California, Colorado, Connecticut, Oregon, Texas and a growing list of states, and Louisiana and Alabama join in 2027. Brave and DuckDuckGo send it by default; in Firefox, set privacy.globalprivacycontrol.enabled to true in about:config. One setting covers every site you visit, forever.
Step 2: Find Out Who Actually Holds Your Data
Rights are only useful if you know where to send the request. Search your own name plus your city on Google and see which people-search sites return a profile of you — that is your working list of the data brokers publishing your address, phone number, relatives and property records.
Step 3: Send Deletion and Opt-Out Requests
From the effective dates, covered businesses must respond to your access, correction, deletion and opt-out requests. Most operate a privacy portal; where they do not, a written request to the privacy contact in their policy starts the clock. Keep copies — a paper trail is what makes an AG complaint credible if a company ignores you.
Step 4: Re-Check in Six Months
This is the step almost everyone skips. Data brokers routinely re-acquire and re-publish records they have deleted, because their sources — public records, voter files, property records, marketing lists — keep refreshing. A deletion request is a snapshot, not a permanent state.
Rights Are Only Worth What You Enforce
Filing deletion requests across a hundred-plus data brokers, then re-checking every few months as listings return, is a permanent part-time job. PrivacyOn does it for you: removals across 100+ data brokers and people-search sites, ongoing re-checks when listings reappear, 24/7 dark web monitoring, and coverage for up to 5 family members from $8.33/month. Start with a free scan.
What This Means If You Don't Live in These States
More than you would think. Companies rarely build separate data pipelines per state — when a threshold of states requires a deletion workflow, a universal opt-out signal, or consent for sensitive data, most national businesses roll it out everywhere because maintaining fifty variants is more expensive than one. Each new state law raises the floor a little for everyone.
That said, "most" is not "all", and the baseline still varies enormously by state. If you live somewhere without a comprehensive law, your practical leverage comes from the opt-out processes brokers operate voluntarily and from the states whose laws they apply nationally.
Frequently Asked Questions
Which state privacy laws take effect in 2027?
Louisiana's Data Privacy Act and Oklahoma's Consumer Data Privacy Act both take effect January 1, 2027, and Alabama's law follows on May 1, 2027. Vermont's arrives January 1, 2028. Separately, Connecticut's data broker registration requirement and Colorado's amended AI law also begin on January 1, 2027.
Does Louisiana's privacy law require honoring Global Privacy Control?
Yes. Louisiana, like Alabama and Vermont, requires controllers to give consumers an opt-out preference signal — a universal opt-out mechanism such as Global Privacy Control. Oklahoma's law does not include that requirement, so Oklahomans must submit opt-out requests to businesses individually.
Can I sue a company under the Louisiana Data Privacy Act?
No. The LDPA is enforced by the Louisiana Attorney General and does not create a private right of action, which is the norm across state privacy laws — California's is the only one with a limited private right, and only for certain data breaches. Your route is a complaint to the AG's office.
Who has to comply with the Louisiana Data Privacy Act?
Entities that annually buy, receive, sell or share the personal information of 75,000 or more consumers, households or devices, or that derive 50% or more of their annual revenue from selling consumers' personal information. That threshold is set to capture data brokers and large ad-tech operations rather than small businesses.
Do these laws automatically delete me from data broker sites?
No. Every state law is request-driven: nothing happens until you submit a deletion or opt-out request to each company, and nothing stops a broker re-acquiring your record from public sources afterwards. That is why removal has to be an ongoing process — PrivacyOn files removals across 100+ brokers and re-checks when listings come back, from $8.33/month.
How many states now have comprehensive privacy laws?
Louisiana became the twenty-second state to enact a comprehensive consumer privacy law when it was signed in May 2026, following Oklahoma and Alabama earlier that year. The count keeps climbing, but effective dates lag enactment by a year or more — which is why the 2027 and 2028 dates matter as much as the signatures.