The AGs in Baton Rouge and Burlington have obtained comprehensive state privacy laws to enforce, bringing the total to 23 such laws in the U.S. The Louisiana Data Privacy Act largely follows a familiar template with a few divergences and a short runway before enforcement begins, while Vermont’s Data Privacy and Online Surveillance Act enters the elite group of strict states with a bundle of stringent demands. Vermont stands out for an expanded definition of PI that includes “derived data,” an explicit requirement to disclose data uses in AI training and a consumer right to request the specific third parties to whom their data has been sold. This article provides perspective on the distinctive compliance challenges that the two new laws pose and offers practical compliance steps that companies should prioritize, with commentary and recommendations from experts at Hinshaw & Culbertson, Kean Miller, Lewis Rice, McDermott Will & Schulte, and Red Clover Advisors. See “Alabama and Oklahoma Introduce Virginia-Style Privacy Laws” (May 6, 2026).