At a Glance
- Applies to businesses with annual gross revenue over USD 25 million, or that process 75,000+ consumers’ data annually, or that derive 50%+ of revenue from data sales.
- Defines “sale” broadly, covering non-monetary as well as monetary consideration, which can bring data-sharing arrangements into scope that are excluded elsewhere.
- Opt-out model for targeted advertising, data sales, and profiling. Affirmative consent is required for sensitive data.
- Honoring authorized-agent opt-out signals (including tools like GPC) is required only if you already process comparable requests to comply with a similar law in another state.
- Includes a unique exemption for organizations registered with the Louisiana Secretary of State as conductors of public opinion polls.
- Enforced solely by the Louisiana Attorney General; civil penalties up to USD 5,000 per violation (USD 10,000 if committed against an elder or person with a disability), with a 30-day cure period available only through July 31, 2027.
Louisiana’s LDPA follows the Virginia Consumer Data Protection Act model in broad structure, including opt-out for most processing, affirmative consent for sensitive data, AG-only enforcement. It also borrows some elements from California and Connecticut.
Where it stands apart is a freestanding revenue threshold uncommon among comparably structured laws, a “sale” definition broader than in Oklahoma or Texas, a conditional (not blanket) authorized-agent opt-out signal requirement, and one of the shortest cure periods among current state privacy laws.
The Checklist
1: Determine If Your Company Must Comply
The LDPA applies if you conduct business in Louisiana, or your products or services are consumed by Louisiana residents, and you meet at least one of the following.
- Annual gross revenue exceeding USD 25 million, or
- Buy, receive, sell, or share the personal data of 75,000 or more consumers or households annually for commercial purposes, or
- Derive 50 percent or more of annual revenue from selling personal data
Exempt entities include state agencies, nonprofits, higher education institutions, GLBA-regulated financial institutions, HIPAA-covered entities, electric public utilities, and organizations registered with the Secretary of State as conductors of public opinion polls, which is a distinctive Louisiana-specific carve-out.
2: Create a Comprehensive Privacy Policy
Disclose data categories (including sensitive data), processing purposes, third-party sharing categories, and whether you sell personal data or use it for targeted advertising.
Explain how consumers can exercise their rights, including the appeal process, and provide a request submission mechanism accessible from your website. If you sell sensitive or biometric data, post a separate, conspicuous disclosure.
3: Inform Consumers About Their Rights
Louisiana consumers can request access, correction, deletion, portability, and opt-out, and cannot be discriminated against for exercising them.
Consumers may also designate an authorized agent to submit opt-out requests on their behalf, including a technology-based opt-out signal like GPC.
4: Review Your Authorized-Agent Opt-Out Signal Obligations
You’re required to honor opt-out requests submitted via authorized-agent technology, such as browser settings or extensions, only if you already process comparable requests to comply with a similar law in another state.
Where that applies, only signals reflecting an affirmative consumer choice (not a default setting) need to be treated as valid.
5: Obtain Affirmative Consent for Sensitive Personal Data
Get affirmative, opt-in consent before processing sensitive personal data.
This includes racial or ethnic origin, religious beliefs, health conditions, sexuality, citizenship or immigration status, biometric or genetic data used for identification, precise geolocation, and data from a known child under 13.
6: Handle Children’s Data in Line With COPPA
Processing personal data from a known child under 13 must comply with COPPA and requires affirmative parental or guardian consent.
7: Audit Consent Interfaces for Dark Patterns
The LDPA prohibits dark patterns, including any practice the FTC designates as such.
Review consent banners and opt-out flows for manipulative design.
8: Review Data-Sharing Arrangements Against the LDPA’s “Sale” Definition
Louisiana’s definition of “sale” covers both monetary and other valuable consideration, which is broader than laws that limit “sale” to money changing hands.
Reassess any arrangements that were excluded under other states’ narrower definitions.
9: Provide at Least Two Secure DSAR Submission Methods
Consumers cannot be required to create a new account solely to submit a request.
Provide at least two secure contact methods for data subject access requests.
10: Respond to DSARs Within the Required Timeline
Respond within 45 days, extendable by a further 45 days with notice to the consumer.
Responses must be free of charge up to twice per year per consumer. Manifestly unfounded, excessive, or repetitive requests may be charged a fee or declined. The burden of demonstrating this falls on the business.
11: Establish an Appeal Process
Resolve appeals within 60 days.
If denied, direct the consumer to the Louisiana Attorney General’s complaint mechanism. A cure period runs from January 1 through July 31, 2027. After that, curing a violation is entirely at the AG’s discretion.
12: Maintain Written Processor Contracts and Conduct Data Protection Assessments
Govern processor relationships with a written agreement covering instructions, data types, duration, and subprocessor obligations.
Conduct data protection assessments for targeted advertising, data sales, profiling, and sensitive data processing. They will need to cover activities already underway before January 1, 2027 that continue past that date, as well as new activities.
Get the full picture in the Louisiana Data Privacy Act overview.