---------------------------
Title: Louisiana Data Privacy Act (LDPA) Compliance Checklist
URL: https://usercentrics.com/us/resources/ldpa-checklist/
---------------------------

# Louisiana Data Privacy Act (LDPA) Compliance Checklist

### At a Glance

- Applies to businesses with annual gross revenue over USD 25 million, or that process 75,000+ consumers' data annually, or that derive 50%+ of revenue from data sales.
- Defines "sale" broadly, covering non-monetary as well as monetary consideration, which can bring data-sharing arrangements into scope that are excluded elsewhere.
- Opt-out model for targeted advertising, data sales, and profiling. Affirmative consent is required for sensitive data.
- Honoring authorized-agent opt-out signals (including tools like GPC) is required only if you already process comparable requests to comply with a similar law in another state.
- Includes a unique exemption for organizations registered with the Louisiana Secretary of State as conductors of public opinion polls.
- Enforced solely by the Louisiana Attorney General; civil penalties up to USD 5,000 per violation (USD 10,000 if committed against an elder or person with a disability), with a 30-day cure period available only through July 31, 2027.

Louisiana's LDPA follows the [Virginia Consumer Data Protection Act](https://usercentrics.com/us/knowledge-hub/virginia-consumer-data-protection-act-vcdpa/) model in broad structure, including opt-out for most processing, affirmative consent for sensitive data, AG-only enforcement. It also borrows some elements from California and Connecticut.

Where it stands apart is a freestanding revenue threshold uncommon among comparably structured laws, a "sale" definition broader than in [Oklahoma](https://usercentrics.com/us/knowledge-hub/oklahoma-consumer-data-privacy-act/) or [Texas](https://usercentrics.com/knowledge-hub/texas-data-privacy-and-security-act-tdpsa/), a conditional (not blanket) authorized-agent opt-out signal requirement, and one of the shortest cure periods among current state privacy laws.

- **2.4M** — websites and apps in 195 countries
- **8.8B** — monthly consents
- **99%+** — customer retention rate
- **4.3/5** — rating on G2

Partners: Canon, Lufthansa Technik, Mitsubishi Electric, Pinterest, PIRELLI TYRE S.p.A., Porsche Financial Services GmbH, Save the Children, Siemens, z – Hello Fresh, z – Ubisoft, zynga

## The Checklist

### 1: Determine If Your Company Must Comply

**The LDPA applies if you conduct business in Louisiana, or your products or services are consumed by Louisiana residents, and you meet at least one of the following.**

- Annual gross revenue exceeding USD 25 million, or
- Buy, receive, sell, or share the personal data of 75,000 or more consumers or households annually for commercial purposes, or
- Derive 50 percent or more of annual revenue from selling personal data

Exempt entities include state agencies, nonprofits, higher education institutions, GLBA-regulated financial institutions, HIPAA-covered entities, electric public utilities, and organizations registered with the Secretary of State as conductors of public opinion polls, which is a distinctive Louisiana-specific carve-out.

### 2: Create a Comprehensive Privacy Policy

**Disclose data categories (including sensitive data), processing purposes, third-party sharing categories, and whether you sell personal data or use it for targeted advertising.**

Explain how consumers can exercise their rights, including the appeal process, and provide a request submission mechanism accessible from your website. If you sell sensitive or biometric data, post a separate, conspicuous disclosure.

### 3: Inform Consumers About Their Rights

**Louisiana consumers can request access, correction, deletion, portability, and opt-out, and cannot be discriminated against for exercising them.**

Consumers may also designate an authorized agent to submit opt-out requests on their behalf, including a technology-based opt-out signal like [GPC](https://usercentrics.com/knowledge-hub/what-is-global-privacy-control/).

### 4: Review Your Authorized-Agent Opt-Out Signal Obligations

**You're required to honor opt-out requests submitted via authorized-agent technology, such as browser settings or extensions, only if you already process comparable requests to comply with a similar law in another state.**

Where that applies, only signals reflecting an affirmative consumer choice (not a default setting) need to be treated as valid.

## Managing privacy compliance across U.S. states?

Usercentrics CMP supports opt-out signals and workflows, consent documentation, and geotargeted configurations across U.S. state privacy laws. Try it free for 14 days.

### 5: Obtain Affirmative Consent for Sensitive Personal Data

**Get affirmative, opt-in consent before processing sensitive personal data**.

This includes racial or ethnic origin, religious beliefs, health conditions, sexuality, citizenship or immigration status, biometric or genetic data used for identification, precise geolocation, and data from a known child under 13.

### 6: Handle Children's Data in Line With COPPA

**Processing personal data from a known child under 13 must comply with** [**COPPA**](https://usercentrics.com/us/knowledge-hub/coppa-compliance/) **and requires affirmative parental or guardian consent.**

### 7: Audit Consent Interfaces for Dark Patterns

**The LDPA prohibits** [**dark patterns**](https://usercentrics.com/knowledge-hub/dark-patterns-and-how-they-affect-consent/)**, including any practice the FTC designates as such.**

Review consent banners and opt-out flows for manipulative design.

### 8: Review Data-Sharing Arrangements Against the LDPA's "Sale" Definition

**Louisiana's definition of "sale" covers both monetary and other valuable consideration, which is broader than laws that limit "sale" to money changing hands.**

Reassess any arrangements that were excluded under other states' narrower definitions.

### 9: Provide at Least Two Secure DSAR Submission Methods

**Consumers cannot be required to create a new account solely to submit a request.**

Provide at least two secure contact methods for [data subject access requests](https://usercentrics.com/knowledge-hub/data-subject-access-requests/).

### 10: Respond to DSARs Within the Required Timeline

**Respond within 45 days, extendable by a further 45 days with notice to the consumer.**

Responses must be free of charge up to twice per year per consumer. Manifestly unfounded, excessive, or repetitive requests may be charged a fee or declined. The burden of demonstrating this falls on the business.

### 11: Establish an Appeal Process

**Resolve appeals within 60 days.**

If denied, direct the consumer to the Louisiana Attorney General's complaint mechanism. A cure period runs from January 1 through July 31, 2027. After that, curing a violation is entirely at the AG's discretion.

### 12: Maintain Written Processor Contracts and Conduct Data Protection Assessments

**Govern processor relationships with a written agreement covering instructions, data types, duration, and subprocessor obligations.**

Conduct [data protection assessments](https://usercentrics.com/knowledge-hub/data-protection-impact-assessment-dpia/) for targeted advertising, data sales, profiling, and sensitive data processing. They will need to cover activities already underway before January 1, 2027 that continue past that date, as well as new activities.

Get the full picture in the [Louisiana Data Privacy Act](https://usercentrics.com/us/knowledge-hub/louisiana-data-privacy-act-ldpa/) overview.

## Download your free PDF version of this checklist.

---

## Footer

### Products
- [Usercentrics Web CMP](https://usercentrics.com/us/website-consent-management/)
- [Usercentrics App CMP](https://usercentrics.com/us/in-app-sdk/)
- [Usercentrics CTV CMP](https://usercentrics.com/us/usercentrics-ctv-cmp/)
- [Usercentrics Privacy Policy Generator](https://usercentrics.com/us/privacy-policy-generator/)
- [Server-side Tagging Solution](https://usercentrics.com/us/server-side-tracking-solution/)
- [Usercentrics Preference Manager](https://usercentrics.com/us/preference-management/)
- [Audience Unlocker](https://usercentrics.com/us/audience-unlocker/)
- [Integrations](https://usercentrics.com/us/integrations/)
- [Web compliance scan](https://usercentrics.com/us/privacy-compliance-scanner/)
- [App compliance scan](https://usercentrics.com/us/app-data-privacy-audit/)
- [ROAS calculator](https://usercentrics.com/roas-calculator/)

### Solutions
- [Data Privacy Regulatory Compliance](https://usercentrics.com/us/data-privacy-regulatory-compliance/)
- [Marketing Performance Optimization](https://usercentrics.com/us/marketing-performance-optimization/)
- [Migration](https://usercentrics.com/us/migration/)
- [Media & Publishing](https://usercentrics.com/us/media-publishing/)
- [Retail & Ecommerce](https://usercentrics.com/us/retail-ecommerce/)
- [Banking, Finance & Insurance](https://usercentrics.com/us/banking-finance-insurance/)
- [Healthcare & Pharmaceuticals](https://usercentrics.com/us/healthcare-pharmaceuticals/)
- [Gaming](https://usercentrics.com/us/gaming/)
- [Education](https://usercentrics.com/us/education/)
- [Automotive](https://usercentrics.com/us/automotive/)
- [Travel & Hospitality](https://usercentrics.com/us/travel/)

### Regulations
- [CCPA (California)](https://usercentrics.com/us/ccpa/)
- [GDPR (EU)](https://usercentrics.com/us/gdpr/)
- [CPRA (California)](https://usercentrics.com/us/cpra)
- [CPA (Colorado)](https://usercentrics.com/us/cpa/)
- [DMA (EU)](https://usercentrics.com/us/digital-markets-act-dma/)
- [FADP (Switzerland)](https://usercentrics.com/us/fadp/)
- [PIPEDA (Canada)](https://usercentrics.com/us/pipeda/)
- [TCF v2.3 (IAB)](https://usercentrics.com/us/cmp-for-publishers/)
- [Google Consent Mode (EU)](https://usercentrics.com/us/usercentrics-cmp-and-google-consent-mode-v2/)
- [Microsoft UET Consent Mode (EU)](https://usercentrics.com/us/usercentrics-cmp-and-microsoft-consent-mode/)
- [View all regulations](https://usercentrics.com/us/regulations-and-frameworks/)

### Resources
- [Blog](https://usercentrics.com/us/knowledge-hub/)
- [Whitepapers](https://usercentrics.com/us/whitepapers/)
- [Checklists](https://usercentrics.com/us/checklists/)
- [Courses](https://courses.usercentrics.com)
- [Customer stories](https://usercentrics.com/us/customer-stories/)
- [Privacy-Led Marketing](https://usercentrics.com/us/privacy-led-marketing/)
- [Events](https://usercentrics.com/us/webinar/)
- [CONSENTED podcast](https://usercentrics.com/us/consented/)
- [Guides](https://usercentrics.com/us/guides/)
- [Release notes](https://releases.usercentrics.com/en)
- [Developer documentation](https://usercentrics.com/docs/)
- [RFI template](https://usercentrics.com/us/resources/usercentrics-rfi-template/)
- [Customer directory](https://usercentrics.com/us/usercentrics-customer-directory/)

### Company
- [About us](https://usercentrics.com/us/about-us/)
- [Press](https://usercentrics.com/us/press/)
- [Our offices](https://usercentrics.com/us/contact/)
- [Trust center](https://trust.usercentrics.com/)
- [Careers](https://usercentrics.com/us/career/)
- [Open positions](https://apply.workable.com/usercentrics/)
- [Diversity and inclusion](https://usercentrics.com/us/dei/)

### Support
- [General support](https://support.usercentrics.com/hc/en-us)
- [Contact sales](https://usercentrics.com/us/book-a-consultation/)
- [Technical support](https://support.usercentrics.com/hc/en-us/requests/new)
- [Billing and account](https://support.usercentrics.com/hc/en-us/categories/12253804608156-Account-and-billing)
- [Suggest a feature](https://support.usercentrics.com/hc/en-us/requests/new?ticket_form_id=10610312381340)
- [Partner login](https://partnerportal.usercentrics.com/)
- [Partner program](https://usercentrics.com/us/partner-program-overview/)
- [Affiliate program](https://usercentrics.com/us/affiliates/)