Louisiana Data Privacy Act (LDPA) Reference Guide

Enacted R.S. 51:1780.2 applies to a person or entity doing business in Louisiana that satisfies at least one of three routes: gross annual revenue above $25 million; annual commercial buying, receiving, selling or sharing of personal information of 75,000 or more consumers, households or devices; or 50% or more of annual revenue from selling consumers’ personal information. The household and device wording should not be silently converted into a unique-person count. Louisiana Legislature: Act 502 / enrolled SB 386

The act also excludes state agencies, nonprofits, higher education and specified financial, health and other entities or data. A business should preserve the evidence for the applicable route and exceptions. A website scan cannot decide revenue, organizational status or the relationship between a device identifier and the statute’s information categories. Louisiana Legislature: Act 502 / enrolled SB 386

The enacted act sets out rights for eligible Louisiana consumers to access, correct, delete, obtain eligible portable data and opt out of targeted advertising, sale and specified profiling. Controllers will need a reliable request and appeal process and notices describing categories, purposes and any sale-related third parties. Louisiana Legislature: Act 502 / enrolled SB 386

Act 502 separately calls for prominent notices with specific statutory wording if a controller sells sensitive personal data or biometric personal data. These requirements will become relevant when the law takes effect, and the underlying sale determination requires a legal and data-flow review rather than a tag-only verdict. Louisiana Legislature: Act 502 / enrolled SB 386

The enacted sale definition includes an exchange for money or other valuable consideration with listed exceptions. Targeted advertising turns on selection based on a consumer’s activities over time and across nonaffiliated sites or apps, with exclusions for contextual, first-party and certain measurement activity. Record vendor purposes and agreements before classifying a pixel or server event. Louisiana Legislature: Act 502 / enrolled SB 386

The act provides for a controller that sells data or processes it for targeted advertising to clearly disclose that practice and how a consumer opts out. Test the consent choice, direct request and authorized-agent route against both browser-side tags and server-to-server calls, without issuing a present-day LDPA compliance verdict. Louisiana Legislature: Act 502 / enrolled SB 386

Under the enacted rights process, a consumer may designate an authorized agent using a website link, browser setting or extension, or global setting on an electronic device to communicate an opt-out of sale, targeted advertising or both. A controller must comply with such a request when it can verify the consumer and the agent’s authority with commercially reasonable efforts, subject to the act’s conditions. Louisiana Legislature: Act 502 / enrolled SB 386

This is a nuanced agent mechanism, not proof that every possible GPC header must always be accepted without verification. Build a test that captures the signal, identity and authority decision where relevant, and the effect on downstream processing. Record any failure and have counsel decide the legal consequence when the act becomes effective. Louisiana Legislature: Act 502 / enrolled SB 386

Act 502 assigns enforcement to the Louisiana Attorney General and excludes private actions under the referenced unfair-trade provisions. It takes effect January 1, 2027. From January 1 through July 31, 2027, the enacted transitional provision specifies notice before an investigation and a 30-day opportunity to cure with written explanation, supporting documentation and policy changes as needed. Louisiana Legislature: Act 502 / enrolled SB 386

This temporary process is not an existing 2026 remedy or an indefinite cure guarantee. Track the dates, build remediation records and recheck whether later legislation or regulatory guidance changes the enacted text before publishing an updated checklist near enforcement. Louisiana Legislature: Act 502 / enrolled SB 386

First establish which alternative scope route may apply and which entity or data exemptions counsel identifies. Map data categories and actual or possible sale recipients, then review the special sensitive and biometric sale notices and controller-to-processor contracts in the enrolled act. Louisiana Legislature: Act 502 / enrolled SB 386

Engineering can test a direct opt-out and a supported browser or device agent signal, compare each with actual client and server events, and repair flows that do not reflect approved choices. Preserve a dated baseline, then retest near January 2027 and distinguish any obligations arising under laws already in force today. Louisiana Legislature: Act 502 / enrolled SB 386

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, privacy notices, vendor contracts, rights-request procedures, sensitive-data obligations, and organizational governance should be handled by qualified privacy counsel.

The official enrolled Louisiana Act 502 (SB 386) supplies the scope, agent, notice and enforcement text. This guide uses the enacted wording and marks every LDPA obligation as future-effective as of the September 2026 review.

Prepared by Etalon Editorial Team. Last reviewed September 28, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for coverage, exclusions, classifications, notices, requests, sensitive data, children, contracts, assessments and governance. The LDPA is enacted but its obligations are not yet in force; a present scan cannot establish a violation of this future-effective law.