LDPA

Louisiana Data Privacy Act (SB 386 / Act 502)

Key Facts

Effective Date
January 1, 2027
Enacted
May 29, 2026
Enforcing Authority
Louisiana Attorney General
Consent Model
Opt-out

Penalties

AG-enforced as an unfair trade practice; no private right of action; 30-day cure period (sunsets 2027-07-31).

Data Subject Rights

Access your data45 days

Confirm whether a controller is processing your personal data and access that data; the controller is not required to reveal a trade secret.

Correct your data45 days

Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.

Delete your data45 days

Have a controller delete personal data you provided or that it obtained about you; for data obtained from other sources, it may instead keep a minimal record so the data stays deleted, or opt you out of non-exempt processing.

Port your data45 days

If the data is available in a digital format, obtain a copy of the personal data you previously provided in a portable and, where technically feasible, readily usable format you can transmit to another controller.

Opt out of targeted advertising45 days

Opt out of the processing of your personal data for targeted advertising.

Opt out of sale45 days

Opt out of the sale of your personal data, meaning its exchange for monetary or other valuable consideration by the controller to a third party.

Opt out of profiling45 days

Opt out of solely automated profiling in furtherance of decisions that result in the provision or denial of financial or lending services, housing, insurance, health care, education enrollment, employment opportunities, criminal justice, or access to basic necessities.

Appeal a refusal60 days

Appeal a controller's refusal to act on your request, within a reasonable period after you receive the decision, through a process that is conspicuously available and similar to the request process, and receive a written explanation of the decision.

Contact the Attorney General

If a controller denies your appeal, it must give you the online mechanism through which you can contact the Louisiana Attorney General to submit a complaint.

Use an authorized agent to opt out45 days

Designate an authorized agent, including through a link, browser setting or extension, or global device setting, to opt out of targeted advertising or the sale of your personal data for you; this agent right does not extend to profiling or other requests.

Non-discrimination

A controller may not discriminate against you for exercising your rights, such as by denying goods or services or charging different prices, but it may offer a different price, rate, level, quality or selection if you opted out, or through a bona fide loyalty, rewards, premium features, discount or club card program.

US State Specifics

Cure Period
30 days
Private Right of Action
No
Global Opt-out Required
Yes
Sensitive Data Opt-in
Yes

Other North America Regulations

CCPACalifornia, United States
The CCPA was the first comprehensive consumer privacy law in the United States, giving California residents the right to know what personal information businesses collect and to opt out of its sale. It established the opt-out consent model that most subsequent US state privacy laws adopted.
CPRACalifornia, United States
The CPRA is the most comprehensive US state privacy law with a dedicated enforcement agency (CPPA). Cross-context behavioral advertising via cookies constitutes sharing personal information, triggering opt-out obligations. GPC signals must be honored as valid opt-out requests.
CIPACalifornia, United States
CIPA is a 1967 California chapter covering wiretapping, eavesdropping, and other privacy invasions, not a website-specific law. Since 2022, courts have applied two of its sections to website chat, analytics, and ad tools, and any visitor can sue directly for at least $5,000 per violation, no revenue threshold.
PIPEDACanada
Canada's federal private-sector privacy law based on 10 fair information principles. Requires express consent for sensitive data and implied consent for less sensitive data. OPC guidance addresses cookies and online behavioral advertising. The CPPA replacement bill died January 2025; a new bill is expected.
TDPSATexas, United States
The TDPSA is the broadest US state privacy law: no revenue thresholds and no minimum consumer data volume thresholds. Applies to any non-small-business processing personal data of Texas residents. Must honor GPC signals since January 2025. This breadth means far more businesses are captured than under any other state law.
MODPAMaryland, United States
The most restrictive US state privacy law. Sensitive data may only be processed when strictly necessary to deliver a requested service, and sale of sensitive data is completely prohibited even with consent. Under-18 sale and targeted advertising are prohibited regardless of consent. Strictest data minimization in the US.

LDPA requires you to recognize an opt-out preference signal such as Global Privacy Control. Check whether GPC is working on your site to confirm the signal reaches you and that trackers actually stop firing when it does.

Stay compliant with LDPA

ConsentStack helps you implement Opt-out consent for Louisiana, United States automatically.