Website Compliance Under the Louisiana Data Privacy Act

Introduction

The Louisiana Data Privacy Act (LDPA) takes effect on January 1, 2027, and imposes new obligations on any website that collects, processes, or shares personal data of Louisiana residents. Whether you run a Shopify store, a SaaS platform, or a content-driven site, understanding what the LDPA requires is essential to avoiding penalties and maintaining consumer trust. This guide breaks down every aspect of website compliance under the Louisiana Data Privacy Act so you can build a compliant, future-proof privacy program.

The LDPA, enacted as Senate Bill 386 and signed on May 29, 2026, is Louisiana’s comprehensive consumer data privacy law. It becomes effective January 1, 2027, placing Louisiana among the growing roster of states with dedicated privacy frameworks.

The LDPA focuses on the personal data of Louisiana residents acting in an individual or household context, excluding individuals acting in a commercial or employment context. This distinction matters for websites because your customer-facing data collection (orders, browsing behavior, ad tracking) is squarely in scope, while B2B contact databases and HR data generally are not.

While the act aligns with other modern state data protection laws, it introduces its own twists: a three-part applicability test, a broad definition of “sale,” and explicit notice requirements when you sell sensitive personal data or biometric personal data. For websites and online stores, LDPA’s relevance is immediate because tracking technologies, targeted advertising, data sales, and cross-border e-commerce are core activities the law addresses.

Pandectes GDPR ComplianceThe most popular & reviewed GDPR app for Shopify★★★★★ 5/5 · 3,000+ reviews · Built for ShopifyInstall free on Shopify

Does LDPA Apply to Your Website?

LDPA applicability requires two conditions: doing business in Louisiana or targeting Louisiana residents, and meeting at least one statutory threshold in the prior calendar year.

The three thresholds are:

Threshold	Trigger
Revenue	Annual gross revenues exceeding $25 million
Consumer volume	Processing personal data of 75,000+ Louisiana consumers, households, or devices
Data sales revenue	Deriving 50% or more of gross revenue from the sale of personal data

A “consumer” under LDPA means a Louisiana resident in an individual or household context, so employment HR data and pure B2B contact data sit outside scope.

Here is what catches many merchants off guard: an online-only Shopify store headquartered in Texas with $30 million in global revenue qualifies under the first threshold even if Louisiana data sales are modest. Similarly, a SaaS platform processing device IDs from 75,000+ Louisiana visitors for behavioral advertising crosses the second threshold. If your website ships to Louisiana, runs Louisiana-specific promotions, or prices in USD with localized marketing, treat LDPA as applicable and build it into your data protection program.

Entity and Data Exemptions Relevant to Websites

Even data-driven websites may be partially exempt where other sectoral laws already govern data protection. However, these exemptions are narrower than most businesses assume.

Entity-level exemptions include:

• State agencies and political subdivisions are exempt from the LDPA
• Financial institutions subject to the Gramm-Leach-Bliley Act (GLBA) are exempt
• HIPAA-covered entities and their business associates are exempt
• Nonprofit organizations are exempt under the LDPA
• Institutions of higher education are exempt from the LDPA
• Certain electric public utilities

Data-level exemptions cover protected health information under HIPAA, data regulated by the Fair Credit Reporting Act, FERPA education records, and Driver’s Privacy Protection Act data, among others.

The critical point: these exemptions typically do not cover core website analytics, cookies, adtech pixels, and e-commerce customer data. Even if a parent entity qualifies for an entity exemption, the website’s public-facing data collection and advertising practices may still fall under LDPA. Do not assume your entire website is exempt merely because part of your organization is regulated elsewhere.

Key LDPA Concepts Websites Must Understand

Correct LDPA interpretation on a website hinges on how the law defines its core terms.

Personal data is any information linked or reasonably linkable to an identified or identifiable individual. On a website, this includes IP addresses, cookie IDs, device IDs, email addresses, purchase history, and browsing patterns. Personal data collected through forms, tracking scripts, and embedded third-party tools all count.

Sensitive personal data carries heightened requirements. The LDPA defines it to include personal data revealing racial or ethnic origin, religious beliefs, citizenship or immigration status, precise geolocation, genetic or biometric data, mental or physical health diagnosis information, sexual orientation, and personal data of known children under 13. Affirmative consent for processing sensitive data must be clear, explicit, and unambiguous. Businesses must implement consent mechanisms for sensitive data collection before it occurs.

The sale of personal data means disclosure for monetary or other valuable consideration. Website-specific examples include sharing user-profile or tracking data with ad networks and data brokers, or affiliate revenue arrangements tied to selling consumers’ personal information. Carve-outs exist for transfers to processors, affiliates, or for a service requested by the consumer.

The controller is the entity determining purposes and means of processing personal data-typically the site operator or merchant. Processors (email service providers, analytics platforms, cloud hosts) act on controller instructions and do not independently decide commercial purposes for the data.

Consumer Rights Under LDPA and Website Workflows

The LDPA grants Louisiana consumers several rights that websites must operationalize. Consumers can request access to their personal data, request correction of inaccuracies in their data, request deletion of their personal data, request a portable copy of their data, and opt out of targeted advertising and data sales.

Each right translates into a concrete website workflow:

• Access and correction: Online request forms or account dashboards where consumers can view and update personal data processed by your site
• Deletion: Back-office processes to delete or de-identify records tied to an email, account, or device ID
• Portability: Export tools delivering data in a commonly used, machine-readable format
• Opt-out: Visible mechanisms (links, preference centers) for opting out of sale and targeted advertising

Businesses must respond to consumer requests within 45 days, with one possible 45-day extension if reasonably necessary. Denials must include justification and an appeal mechanism. Controllers must provide up to two free responses per year and may impose reasonable fees only for manifestly unfounded or repetitive requests.

An authorized agent-an individual, law firm, or privacy service-can submit opt-out requests on a consumer’s behalf. Websites must build verification processes that use commercially reasonable effort without being overly burdensome. A clear “Your Louisiana Data Rights” footer page with forms, email contacts, and verification explanations is a practical approach.

Universal Opt-Out Signals, Cookies, and Targeted Advertising

LDPA connects universal opt-out mechanisms to the authorized agent provisions, meaning websites may need to honor browser or device signals like the Global Privacy Control where technically feasible.

Targeted advertising under LDPA means displaying ads based on personal data gathered from a consumer’s activities across non-affiliated websites or apps. This is standard practice on ad-supported and e-commerce sites using retargeting pixels, behavioral ad platforms, or lookalike audiences.

Louisiana consumers can opt out of targeted advertising and the sale of personal data. Websites should implement consumer-friendly mechanisms: cookie banners, preference centers, and “Do Not Sell or Share My Personal Information” links where sale occurs. Universal opt-out signals must reflect an affirmative consumer choice-not a default internet browser setting. If a consumer intentionally enables such signals, controllers who can technically process them should treat them in the same manner as an authorized agent opt-out request. Controllers can decline signals only if they lack technical ability.

A consent management platform like Pandectes can detect, categorize, and block non-essential cookies and tags until valid consent or opt-in is recorded, integrating LDPA requirements with GDPR and California Consumer Privacy Act rules within a single banner solution.

Privacy Notice, Cookie Notice, and LDPA-Specific Disclosures

Controllers must provide a clear privacy notice to consumers. LDPA requires it to be accessible, written in plain language, linked from the footer on every page, and usable on mobile devices.

A Louisiana-compliant privacy notice should cover:

• Categories of personal data collected and sensitive data involved
• Purposes of data processing
• Categories of third parties receiving data
• Whether the business sells personal data or uses it for targeted advertising
• Consumer rights and instructions for exercising them
• Appeal process details
• Controller contact information

The LDPA mandates separate notices for selling sensitive data. When a controller sells sensitive personal data or has biometric data processed for commercial purposes, the law requires a prominent statement using LDPA-prescribed language (e.g., “NOTICE: We may sell your sensitive personal data”), displayed in the same manner as the overall privacy notice.

Cookie and tracking-technology transparency should describe categories-strictly necessary, analytics, advertising-and connect each to LDPA rights and opt-out choices. Dynamic notices generated by tools like Pandectes automatically pull in detected cookies, categorize them, and keep Louisiana data privacy disclosures current without manual recoding.

Data Protection Principles and Website Security

Beyond notices and consumer rights, LDPA embeds core data protection principles that websites must follow: data minimization, purpose limitation, and reasonable security.

Data minimization means personal data collection must be adequate, relevant, and reasonably necessary for its stated purpose. Controllers must limit data collection to necessary information. For example, do not request date of birth for a simple newsletter signup if it serves no disclosed purpose.

Purpose limitation requires that data not be repurposed beyond what your privacy notice discloses. If you collect email addresses for order confirmations, do not silently repurpose them for unrelated profiling or mass media channel advertising campaigns without additional transparency and, where required, consent.

Security safeguards: The LDPA includes provisions for security safeguards to protect personal information.

Implement administrative, technical, and physical data security practices appropriate to the volume and sensitivity of personal data:

• HTTPS across all pages
• Strong access controls and least-privilege policies
• Encryption in transit and at rest
• Regular patching and vulnerability management
• Vendor risk management to address any reasonably foreseeable risk

Website compliance requirements focus on transparency, consumer opt-out rights, and data minimization, but security failures can independently trigger enforcement.

Data Protection Assessments for High-Risk Website Processing

The LDPA requires data protection assessments for high-risk processing activities starting January 1, 2027. These include targeted advertising, selling personal data, profiling that produces legal or similarly significant effects, and processing sensitive data, all of which heighten the risk to consumer privacy.

Entities must conduct data protection assessments that examine:

• Data flows across the website, including tracking and adtech partners
• Risks to consumer rights and freedoms
• Benefits of processing versus impact on the data subject
• Safeguards implemented (pseudonymization, de-identification, opt-in flows)
• Alternatives that would reduce privacy impact

Businesses can leverage existing GDPR DPIAs or comparable assessments if they substantially cover the same risk areas. This makes it easier for global businesses to document data protection assessments without starting from scratch.

Assessments remain confidential but can be requested by the Louisiana Attorney General via civil investigative demand. You must keep them current as your website introduces new features, retargeting campaigns, or vendor integrations. For example, launching a behavioral recommendation engine or adding a new ad network both trigger the need to conduct data protection assessments before go-live.

Processor Contracts, Third-Party Scripts, and E-commerce Platforms

LDPA requires controllers to govern relationships with processors through written contracts specifying instructions, purpose, data types, duration, and security obligations. This matters for websites because third-party scripts-pixels, chat widgets, review tools, social plugins-can collect personal data without the merchant’s full awareness.

Contracts must clarify roles and ensure processors assist with consumer requests and data protection duties. LDPA-aligned agreements should include audit and oversight rights, allowing controllers to receive compliance reports or assessments.

For Shopify and other e-commerce platforms, store owners are controllers while Shopify and installed apps are typically processors or, in some cases, independent controllers. Merchants must understand and document who does what for LDPA compliance. Pandectes integrates with Shopify and Google Consent Mode, centralizing consent records and cookie control across multiple third-party scripts to simplify multi-vendor compliance.

Enforcement, Penalties, and LDPA Timeline

The Louisiana Attorney General has exclusive authority to enforce the LDPA. Louisiana law treats violations as unfair trade practices and prosecutes them under the Unfair Trade Practices and Consumer Protection Law. No private right of action exists for LDPA violations.

Key dates and penalties:

Period	What Happens
January 1 – July 31, 2027	30-day cure period: AG must send written notice; business has 30 days to cure and certify remediation
After July 31, 2027	No mandatory cure window; AG may investigate and enforce immediately
Penalties	Up to $5,000 per violation; enhanced penalties possible for vulnerable populations

Every non-compliant practice on a website-a missing sensitive-data sale notice, ignored opt-out requests, misleading cookie disclosures, or failing to implement reasonable security-can count as a separate violation. The financial exposure compounds quickly across thousands of consumers.

From January 1, 2027, a 30-day cure period applies before investigations. After July 31, 2027, the cure period will no longer apply, making proactive compliance far more valuable than relying on the temporary safety net.

Conclusion

Complying with the Louisiana Data Privacy Act is essential for any website that collects or processes personal data of Louisiana residents. With its comprehensive requirements around transparency, consumer rights, consent for sensitive data, and robust security measures, the LDPA sets a high standard for data privacy. Businesses must carefully assess their applicability based on revenue, consumer volume, and data sales, and implement clear privacy notices, user-friendly opt-out mechanisms, and rigorous data protection assessments.

Leveraging tools like Pandectes can simplify compliance by automating consent management and cookie control across platforms. As enforcement begins in 2027, proactive preparation not only mitigates legal risks but also builds consumer trust and competitive advantage in a privacy-conscious market. Start your LDPA compliance journey today to ensure your website respects Louisiana residents’ data privacy rights and stays ahead of evolving regulations.