Meta Limited Data Use in 2026: State Privacy Signals

Quick Answer

Meta Limited Data Use (LDU) is Meta's mechanism for complying with US state consumer-privacy laws that give people the right to opt out of the sale or sharing of their personal information for advertising. According to Meta's developer and business documentation, when an event is sent to Meta with the LDU signal — implemented through the data processing options parameters on the Meta Pixel and the Conversions API — Meta restricts how it processes that person's data. In practice LDU limits the use of the event for ad personalization, so the data is not used to build or expand Custom Audiences, lookalike audiences or retargeting pools, while the event still counts for conversion measurement and statistical modeling. LDU originated as a way to meet California's CCPA, and Meta has extended its applicability as additional states have enacted comprehensive privacy laws granting opt-out rights; because that list keeps growing through 2025 and 2026, advertisers should confirm the current covered states against Meta's official documentation rather than relying on a fixed list. The practical decision advertisers face is whether to let Meta apply LDU based on geography automatically or to control the flags themselves based on a consent or opt-out signal captured on their own properties, and that choice interacts with how Custom Audiences and the Conversions API are configured. The compliant posture is to map where opt-out rights apply, wire a reliable consent or opt-out signal into the pixel and Conversions API, and accept that audiences built from restricted data will be smaller in exchange for defensible compliance. Audit your data flows with the AI Compliance Audit, map multi-state exposure with the Legal Compliance Scan, and ground Meta policy with the Meta ad policies guide.

Predict ad disapprovals before you submit — try the free Meta Rejection Predictor

Meta Limited Data Use in 2026: How State Privacy Signals Reshape Custom Audiences, Conversions API and Retargeting

What Limited Data Use Is

Limited Data Use, usually abbreviated LDU, is Meta's mechanism for complying with United States state consumer-privacy laws that grant people the right to opt out of the sale or sharing of their personal information for advertising. Rather than removing a person from advertising entirely, LDU narrows how Meta is permitted to process the event data an advertiser sends, so that opted-out users are not folded into the personalization and audience-building machinery while still being counted for measurement.

For advertisers, LDU sits at the intersection of two systems that are easy to treat as separate but are not: the privacy-consent layer on your own website or app, and the data you send to Meta through the Pixel and the Conversions API. As more states pass comprehensive privacy laws through 2025 and 2026, the population of users with enforceable opt-out rights grows, and the correctness of your LDU configuration increasingly determines whether your data practices are defensible.

"Limited Data Use does not switch advertising off for a person. It constrains how their data is processed — restricting personalization and audience-building while preserving measurement — which is exactly the trade a state opt-out is meant to produce.
— AuditSocials analysis of Meta's Limited Data Use documentation"

This guide explains what the LDU signal does, which opt-outs trigger it, how it affects Custom Audiences and retargeting, and how to configure it across the Pixel and Conversions API. Ground the US picture with the United States advertising compliance guide, and define terms in the compliance glossary.

How the LDU Signal Works

According to Meta's developer and business documentation, LDU is carried by a set of data processing options parameters attached to each event. When those parameters indicate limited processing, Meta treats the event as restricted for that person.

What Restriction Actually Changes

Function	Standard event	Event flagged with LDU
Conversion measurement	Counted	Counted
Statistical modeling and reporting	Used	Generally still used
Ad personalization	Used	Restricted
Custom Audience membership	Eligible	Restricted
Lookalike and retargeting source	Eligible	Restricted

The headline point is that LDU is not a delete signal and not an event-blocking signal. The conversion still registers, so your reporting and optimization signal are largely preserved, but the person's data is walled off from the personalization and audience uses that a state opt-out is designed to stop. Because the exact processing behavior is defined by Meta and can be refined over time, treat the precise mechanics as something to confirm against Meta's current documentation rather than as a fixed guarantee. Audit how events flow from your properties to Meta with the AI Compliance Audit.

Which States and Opt-Outs Trigger It

LDU exists because US state privacy laws increasingly give consumers a right to opt out of the sale or sharing of personal information and of targeted advertising. The signal originated as a way to meet California's framework and has been extended as more states enacted comparable laws.

The Direction of Travel

California first: LDU was introduced to address California's Consumer Privacy Act opt-out of sale and sharing, the earliest and most influential of the state regimes.
An expanding map: As states such as Colorado, Connecticut and a growing roster of others brought comprehensive privacy laws into effect, the set of consumers with opt-out rights widened, and Meta's applicability guidance expanded accordingly.
Universal opt-out signals: Several states now require businesses to honor browser-level universal opt-out mechanisms such as Global Privacy Control, which means an opt-out may arrive as a signal on your site rather than a button click.

Because the covered-state list keeps changing as new laws take effect, the durable instruction is to confirm the current scope against Meta's official documentation and against the state laws themselves rather than hard-coding a list that will age. For the strict end of the state wave, see the Maryland MODPA guide, and map your multi-state exposure with the Legal Compliance Scan.

Impact on Custom Audiences and Retargeting

The most concrete advertiser-facing effect of LDU is on audiences. When data is restricted, it cannot feed the audience products that depend on personalization, and that has real consequences for reach and retargeting.

What Shrinks and What Survives

Custom Audiences from website or app activity: Events flagged for limited use are restricted from building or expanding these audiences, so pools sourced from opted-out users will be smaller.
Retargeting: A user whose data is restricted should not be retargeted on the basis of that restricted activity, which narrows lower-funnel pools in states with high opt-out rates.
Lookalikes: Because lookalikes are modeled from source audiences, restricting the source data narrows the seed and can affect the modeled audience.
Measurement and optimization: Conversion counting and modeled reporting are largely preserved, so campaign optimization signal is less affected than audience building.

The strategic reading is that LDU shifts value away from granular retargeting and toward broad-reach, well-measured prospecting — a direction that aligns with the broader post-signal-loss environment advertisers already face. For the parallel collapse of third-party retargeting signal, see the Privacy Sandbox shutdown guide. Pressure-test campaign copy and targeting with the Keyword Risk Checker.

Configuring LDU in the Pixel and Conversions API

LDU is only as good as its implementation. The central design choice is whether to let Meta apply restriction by geography automatically or to control the flags yourself from a consent or opt-out signal you capture, and the answer shapes how you wire the Pixel and Conversions API.

Implementation Decisions

Geography-based vs self-controlled: Meta supports letting it determine applicability by geography, or having the advertiser set the data processing options explicitly per event. Self-control gives precision when you already capture consent state, but it puts the accuracy burden on you.
Wire a real opt-out signal: Connect your consent management platform or opt-out mechanism — including universal signals like Global Privacy Control where required — to the flags, so an opt-out on your property propagates to Meta.
Apply consistently across Pixel and CAPI: If you send events both client-side via the Pixel and server-side via the Conversions API, the LDU state must be consistent across both paths, or a server event can undo a browser restriction.
Document the logic: Keep a written record of how applicability is determined and how the signal flows, because that documentation is what demonstrates a defensible, deliberate practice.

Because Conversions API events are sent from your server rather than the browser, they are exactly where an opt-out can silently fail to carry through, so server-side configuration deserves particular scrutiny. Audit the end-to-end flow with the AI Compliance Audit, and keep watch on state-law movement with the Policy Change Tracker.

Limited Data Use Readiness Checklist

[ ] Current LDU covered-state scope confirmed against Meta's official documentation
[ ] Opt-out and consent capture on your own properties wired to the LDU flags
[ ] Universal opt-out signals (e.g. Global Privacy Control) honored where state law requires
[ ] Geography-based vs self-controlled applicability decision made and documented
[ ] LDU state consistent across the Pixel and the Conversions API
[ ] Server-side Conversions API events verified to carry the correct restriction
[ ] Custom Audience and retargeting impact understood and accepted
[ ] Conversion measurement confirmed to persist for restricted events
[ ] Written record of applicability logic and signal flow maintained
[ ] Multi-state exposure mapped and reviewed as new laws take effect

Frequently Asked Questions

Does Limited Data Use stop a person from seeing ads, or just change how their data is processed?

Limited Data Use does not stop a person from seeing ads; it changes how Meta is permitted to process that person's event data, restricting personalization and audience-building while preserving measurement. This distinction is the single most important thing to understand about LDU, because advertisers sometimes assume an opt-out means the user disappears from advertising entirely, and that is not how the mechanism works. According to Meta's documentation, when an event arrives carrying the limited-use data processing options, Meta treats the data as restricted: it is not used to build or expand Custom Audiences, it should not drive retargeting based on that restricted activity, and it is walled off from ad personalization generally. What is preserved is the conversion itself — the event still counts, so your reporting and the optimization signal that powers campaign delivery are largely intact, and Meta can still use the data for statistical modeling and aggregated measurement. The practical effect is that an opted-out user can still encounter your ads through broad-reach prospecting, but they should not be the target of granular, data-driven retargeting that depends on their restricted activity. That is precisely the trade a state opt-out is designed to produce: the consumer exercises a right to not have their personal information sold or shared for targeted advertising, and the mechanism honors that by limiting the personalization use rather than by erasing them from the ad system. For advertisers, the consequence is that LDU is a precision instrument, not a kill switch, and treating it as a kill switch leads to two errors — either over-restricting and losing measurement you were entitled to keep, or assuming restriction removes all obligations when in fact you must still ensure the signal is correctly applied. Because the exact processing behavior is defined by Meta and can be refined, confirm the current mechanics against Meta's official documentation rather than a static description. To audit how your events are processed end to end, use the AI Compliance Audit, and ground Meta's broader advertising rules with the Meta ad policies guide. The organizing principle is that LDU restricts processing, not visibility: measurement survives, personalization and audience-building do not.

Which US states trigger Limited Data Use, and how do I keep the list current?

Limited Data Use is triggered by US state consumer-privacy laws that grant people a right to opt out of the sale or sharing of their personal information and of targeted advertising, and the only reliable way to keep the list current is to confirm it against Meta's official documentation and the state laws themselves rather than memorizing a fixed set. LDU originated as Meta's response to California's framework, which was the first and most influential state regime to give consumers an opt-out of the sale and sharing of personal information, and Meta extended the mechanism's applicability as additional states — including Colorado, Connecticut and a widening roster of others — brought comprehensive privacy laws into effect through 2025 and 2026. Because new state laws keep taking effect on a rolling schedule, any specific list written down today will age, which is why the durable instruction is process rather than memorization: maintain a recurring review of which states have enforceable opt-out rights, check Meta's current applicability guidance, and update your configuration as the map changes. A complicating factor is that opt-outs increasingly arrive not as explicit button clicks but as browser-level universal opt-out signals such as Global Privacy Control, which several states now require businesses to honor; this means an opt-out can be expressed by a signal on the user's browser that your consent infrastructure must detect and propagate. For advertisers operating nationally, the operationally simpler posture is often to build to the broad case rather than maintain brittle per-state carve-outs: capture consent and opt-out state reliably, honor universal signals where required, and let that drive the LDU flags. This avoids the fragility of a hard-coded list and the risk that a newly effective state law silently goes unhandled. To see how the strictest state regimes constrain advertising data, review the Maryland MODPA guide, map your exposure with the Legal Compliance Scan, and track new state laws on the Policy Change Tracker. The organizing principle is that the covered-state scope is a moving target, so manage it as a maintained process anchored to Meta's official documentation, not as a static list.

How does Limited Data Use affect Custom Audiences, lookalikes and retargeting?

Limited Data Use most directly affects audiences: data flagged for limited use is restricted from building or expanding Custom Audiences, should not drive retargeting based on that restricted activity, and narrows the seeds that lookalikes are modeled from, while conversion measurement and optimization signal are largely preserved. Understanding this asymmetry — audiences shrink, measurement survives — is what lets advertisers plan around LDU rather than be surprised by it. Start with Custom Audiences built from website or app activity: these are assembled from events, and when an event carries the limited-use signal, it is restricted from contributing to those audiences, so in states with high opt-out rates the pools sourced from that traffic will be smaller than the raw event volume suggests. Retargeting is the next casualty, because retargeting is just acting on Custom Audience membership; a user whose activity is restricted should not be retargeted on the basis of that activity, which thins lower-funnel pools precisely where data-driven advertising has historically been most efficient. Lookalike audiences are affected one step removed: because a lookalike is modeled from a source audience, restricting the data that would have fed the source narrows the seed, and a narrower or differently composed seed can change the modeled audience. What survives is the measurement layer — conversions still count for restricted events, and Meta can still use the data for statistical modeling and aggregated reporting — so the optimization signal that drives delivery is less degraded than the audience-building layer. The strategic implication is that LDU pushes value away from granular retargeting and toward broad-reach prospecting with strong measurement, which is the same direction the wider loss of third-party signal has been pushing advertisers for years. Rather than fight that current, the durable response is to lean into well-measured prospecting, treat retargeting pools as smaller and state-dependent, and stop assuming raw event counts equal addressable audience. For the parallel collapse of third-party retargeting infrastructure, see the Privacy Sandbox shutdown guide, and audit your audience sources with the AI Compliance Audit. The organizing principle is that LDU shrinks audiences and retargeting while preserving measurement, so plan campaigns around broad reach plus reliable measurement rather than granular remarketing.

Should I let Meta apply LDU by geography or control the flags myself?

Whether to let Meta apply Limited Data Use by geography or to control the data processing options yourself is the central implementation decision, and the right answer depends on whether you reliably capture each user's consent or opt-out state on your own properties — if you do, self-control is more precise; if you do not, geography-based application is a reasonable default. Meta supports both approaches. In the geography-based approach, Meta determines whether to apply limited processing based on where it understands the user to be, which relieves the advertiser of having to compute applicability for every event but ties the restriction to Meta's geographic determination rather than to the actual opt-out the user expressed on your site. In the self-controlled approach, the advertiser sets the data processing options explicitly on each event, which allows the restriction to reflect the real consent or opt-out signal you captured — including universal signals such as Global Privacy Control — but places the accuracy and completeness burden squarely on your implementation. The trade-off is precision versus responsibility. Self-control is the stronger posture when you already operate a mature consent management platform that records each visitor's state, because it lets the actual user choice, not an inferred location, drive the restriction, and it produces a cleaner story about honoring the specific right the user exercised. But self-control is also less forgiving: if your signal capture is incomplete or your server-side events fail to carry the flag, you can under-restrict and process data you should not. Geography-based application is the safer default when your consent infrastructure is not yet reliable, because it does not depend on you correctly threading a per-user signal through every event path. Whichever you choose, two disciplines are non-negotiable: apply the LDU state consistently across both the Pixel and the Conversions API so a server event cannot undo a browser restriction, and keep written documentation of how applicability is determined, because that record is what demonstrates a deliberate, defensible practice. To stress-test multi-jurisdiction logic use the Legal Compliance Scan, and audit the event flow with the AI Compliance Audit. The organizing principle is that self-control rewards mature consent capture with precision, while geography-based application is the safer default when your signal capture is not yet reliable.

Why does the Conversions API deserve special attention for Limited Data Use compliance?

The Conversions API deserves special attention for Limited Data Use compliance because its events are sent from your server rather than the user's browser, which makes it exactly the place where an opt-out captured on your site can silently fail to carry through to Meta, undoing the restriction you intended. With the Meta Pixel, events fire client-side in the browser, where your consent management platform and any browser-level universal opt-out signal are present and can be read in context; the restriction can be applied at the moment and place the user expressed their choice. The Conversions API works differently: your server constructs and sends the event, often decoupled in time and place from the browser interaction, and unless your server-side code is explicitly told the user's consent or opt-out state and is built to attach the limited-use data processing options accordingly, the event can reach Meta without the restriction even though the user opted out. This is the quiet failure mode that catches advertisers — the browser-side Pixel correctly restricts an opted-out user, but a parallel server-side event for the same user carries no restriction, and because server events can be used to fill measurement gaps, the unrestricted server event can effectively reintroduce the data into uses the user declined. The fix is architectural: the consent or opt-out state must be captured and then propagated to the server so that Conversions API events carry the same LDU state as the corresponding Pixel events, and the two paths must be reconciled so they never disagree for the same user. This requires treating consent state as data that travels with the event through your whole stack, not as something that lives only in the browser. It also requires testing — verifying that a known opted-out user's server-side events actually arrive at Meta with the restriction set, rather than assuming the configuration works. Given that many advertisers adopted the Conversions API precisely to recover measurement lost to browser restrictions, the risk that it also bypasses privacy restrictions is real and deserves deliberate verification. Audit the end-to-end flow, including server-side events, with the AI Compliance Audit, and ground the US state-law framework with the United States advertising compliance guide. The organizing principle is that server-side Conversions API events are where opt-outs silently fail, so they must be explicitly wired to carry the same Limited Data Use state as the Pixel and verified, not assumed.

Don't miss the next policy change.

Create a free account — track every policy change across 8 platforms, get instant alerts, and access every free compliance tool. Or try our Meta Rejection Predictor first.

Create Free Account

Report Keywords — Run AI Compliance Audit

#Meta Ads#Limited Data Use#State Privacy#CCPA#Custom Audiences#Conversions API#Retargeting#Data Processing#Advertisers#2026 Policy#United States#Compliance Guide 2026

Share This Report

Tweet Share

Meta Sensitive-Category Ad Targeting and Audience Compliance in 2026: Personal Attributes, Special Categories and Custom Audiences

Meta restricts how advertisers target and describe audiences tied to health, religion and other sensitive attributes — and 2026 review reaches audience names, not just targeting.

FIFA World Cup 2026 Advertising Compliance: Ambush Marketing, IP Rules and Platform Enforcement

The FIFA World Cup 2026 draws non-sponsor brands to event marketing — and to FIFA's trademark rules, ambush-marketing limits, and the counterfeit and IP policies that platforms enforce on ads.

Meta Beauty and Cosmetic Ads in 2026: Before/After Photos, Body Image and Compliant Creative

Beauty ads are a high-rejection category on Meta. Whether you can use before/after photos depends on the product type, and negative self-perception framing is always restricted.

Platforms

Industries

Knowledge

Blog

Meta Limited Data Use in 2026: How State Privacy Signals Reshape Custom Audiences, Conversions API and Retargeting