Alabama Privacy Law: What Happened to HB 351 and What Comes Next
What Was Alabama HB 351?
HB 351, the Alabama Personal Data Protection Act, was a comprehensive consumer data privacy bill that would have made Alabama the 21st US state with a broad privacy law. Sponsored by Rep. Mike Shaw, the bill would have established regulations for how businesses process personal data of Alabama residents.
The proposed law included familiar elements from other state privacy laws: applicability thresholds (businesses processing data of 25,000+ consumers or deriving 25% or more of gross revenue from data sales), consumer rights (access, correction, deletion, portability, opt-out of sale and targeted advertising), and enforcement by the Alabama Attorney General.
For a detailed analysis of the bill’s original provisions, see our comprehensive guide to the Alabama Personal Data Protection Act.
What Happened in the 2026 Legislative Session
Alabama’s 2026 Regular Session ran from February through March 27, 2026. Here is the timeline of HB 351’s journey:
House Passage: Unanimous Support
On February 24, 2026, the Alabama House of Representatives passed HB 351 with an overwhelming 103-0 vote. Before passage, Rep. Shaw introduced a significant amendment that reshaped the bill:
- Removed AI provisions — The original bill included restrictions on AI profiling and automated decision-making. The amendment removed these provisions, with Shaw stating it would effectively remove "any mention of AI" from the bill.
- Expanded applicability thresholds — The amendment raised the bar for which businesses the law would cover.
- Delayed the effective date — The effective date was pushed from October 1, 2026 to May 1, 2027, giving businesses more time to prepare.
Senate Committee: Universal Opt-Out Removed
After reaching the Senate, HB 351 was referred to the County and Municipal Government Committee. In early March, the committee agreed to revise the bill to remove the universal opt-out mechanism requirement. This was a significant change — the universal opt-out (which includes honoring signals like Global Privacy Control) is a requirement in California, Colorado, Connecticut, Texas, and several other states. See our universal opt-out compliance guide for context on this requirement.
Session End: Bill Did Not Receive Senate Floor Vote
The Alabama 2026 Regular Session ended on March 27, 2026. Based on available legislative tracking data, HB 351 does not appear to have received a final floor vote in the Senate before the session concluded. The bill was placed on the Senate calendar after committee amendments, but the full Senate did not take action before adjournment.
Key Changes Made During the Legislative Process
The bill evolved significantly from its original introduction to its final Senate committee version:
| Provision | Original Bill | House Amendment | Senate Committee |
|---|---|---|---|
| AI/profiling provisions | Included | Removed | Removed |
| Universal opt-out (GPC) | Included | Included | Removed |
| Effective date | October 1, 2026 | May 1, 2027 | May 1, 2027 |
| Applicability thresholds | Standard | Expanded | Expanded |
| Core consumer rights | Full suite | Full suite | Full suite (minus universal opt-out) |
| AG enforcement | Yes | Yes | Yes |
| Private right of action | No | No | No |
What Comes Next for Alabama Privacy Legislation
Despite not passing this session, there are strong signals that Alabama will eventually enact a comprehensive privacy law:
- Overwhelming bipartisan support — The 103-0 House vote demonstrates that privacy legislation has broad support in Alabama. No legislators opposed the bill in the House.
- Senate concerns were narrow — The Senate’s objections focused primarily on the universal opt-out mechanism, not the broader framework. A future bill without this provision may face less resistance.
- National momentum — With 20+ states already having comprehensive privacy laws, the pressure on remaining states continues to grow. See our overview of how many states have data privacy laws.
- Likely reintroduction — Given the strong House support and the relatively minor nature of the Senate’s concerns, a revised version of the bill is likely to be reintroduced in the 2027 session.
Should Businesses Prepare Now?
Even though Alabama does not currently have a comprehensive privacy law, businesses operating in the state should consider proactive compliance for several reasons:
- Other state laws may already apply — If you process data of consumers in any of the 20+ states with active privacy laws, you already have compliance obligations. Use our Privacy Law Calculator to check which laws apply to your business.
- The proposed Alabama law mirrors existing frameworks — HB 351 closely followed the Virginia VCDPA model. If you comply with Virginia, you would likely meet most of Alabama’s proposed requirements with minimal additional effort.
- Passage remains likely — The strong House support suggests this is a matter of "when," not "if." Businesses that prepare now avoid a compliance scramble when the law eventually passes.
- Privacy compliance is increasingly a business necessity — Beyond legal requirements, consumers and business partners increasingly expect privacy protections. Proactive compliance demonstrates good data stewardship.
Use our state comparison tool to see how Alabama’s proposed law would have compared to existing state privacy laws.
Frequently Asked Questions
Did Alabama pass a privacy law in 2026?
No. Alabama HB 351 (the Alabama Personal Data Protection Act) passed the House unanimously with a 103-0 vote on February 24, 2026, but did not receive a final vote in the Senate before the legislative session ended on March 27, 2026. Alabama does not currently have a comprehensive consumer data privacy law.
When will Alabama have a privacy law?
It is difficult to predict with certainty, but the strong bipartisan House support and the narrowness of Senate objections suggest the bill may be reintroduced in the 2027 legislative session. If reintroduced without the controversial universal opt-out provision, it could have a clearer path to passage.
What would HB 351 have required?
In its final form, HB 351 would have required businesses processing data of 25,000+ Alabama consumers (or deriving 25%+ of revenue from data sales) to provide consumer rights including access, correction, deletion, portability, and opt-out of sale and targeted advertising. It would have been enforced by the Alabama Attorney General with no private right of action, and would have taken effect May 1, 2027.
How does the proposed Alabama law compare to other state privacy laws?
The proposed Alabama Personal Data Protection Act closely followed the Virginia VCDPA model — one of the most common templates for state privacy laws. It included standard consumer rights, AG-only enforcement, and a business-friendly threshold. The final Senate committee version was notable for removing the universal opt-out mechanism, which would have placed Alabama among the majority of states that do not require honoring Global Privacy Control signals.
Last updated: March 29, 2026.Disclaimer: PrivacyLawMap provides general information about US state privacy laws for educational purposes only. This is NOT legal advice. Privacy laws are complex and frequently amended. Consult with a qualified privacy attorney for advice specific to your business. PrivacyLawMap makes no warranties about the accuracy or completeness of this information.