Alabama Privacy Law: The Alabama Personal Data Protection Act (HB 351, Act 2026-552) Explained
Termly can generate and maintain your privacy policy, consent banner, and data-request workflow as requirements change.
Updated October 12, 2026. Alabama now has a comprehensive consumer data privacy law. Governor Kay Ivey signed HB 351, the Alabama Personal Data Protection Act, on April 16, 2026, and it became Act 2026-552 (Alabama Secretary of State act record). The act takes effect on May 1, 2027 (Section 12). An earlier version of this article, written in March 2026, said the bill’s fate was uncertain and described several provisions — a 30-day cure period and data protection assessments among them — that are not in the enacted text. This version is based on the enrolled bill. For the full state profile, see our Alabama privacy law page.
How HB 351 Became Law
- January 29, 2026 — first read in the House (sponsor: Representative Shaw)
- February 24, 2026 — passed the House as amended
- April 7, 2026 — the Senate adopted two floor amendments and passed the bill 34-0; the House concurred 104-0 the same day
- April 16, 2026 — signed by Governor Ivey as Act 2026-552
- May 1, 2027 — effective date
Who the Alabama Privacy Law Applies To
Section 3 covers a person that conducts business in Alabama, or produces products or services targeted to Alabama residents, and that meets either of two tests:
- controls or processes the personal data of more than 25,000 consumers, excluding data processed solely to complete a payment transaction; or
- derives more than 25% of gross revenue from the sale of personal data, regardless of how many consumers’ data it holds.
Section 4(a) then removes a large group of businesses with an exemption keyed to headcount: a business with fewer than 500 employees is exempt as long as it does not sell personal data, and a nonprofit with fewer than 100 employees is exempt on the same condition. Selling personal data — which the act defines to include exchanges for monetary consideration, and for other valuable consideration where the controller receives a material benefit and the recipient’s use is unrestricted — ends the exemption regardless of size.
Other exemptions
- Entity level: political subdivisions and public corporations; two- and four-year institutions of higher education; GLBA financial institutions and their affiliates; HIPAA covered entities and business associates; political committees and data sellers that sell primarily to them; electric providers subject to NERC reliability standards
- Data level: protected health information and other health-research data; FCRA-regulated consumer reporting; data covered by the Driver’s Privacy Protection Act, FERPA, and the Farm Credit Act; employee, applicant, and contractor data; emergency contacts; benefits administration; airline price, route, and service data; data processed to comply with state law
Consumer Rights Under the Alabama Act
| Right | What the enacted text says |
|---|---|
| Confirm and access | Confirm whether data is being processed and access it (Section 5(a)(1)) |
| Correct | Correct inaccuracies (Section 5(a)(2)) |
| Delete | Direct the controller to delete personal data (Section 5(a)(3)) |
| Portability | A portable copy of data the consumer previously provided (Section 5(a)(4)) |
| Opt out | Targeted advertising, sale of personal data, and profiling in furtherance of solely automated significant decisions (Section 5(a)(5)) |
| Appeal | Not provided — a controller that declines must explain why within 45 days (Section 5(d)(2)) |
Controllers must respond within 45 days, with one 45-day extension, and answer requests free of charge once per consumer per 12 months. They may not require a new account, and they must post a clear and conspicuous website link where consumers can opt out of targeted advertising and sales (Section 6(b)).
Sensitive Data, Teens, and Controller Duties
- Sensitive data needs consent — racial or ethnic origin, religious beliefs, health conditions or diagnoses, sex life, sexual orientation, citizenship or immigration status, genetic or biometric identifiers, a known child’s data (processed under COPPA), and precise geolocation within 1,750 feet (Sections 2(21), 7(b)(2))
- Teens 13 to 15 — no targeted advertising and no sale of their data without their consent, where the controller has actual knowledge of the age (Section 7(b)(4))
- Data minimization — collection limited to what is adequate, relevant, and reasonably necessary (Section 7(a)(1))
- Privacy notice — categories of data, purposes, categories shared and recipients, a contact mechanism, and how to exercise rights (Section 7(d))
- Processor contracts — instructions, nature and purpose, data types, duration, confidentiality, deletion or return, and subcontractor flow-down (Section 8)
The enacted text does not require data protection assessments and does not require controllers to honor universal opt-out signals such as Global Privacy Control; Section 6(c) only explains how to handle a signal that conflicts with a consumer’s existing settings. If you already honor GPC for other states, use our GPC Compliance Checker to map those obligations.
Enforcement, Cure Period, and Penalties
The Alabama Attorney General enforces the act (Section 11). Before any action, the Attorney General must issue a notice of violation. A controller that corrects the violation within 45 days and gives the Attorney General an express written statement that the violations are corrected and will not recur cannot be sued, and that cure right does not expire. If the controller fails to cure, a court may assess a civil penalty of up to $15,000 per violation and grant an injunction. The act creates no private right of action.
How Alabama Compares
| Feature | Alabama | Virginia | Oklahoma |
|---|---|---|---|
| Effective date | May 1, 2027 | January 1, 2023 | January 1, 2027 |
| Consumer threshold | More than 25,000 | 100,000 | 100,000 |
| Data-sale test | More than 25% of revenue, any consumer count | 25,000 consumers + more than 50% of revenue | 25,000 consumers + more than 50% of revenue |
| Size exemption | Under 500 employees, if not selling data | None | None |
| Appeal right | No | Yes | Yes |
| Cure period | 45 days, permanent | 30 days, permanent | 30 days, permanent |
| Maximum civil penalty | $15,000 per violation | $7,500 per violation | $7,500 per violation |
Compare any of these side by side in our state privacy law comparison tool, or check which laws reach your business with the Privacy Law Calculator.
What Businesses Should Do Before May 1, 2027
- Count Alabama consumers and test the 25% data-sale revenue prong.
- Check the Section 4(a) exemptions, including the headcount exemption — and whether any of your data sharing is a “sale.”
- Publish a privacy notice that meets Section 7(d) and add the opt-out link required by Section 6(b).
- Obtain consent before processing sensitive data and before targeting or selling the data of known 13-to-15-year-olds.
- Stand up a 45-day request process and update processor contracts.
Sources
HB 351 enrolled text, Alabama Legislature; Act 2026-552 record, Alabama Secretary of State (date_retrieved: 2026-10-12).
This article provides general educational information and is not legal advice. Published March 29, 2026. Last updated October 12, 2026.
Termly can turn the requirements above into a maintained privacy policy, consent banner, and data-request workflow.