Alabama Privacy Law

The Alabama Personal Data Protection Act was enacted as House Bill 351 of the 2026 Regular Session (sponsored by Representative Shaw) and became Act 2026-552 when Governor Kay Ivey signed it on April 16, 2026, according to the Alabama Secretary of State's act record. The House first passed the bill on February 24, 2026; the Senate adopted floor amendments and passed it 34-0 on April 7, 2026, and the House concurred in the Senate amendments 104-0 the same day. Section 12 of the act sets the effective date: May 1, 2027. Alabama follows Oklahoma (signed March 20, 2026) as the next state to enact a comprehensive consumer data privacy law.

The act applies to a person that conducts business in Alabama, or produces products or services targeted to Alabama residents, and that either controls or processes the personal data of more than 25,000 consumers (excluding data processed solely to complete a payment transaction) or derives more than 25 percent of gross revenue from the sale of personal data, regardless of how many consumers' data it holds (Section 3). The 25,000-consumer trigger is among the lowest in the country, but Section 4(a) softens it with an exemption keyed to employee headcount, which most state privacy laws do not use: a business with fewer than 500 employees is outside the act entirely as long as it does not sell personal data, and a nonprofit with fewer than 100 employees is likewise exempt unless it sells personal data. Entity-level exemptions also cover political subdivisions, two- and four-year institutions of higher education, GLBA-governed financial institutions and their affiliates, HIPAA covered entities and business associates, political committees, and electric providers subject to NERC reliability standards.

Consumers get the familiar Virginia-model rights: to confirm and access personal data, correct inaccuracies, delete personal data, obtain a portable copy of data they provided, and opt out of targeted advertising, the sale of personal data, and profiling in furtherance of solely automated significant decisions (Section 5). Controllers must respond within 45 days, extendable once by 45 days, and must provide the information free of charge once per consumer in any 12-month period. Unlike most comparable laws, the enacted text contains no consumer right to appeal a controller's refusal to act and no data protection assessment requirement. Sensitive data — including racial or ethnic origin, religious beliefs, health conditions, sex life, sexual orientation, citizenship or immigration status, genetic or biometric identifiers, a known child's data, and precise geolocation within 1,750 feet — may not be processed without the consumer's consent (Section 7(b)(2)), and a controller with actual knowledge that a consumer is 13, 14, or 15 may not use that consumer's data for targeted advertising or sell it without consent (Section 7(b)(4)).

The Attorney General enforces the act (Section 11). Before bringing any action the Attorney General must send a notice of violation, and the controller has 45 days to correct the violation; a controller that corrects it and gives the Attorney General an express written statement that the violations are corrected and will not recur cannot be sued. The cure right does not sunset. If the controller fails to cure, a court may assess a civil penalty of up to $15,000 per violation. The act does not create a private right of action, and it does not require controllers to honor universal opt-out signals such as Global Privacy Control.

Most state privacy laws decide coverage by counting consumers. Alabama counts consumers too — more than 25,000 triggers the act — but Section 4(a)(7) then removes any business with fewer than 500 employees, provided the business does not engage in the sale of personal data. Section 4(a)(8) does the same for nonprofits with fewer than 100 employees. Most state privacy laws have no headcount-based exemption at all; Texas, for comparison, exempts small businesses by reference to federal SBA size standards.

The practical result is a two-question test. First, does the business control or process the personal data of more than 25,000 Alabama consumers, or earn more than 25 percent of gross revenue from selling personal data? Second, if it has fewer than 500 employees (fewer than 100 for a nonprofit), does it sell personal data at all? A mid-sized retailer with 300 employees and 80,000 Alabama customers is outside the act if it never sells data — and inside it the moment it does. Because the act defines a sale to include exchanges for "other valuable consideration" where the controller receives a material benefit and the recipient's use is unrestricted, data-sharing arrangements with advertising partners deserve a close look before a business relies on the exemption.

• More than 25,000 consumers (payment-only data excluded) OR more than 25% of gross revenue from selling personal data — Section 3
• Exempt: businesses with fewer than 500 employees that do not sell personal data — Section 4(a)(7)
• Exempt: nonprofits with fewer than 100 employees that do not sell personal data — Section 4(a)(8)
• Exempt at entity level: higher education, GLBA financial institutions and affiliates, HIPAA covered entities and business associates, political subdivisions — Section 4(a)

Compared with the Virginia model it otherwise follows, the enacted Alabama text omits three obligations that most recent state laws include. There is no consumer right to appeal a controller's refusal to act on a request; Section 5(d)(2) only requires the controller to explain, within 45 days, why it declined. There is no data protection assessment requirement for targeted advertising, sales, profiling, or sensitive data. And there is no obligation to honor universal opt-out signals such as Global Privacy Control — the act requires a website opt-out link instead (Section 6(b)).

Businesses that already run a multi-state program built for Connecticut, Colorado, or Oregon will generally exceed Alabama's requirements. The Alabama-specific items to check are the 13-to-15 teen consent rule, the 45-day outer limit for stopping processing after a consumer revokes consent (Section 7(a)(3)), and the privacy-notice contents listed in Section 7(d).