79%
of Alabama's 19 requirements are already met by California (CA). Here is what APDPA adds, biggest gaps first.
ThresholdsWho it coversBig gap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
APDPA adds2 Applies to businesses controlling or processing data of over 25,000 Alabama consumers (excluding payment-only data), or deriving over 25% of gross revenue from data sales.
HB 351 (2026), § 3 · source ↗
Sensitive dataSensitive data and minorsGap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
APDPA adds1 Processing sensitive data requires consumer consent.
HB 351 (2026), §§ 2(21), 7(b)(2) · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
APDPA adds3 Deidentified data needs safeguards, a public commitment and contract flow-down; pseudonymous data is exempt from certain rights if kept separate.
HB 351 (2026), §§ 2(10), 2(18), 9 · source ↗
Maximum penaltyEnforcementGap
CA2 Up to $2,663 per violation and $7,988 per intentional violation or violation involving known minors under 16 (2025 adjusted).
APDPA adds3 After a failed cure, civil penalty up to $15,000 per violation plus injunctive relief.
HB 351 (2026), § 11(b)(2) · source ↗
Already covered by CA: Exemptions, Children and teens, Data minimization, Rights, Request deadline, Appeals, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Private action, Rulemaking.
A gap means APDPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
