Regulations › US states › Alabama
APDPA
Alabama Personal Data Protection Act
WhenTakes effect 1 May 2027
Who enforces itState Attorney General (no private right of action)
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsApplies to businesses controlling or processing data of over 25,000 Alabama consumers (excludi…
Universal opt-outThe Act refers to honoring an opt-out preference signal but defines no standard and creates no…
Cure periodThe AG must give notice and a 45-day cure period before acting
Request deadlineControllers must respond within 45 days, extendable once by 45 days with notice
Maximum penaltyAfter a failed cure, civil penalty up to $15,000 per violation plus injunctive relief
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
2
Applies to businesses controlling or processing data of over 25,000 Alabama consumers (excluding payment-only data), or deriving over 25% of gross revenue from data sales.HB 351 (2026), § 3 · source ↗
Enacted as HB 351 (2026 Reg. Sess.), signed by Gov. Ivey April 16, 2026. Read from the enrolled text via LegiScan. Act number and Code of Alabama codification not confirmed, so cites use bill sections. Small businesses (under 500 employees) that do not sell data are exempt, which narrows reach.
Exemptions
0
Entity-level exemptions for GLBA financial institutions, HIPAA entities, insurers, and non-selling small businesses (under 500 employees) and nonprofits (under 100 employees).HB 351 (2026), § 4(a)-(b) · source ↗
Sensitive data and minors
Sensitive data
1
Processing sensitive data requires consumer consent.HB 351 (2026), §§ 2(21), 7(b)(2) · source ↗
Children and teens
2
Under-13 data is sensitive (COPPA consent). Consent is required for targeted ads or sale of data of consumers the controller actually knows are 13 to 15.HB 351 (2026), §§ 2(4), 7(b)(2), 7(b)(4) · source ↗
Didomi says 13 to 16; the enrolled text reads 13 to 15.
Data minimization
1
Collection must be adequate, relevant and reasonably necessary to processing purposes; incompatible processing is barred.HB 351 (2026), § 7(a)(1), (b)(1) · source ↗
Consumers' rights
Rights
2
Confirm and access, correct, delete, portability, and opt out of targeted ads, sale and solely automated significant decisions.HB 351 (2026), § 5(a) · source ↗
Request deadline
2
Controllers must respond within 45 days, extendable once by 45 days with notice.HB 351 (2026), § 5(d) · source ↗
Appeals
0
No appeal process is required.HB 351 (2026), § 5 · source ↗
No appeal provision found in the enrolled text.
Universal opt-out
1
The Act refers to honoring an opt-out preference signal but defines no standard and creates no clear duty.HB 351 (2026), § 6(b)-(c) · source ↗
Law firms call the signal language ambiguous; treat as uncertain.
Business duties
Processor contracts
2
Binding contract with instructions, data types, duration, confidentiality, return or deletion, compliance information and subcontractor flow-down.HB 351 (2026), § 8(a)-(b) · source ↗
Privacy notice
1
Notice must cover data categories, purposes, third-party sharing categories, a contact method and how to exercise rights; sale and targeted ads disclosed.HB 351 (2026), § 7(d)-(e) · source ↗
Loyalty programs
1
Non-discrimination rule with a carve-out for voluntary bona fide loyalty, rewards or club card programs.HB 351 (2026), §§ 6(c)(1), 7(b)(5) · source ↗
De-identified data
3
Deidentified data needs safeguards, a public commitment and contract flow-down; pseudonymous data is exempt from certain rights if kept separate.HB 351 (2026), §§ 2(10), 2(18), 9 · source ↗
Enforcement
Who enforces
1
Attorney General has exclusive enforcement authority.HB 351 (2026), § 11(a) · source ↗
Cure period
0
The AG must give notice and a 45-day cure period before acting; it does not sunset.HB 351 (2026), § 11(b) · source ↗
Maximum penalty
3
After a failed cure, civil penalty up to $15,000 per violation plus injunctive relief.HB 351 (2026), § 11(b)(2) · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws