Privacy Law Library

Alabama Personal Data Protection Act

APDPA

Comprehensive privacy · Children · Health · Genetic · Biometric · Location

Alabama's comprehensive consumer privacy law gives Alabama residents rights to confirm, access, correct, delete, and port their personal data and to opt out of targeted advertising, sale, and profiling for solely automated significant decisions. Controllers must minimize data, secure it, get consent before processing sensitive data, publish a privacy notice, and may not sell or use for targeted advertising the data of known 13- to 15-year-olds without consent. It takes effect May 1, 2027 and has a lower applicability threshold (25,000 consumers) than most state privacy laws, offset by a broad small-business exemption.

Where
Alabama
Citation
Ala. Code §§ 8-44-1 to 8-44-11 (Act 2026-552, HB351)
Status
Enacted, not yet in force
In force since
2027-05-01
Enforced by
Alabama Attorney General
People can sue
No
Penalties
The Attorney General must first issue a notice of violation; if the controller does not cure within 45 days, the AG may sue for an injunction and the court may assess a civil penalty of up to $15,000 per violation. A cure plus a written statement that violations are corrected bars the action.
Applies to
  • Persons that conduct business in Alabama or produce products or services targeted to Alabama residents and that either control or process personal data of more than 25,000 consumers (excluding data processed solely to complete a payment transaction) or derive more than 25% of gross revenue from the sale of personal data
  • Processors acting on behalf of covered controllers
  • Entity exemptions include political subdivisions and certain public boards and authorities, institutions of higher education, GLBA financial institutions and affiliates, HIPAA covered entities and business associates, businesses with fewer than 500 employees that do not sell personal data, nonprofits with fewer than 100 employees that do not sell personal data, political committees and organizations, and NERC-regulated electric providers
  • Data exemptions include PHI and other health research data, FCRA-regulated activity, DPPA, FERPA and Farm Credit Act data, employment-context data, and data processed to comply with state law

What a privacy notice must say

  • Provide a clear and conspicuous website link to a page where consumers can opt out of targeted advertising or sale (or up-to-date contact information for opt-out requests); an opt-out preference signal controls over conflicting controller-specific settings.Ala. Code § 8-44-6(b)-(c) · From 2027-05-01
  • Publish a privacy notice listing categories of personal data processed, purposes, categories shared and third-party recipients, a contact email or mechanism, and how to exercise rights; disclose sale and targeted advertising conspicuously.Ala. Code § 8-44-7(c)-(d) · From 2027-05-01

Rights it gives people

  • On an authenticated request, controllers must confirm processing and provide access, correct inaccuracies, delete personal data, and provide a portable copy of data the consumer supplied.Ala. Code § 8-44-5(a)(1)-(4) · From 2027-05-01
  • Consumers may opt out of processing for targeted advertising, sale of personal data, and profiling in furtherance of solely automated significant decisions.Ala. Code § 8-44-5(a)(5) · From 2027-05-01

Practices it requires

  • Obtain consent before processing sensitive data (including health, precise geolocation, genetic or biometric data used to identify, citizenship or immigration status); process known children's data in line with COPPA.Ala. Code § 8-44-7(b)(2); § 8-44-2(21) · From 2027-05-01
  • Respond to rights requests within 45 days, extendable once by 45 days with notice; give reasons for declining; provide responses free once per 12 months.Ala. Code § 8-44-5(d) · From 2027-05-01
  • Limit collection to what is adequate, relevant, and reasonably necessary for disclosed purposes, and do not process for incompatible purposes.Ala. Code § 8-44-7(a)(1), (b)(1) · From 2027-05-01
  • Do not sell, or process for targeted advertising, the personal data of a consumer the controller actually knows is 13 to 15 years old without consent.Ala. Code § 8-44-7(b)(4) · Only if: Actual knowledge of age 13-15 · From 2027-05-01
  • Do not deny goods or services, or charge different prices, because a consumer opted out, except for bona fide loyalty or rewards programs.Ala. Code § 8-44-7(b)(5) · From 2027-05-01
  • Provide a consent-revocation mechanism as easy as giving consent; do not require a new account to exercise rights; contractual waivers of rights are void.Ala. Code § 8-44-7(a)(3), (e)(2), (f) · From 2027-05-01

Security duties

  • Maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the personal data.Ala. Code § 8-44-7(a)(2) · From 2027-05-01

Other duties

  • Controller-processor contracts must set processing instructions, nature, purpose, data types and duration, and impose confidentiality, deletion or return, audit-information, and subcontractor flow-down duties.Ala. Code § 8-44-8(b) · From 2027-05-01

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: The Act does not expressly bar private suits; 'no' private right of action reflects that only the Attorney General is given enforcement power (Ala. Code § 8-44-11). No Attorney General guidance or rules had been located as of 2026-09-25.

Research reference, not legal advice.