Comprehensive state privacy law
Alabama privacy law
Alabama Personal Data Protection Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Ala. Code §§ 8-44-1 to 8-44-11 (Act 2026-552, §§ 1 to 11)
- Official text
- https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf
- Enacted
- April 16, 2026. Act 2026-552 (HB 351, 2026 Regular Session); approved by the Governor 16 April 2026 at 10:50 a.m. per the Secretary of State; the legislature's system records the bill as 'Enacted' on 17 April 2026
- In force
- Enacted, in force May 1, 2027
- Effective dates
- May 1, 2027: whole act (Act 2026-552, § 12)
- Enforcer
- Attorney General
- Private right of action
- No. The act creates no private right of action; it provides only for Attorney General enforcement and is silent on private suits (Act 2026-552, § 11).
- Cure period
- 45 days. The Attorney General must first issue a notice of violation; no action may be brought if the controller corrects the violation within 45 days and gives an express written statement that it is corrected and will not recur. The cure period does not expire. (Act 2026-552, § 11(b) (Ala. Code § 8-44-11))
- Rulemaking
- No. The act grants no rulemaking power.
Amendments
No amendments recorded.
Topics
- ApplicabilityThe act applies to persons doing business in Alabama or targeting its residents that either control or process personal data of more than 25,000 consumers (excluding payment-only data) or derive more than 25% of gross revenue from selling personal data, whatever the number of consumers. It has broad entity exemptions, notably for businesses with fewer than 500 employees and nonprofits with fewer than 100 employees, in each case only if they do not sell personal data. GLBA financial institutions and their affiliates, HIPAA covered entities and business associates, higher education and several regulated sectors are also excluded, and many data types are exempt.
- Consumer rightsConsumers may confirm processing and access their data, correct it, have it deleted, obtain a portable copy of data they provided, and opt out of targeted advertising, sale and profiling for solely automated significant decisions. Controllers must answer within 45 days, extendable by 45 days with notice, and must provide information free once a year. Controllers must offer a clear opt-out link on their website. Unlike most state laws, the act does not require an appeal process.
- Sensitive dataControllers may not process sensitive data of a consumer without consent, and a known child's data must be processed under COPPA. Sensitive data covers racial or ethnic origin, religious beliefs, health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, genetic or biometric identifiers, data collected from a known child, and precise geolocation within 1,750 feet. For consumers known to be 13 to 15, targeted advertising and sale require consent.
- Controller dutiesControllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, and not process data for undisclosed incompatible purposes. The privacy notice must list categories of data, purposes, data shared and categories of third parties, an active email or contact mechanism, and how to exercise rights and opt out. The act does not require data protection assessments. It does not expressly require controllers to honour opt-out preference signals, although it says how to resolve a conflict when such a signal is received.
- ProcessorsProcessors must follow controller instructions and help with consumer requests, security and breach notification. A binding contract must set out instructions, nature and purpose, data types, duration and both parties' rights and obligations, and must require confidentiality, deletion or return at the end (unless law or the contract permits retention), compliance information, and flow-down obligations for subcontractors. The act does not require a contractual audit or assessment clause.
- EnforcementThe Attorney General may enforce the act after first issuing a notice of violation. If the controller does not correct the violation within 45 days, the Attorney General may sue for an injunction, and the court may impose a civil penalty of up to $15,000 per violation. No action may be brought if the controller corrects the violation in time and gives a written statement that it will not recur. The cure period has no end date.
Sources
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Alabama statute
Reference material, not legal advice.