--- title: "Alabama privacy law: consumer rights" canonical: "https://dposchool.com/state-privacy-laws/state/alabama/consumer-rights" source: "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Alabama Personal Data Protection Act # Alabama privacy law: consumer rights Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Consumers may confirm processing and access their data, correct it, have it deleted, obtain a portable copy of data they provided, and opt out of targeted advertising, sale and profiling for solely automated significant decisions. Controllers must answer within 45 days, extendable by 45 days with notice, and must provide information free once a year. Controllers must offer a clear opt-out link on their website. Unlike most state laws, the act does not require an appeal process. ## Key points 1. Rights to confirm and access, correct, delete, and obtain a portable copy of data previously provided, subject to trade-secret limits. Section: [Act 2026-552, § 5(a)(1) to (4) (Ala. Code § 8-44-5)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 2. Right to opt out of targeted advertising, sale, and profiling in furtherance of solely automated significant decisions. Section: [Act 2026-552, § 5(a)(5) (Ala. Code § 8-44-5)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 3. Response within 45 days, extendable by 45 days with notice and reasons within the first period. Section: [Act 2026-552, § 5(d)(1) (Ala. Code § 8-44-5)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 4. Free once per 12 months; a fee or refusal is allowed for manifestly unfounded, excessive, technically infeasible or repetitive requests. Section: [Act 2026-552, § 5(d)(3) (Ala. Code § 8-44-5)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 5. Opt-out requests need no authentication but may be refused on a good-faith, documented belief of fraud, with notice. Section: [Act 2026-552, § 5(d)(4) (Ala. Code § 8-44-5)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 6. Controllers must provide a clear and conspicuous website link to opt out of targeted advertising and sale, or up-to-date contact details for opting out. Section: [Act 2026-552, § 6(b) (Ala. Code § 8-44-6)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 7. No appeal process is required by the act. Section: [Act 2026-552, § 5 (Ala. Code § 8-44-5)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 8. Parents of a known child and guardians or conservators may exercise rights on the person's behalf. Section: [Act 2026-552, § 5(c); § 6(a) (Ala. Code §§ 8-44-5, 8-44-6)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) ## Sources - [HB 351 (2026 RS), enrolled act text](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) [Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access) - [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion) - [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Alabama statute](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) Reference material, not legal advice. ## Other topics for Alabama - [Applicability](https://dposchool.com/state-privacy-laws/state/alabama/applicability) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/alabama/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/alabama/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/alabama/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/alabama/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Alabama](https://dposchool.com/state-privacy-laws/state/alabama) / Consumer rights Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/alabama/applicability) Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/alabama/sensitive-data) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents