Alabama Personal Data Protection Act
Alabama privacy law: sensitive data
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Controllers may not process sensitive data of a consumer without consent, and a known child's data must be processed under COPPA. Sensitive data covers racial or ethnic origin, religious beliefs, health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, genetic or biometric identifiers, data collected from a known child, and precise geolocation within 1,750 feet. For consumers known to be 13 to 15, targeted advertising and sale require consent.
Key points
Sensitive data may be processed only with consent; a known child's data must be processed under COPPA.
Sensitive data includes sex life and citizenship or immigration status, as well as health, religion, race, sexual orientation, genetic or biometric data, known-child data and precise geolocation.
'Child' means an individual under 13.
With actual knowledge that a consumer is at least 13 but under 16, targeted advertising and sale require the consumer's consent.
Consent must be revocable as easily as given; processing must stop as soon as practicable and within 45 days.
COPPA verifiable parental consent satisfies the act's parental consent duties.
Sources
Compare sensitive data across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 9: Processing of special categories of personal data (sensitive data)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Alabama statute
Reference material, not legal advice.