---
title: "Alabama privacy law: sensitive data"
canonical: "https://dposchool.com/state-privacy-laws/state/alabama/sensitive-data"
source: "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Alabama Personal Data Protection Act

# Alabama privacy law: sensitive data

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Controllers may not process sensitive data of a consumer without consent, and a known child's data must be processed under COPPA. Sensitive data covers racial or ethnic origin, religious beliefs, health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, genetic or biometric identifiers, data collected from a known child, and precise geolocation within 1,750 feet. For consumers known to be 13 to 15, targeted advertising and sale require consent.

## Key points

1. Sensitive data may be processed only with consent; a known child's data must be processed under COPPA.

   Section: [Act 2026-552, § 7(b)(2) (Ala. Code § 8-44-7)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf)

2. Sensitive data includes sex life and citizenship or immigration status, as well as health, religion, race, sexual orientation, genetic or biometric data, known-child data and precise geolocation.

   Section: [Act 2026-552, § 2(21) (Ala. Code § 8-44-2)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf)

3. 'Child' means an individual under 13.

   Section: [Act 2026-552, § 2(4) (Ala. Code § 8-44-2)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf)

4. With actual knowledge that a consumer is at least 13 but under 16, targeted advertising and sale require the consumer's consent.

   Section: [Act 2026-552, § 7(b)(4) (Ala. Code § 8-44-7)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf)

5. Consent must be revocable as easily as given; processing must stop as soon as practicable and within 45 days.

   Section: [Act 2026-552, § 7(a)(3) (Ala. Code § 8-44-7)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf)

6. COPPA verifiable parental consent satisfies the act's parental consent duties.

   Section: [Act 2026-552, § 4(c) (Ala. Code § 8-44-4)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf)

## Sources

- [HB 351 (2026 RS), enrolled act text](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf)

[Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Alabama statute](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf)

Reference material, not legal advice.

## Other topics for Alabama

- [Applicability](https://dposchool.com/state-privacy-laws/state/alabama/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/alabama/consumer-rights)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/alabama/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/alabama/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/alabama/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Alabama](https://dposchool.com/state-privacy-laws/state/alabama) / Sensitive data

Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/alabama/consumer-rights)

Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/alabama/controller-duties)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents