Alabama Enacts Business-Friendly Consumer Data Privacy Law
Governor Kay Ivey signed the Alabama Personal Data Protection Act, the state's new comprehensive privacy law.
Why it matters: Alabama’s law adds to the patchwork of state privacy rules, demanding updated compliance from law firms and in-house teams. Its business-oriented provisions could shape privacy strategies for companies operating in multiple states.
- Alabama is the 21st U.S. state with a comprehensive consumer data privacy law, effective April 16, 2026.
- The law targets controllers processing data of over 25,000 consumers or earning 25%+ of revenue from data sales.
- Consumers gain rights to access, correct, delete, and export data, plus opt out of certain data uses.
- Exclusive enforcement is granted to the Attorney General, with penalties up to $15,000 per violation.
On April 16, 2026, Alabama joined the ranks of states with sweeping data privacy regulation as Governor Kay Ivey signed the Alabama Personal Data Protection Act (HB 351). This makes Alabama the 21st state to enact such a law, signaling ongoing momentum for state-level privacy action in the absence of federal rules.
- Who’s covered: The law applies to entities that control or process the personal data of more than 25,000 consumers, or that derive over 25% of gross revenue from the sale of personal data (details).
- Consumer rights: Alabama residents can ask to confirm if their data is processed, correct inaccuracies, delete their data, obtain a portable copy, and opt out of targeted advertising, data sales, and automated profiling decisions.
- Business obligations: Controllers must respond to requests within 45 days (extendable to 90), and maintain clear, accessible privacy notices addressing processed data categories, purposes, and third-party sharing.
- Enforcement: The Attorney General retains exclusive authority to enforce the law. There’s a 45-day opportunity to cure alleged violations before action, with civil penalties up to $15,000 per violation.
Reaction has split. Rep. Mike Shaw, HB 351 sponsor, called the law “the product of two years of hard work to create a common-sense framework that protects consumers while also remaining friendly to those who do business in our state.” Meanwhile, Consumer Reports urged a veto, citing weak definitions, broad exemptions, and insufficient enforcement.
Large entities conducting business in Alabama—or nationwide—should assess and update compliance strategies to align with core provisions and enforcement realities of the new law.
By the numbers:
- 25,000+ — Minimum number of consumers' data processed to trigger the law's application
- 25%+ — Revenue threshold from data sales for coverage under the Act
- $15,000 — Maximum civil penalty per violation
Yes, but: Consumer advocacy groups say the law's broad exemptions and limited enforcement mechanisms may weaken consumer protections.