Alabama Legislature Unanimously Passes Sweeping Personal Data Law
Alabama lawmakers unanimously passed the Personal Data Protection Act, awaiting the governor's signature.
Why it matters: This move places Alabama alongside 20 other states with broad data privacy laws, requiring new compliance steps for businesses handling large volumes of personal information. It also signals a policy shift in the southern U.S., but critics warn the law may fall short on meaningful consumer protections.
- The legislature approved House Bill 351 unanimously—104-0 in the House, 34-0 in the Senate.
- The Act covers entities with data from over 25,000 consumers or 25%+ revenue from data sales.
- Consumers gain rights to access, correct, delete, and obtain copies of their data, and to opt out of targeted ads or data sales.
- Consumer Reports urges a veto, citing weak enforcement and broad exemptions.
Alabama moved closer to joining the ranks of states with robust privacy laws as its legislature passed the Personal Data Protection Act (HB351) by unanimous vote on April 7, 2026. If signed by Governor Kay Ivey, the law will take effect on May 1, 2027.
- HB351 requires compliance from any entity that processes the personal data of more than 25,000 consumers or derives at least 25% of its revenue from the sale of personal data, according to a legal summary.
- Consumers would have explicit rights to confirm, access, correct, delete, and obtain a copy of their data, and to opt out of targeted advertising and data sales. Businesses must respond to such requests within 45 days, with a possible 45-day extension.
- Rep. Mike Shaw, the bill's sponsor, described it as “the product of two years of hard work to create a common-sense framework that protects consumers while also remaining friendly to those who do business in our state.”
- The Alabama Attorney General will enforce the Act, with businesses given a 45-day notice and time to cure alleged violations before action is taken.
Yet the bill did not escape criticism. Consumer Reports, a prominent advocacy group, has urged Governor Ivey to veto the legislation, warning it “adopts a lowest-common-denominator approach to privacy that will not meaningfully protect consumers.” The group flags potential loopholes, weak enforcement, and broad exemptions as major concerns (news report).
With states nationwide enacting new privacy regimes, Alabama's framework—though controversial—further shapes the landscape for compliance and consumer rights throughout the South.
By the numbers:
- 104-0 — House vote total for HB351
- 34-0 — Senate vote total for HB351
- 25,000 — Minimum number of consumers' data for Act applicability
- 45 days — Maximum response time for consumer data requests
Yes, but: Critics like Consumer Reports argue the law's enforcement is too weak and leaves loopholes that could undermine consumer protections.
What's next: The Act awaits Governor Kay Ivey's signature before becoming law, with an effective date set for May 1, 2027.