On April 17, 2026, the Governor of Alabama signed HB 351, Alabama Personal Data Protection Act (ALDPA), into law. The law resembles Connecticut’s data privacy statute, but omits certain requirements, such as a data protection impact assessment. Alabama follows Oklahoma as the second state to enact a comprehensive privacy law this year. The law will take effect on May 1, 2027.
The below lists key provisions in ALDPA:
- Scope. ALPDA applies to controllers and processors that conduct business in Alabama or produce products or services that target Alabama residents and either (a) process or control the personal data of more than 25,000 Alabama residents, excluding personal data processed or controlled solely for the purpose of completing a payment transaction, or (b) derive over 25% of their gross revenue from the sale of personal data, regardless of the number of consumers.
- Exemptions. The law exempts individuals acting in a commercial or employment context, and contains several entity-level exemptions, including for a financial institution subject to the GLBA, a business with fewer than 500 employees that does not sell personal data, covered entities and business associates governed by HIPAA, nonprofits, and institutions of higher education.
- Consumer Rights. The law grants consumers a set of rights, including rights of access, deletion, correction, and portability, and rights to opt-out of targeted advertising, sale, or profiling in furtherance of solely automated significant decisions concerning the consumer, defined to include decisions about topics such as credit or lending services, employment opportunity, health care service, and access to basic necessities. Notably, and unlike other state privacy laws, the law defines “sale” to include the exchange of personal information for monetary consideration by a controller to a third party or for “other valuable consideration” where the controller “receives a material benefit and the third party is not restricted in its subsequent uses of the personal data.” The law also requires that controllers honor opt-out preference signals, but permits the controller to notify the consumer of conflicting signals and provide the choice to confirm controller-specific privacy settings or participation in loyalty and similar programs.
- Transparency Requirements. Controllers must provide consumers reasonably clear and accessible privacy notices that resemble notices required in other state privacy statutes, including by disclosing the categories of personal data processed, the purposes of processing that data, and the categories of personal data shared with third parties.
- Sensitive Data. Controllers must obtain consent to process sensitive data, with the standard for consent largely tracking the Connecticut approach. The scope of sensitive data generally follows the approach taken in Oklahoma and other state comprehensive privacy laws, and includes data such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, genetic or biometric data that is processed for the purpose of uniquely identifying an individual, personal data collected from a known child under 13, and precise geolocation data.