What Just Happened
On April 17, 2026, Governor Kay Ivey signed House Bill 351 into law, making Alabama the 21st state to pass a comprehensive consumer privacy law. The bill passed both chambers of the Alabama Legislature without a single "no" vote.
The Alabama Personal Data Protection Act gives residents new rights over the personal data companies collect on them: the right to see what's collected, correct it, delete it, take a copy of it, and opt out of having it sold or used to target them with ads. It also sets rules for how companies have to handle that data, and puts the Alabama Attorney General in charge of enforcing it.
None of it takes effect until May 1, 2027. Businesses have just over a year to get ready. Alabamians don't get any new rights until then.
Who Actually Has to Follow It
The law applies to companies doing business in Alabama, or targeting Alabama residents, that meet one of two thresholds: they process personal data belonging to more than 25,000 Alabama residents (not counting basic payment-transaction data), or they get 25% or more of their gross revenue from selling personal data — regardless of how many people's data that involves.
That first number is doing a lot of work. Twenty-five thousand is the lowest consumer threshold of any comprehensive state privacy law on the books, tying Montana for the smallest floor in the country. In Alabama, a mid-sized regional business could clear it without much effort.
The revenue threshold cuts the other way: Alabama is the first state to apply a 25%-of-revenue trigger with no minimum number of people it has to involve. In theory, a small data broker doing high-value business with very few customers could be on the hook.
The law carves out real exceptions, too. Companies regulated under HIPAA or the Gramm-Leach-Bliley Act are exempt entirely. So is data collected in employment and typical commercial contexts. Smaller operations get a pass as well — the law's exemptions are aimed at genuinely small businesses and nonprofits, not the companies the 25,000-resident threshold is built to catch.
What Alabamians Actually Get
Once the law takes effect, Alabama residents can ask a covered company to confirm what personal data it has on them, correct inaccurate data, delete it, or hand over a portable copy. They can opt out of having their data sold, used for targeted advertising, or run through "solely automated" decisions that affect things like credit, housing, insurance, education, employment, health care, or other basic necessities.
Those are the standard rights most state privacy laws grant by now. Alabama's version has some real gaps next to them.
What's Missing
Start with the definition of "sale." Alabama's law only counts a data transfer as a "sale" if the company gets a "material benefit" from it and the third party receiving the data is left free to use it however it wants. Disclosures to analytics providers or marketing services working on the company's own behalf don't count as a sale at all under this law.
There's no requirement that companies honor "universal opt-out" tools like Global Privacy Control, the browser-level signal that lets a user tell every website at once not to sell their data. Some other states require it. Alabama doesn't.
Data protection impact assessments aren't required either, something California and Colorado both mandate before high-risk processing goes live. And unlike most of its peers, Alabama gives consumers no right to appeal if a company denies their request to access, correct, or delete their own data — the decision is final.
The law also gave the Attorney General no rulemaking authority, meaning there's no built-in path to update the rules as data practices change without going back to the Legislature.
The starkest gap is around kids. Alabama's law only requires parental consent for children under 13, the same floor set by the federal COPPA law, on the books since 1998. States like Colorado, Connecticut, and Virginia have moved beyond that baseline in recent years, requiring opt-in consent before targeting older teenagers with ads or selling their data. Alabama's law doesn't.
Bill sponsor Rep. Mike Shaw, a Republican with a background in tech, has acknowledged the gap directly. "The definition of minors wasn't discussed at length," he told the International Association of Privacy Professionals, adding that "there needs to be further conversation and coordination moving forward about aligning laws to a common age group."
It's a strange inconsistency next to Alabama's own App Store Accountability Act, a separate state law that requires parental consent for app downloads by anyone under 18. Under one Alabama law, a 16-year-old needs a parent's permission to download an app, and under the new privacy law, that same 16-year-old's data can be sold without anyone's consent at all.
Why It Looks Like This
Shaw has been working on the bill for two years. He's framed it from the start as a deliberate trade-off, not an oversight. "This bill was all about balance," he said. "Balancing Alabamians' rights with the burden of regulation."
That framing shows up throughout the law: no data protection assessments to slow down rollout of new products, no universal opt-out signal to build for, a narrow sale definition that leaves common marketing arrangements untouched, and enforcement limited to a single state office that has to give companies 45 days to fix a violation before it can bring a case. There is no path for a private citizen to sue over a violation.
Freshfields, a law firm tracking state privacy legislation, has called Alabama's approach "notably business-friendly" compared with the laws California and Colorado wrote first. Alabama joins Oklahoma as one of two states to enact comprehensive privacy legislation so far in 2026.
The Bottom Line
Alabama now has a privacy law. It gives residents real, enforceable rights they didn't have before: to see their data, fix it, delete it, and opt out of having it sold. That's not nothing.
It's also a law built with a light touch by design, from a threshold low enough to catch mid-sized local businesses, to a definition of "sale" narrow enough to let a lot of routine data-sharing through untouched, to child protections that stop at age 13 while a different Alabama law protects the same kids' app downloads until they turn 18.
None of it matters yet. The clock starts May 1, 2027. What happens between now and then — whether the Legislature revisits the minors' gap Shaw himself flagged, whether the AG's office builds out enforcement capacity, whether Alabama businesses actually prepare — is the part still being written.