This amendment creates a new law called the Alabama Personal Data Protection Act that gives residents specific rights over their private information and sets rules for companies handling that data.
Alabama2026Enacted
HB351
Alabama Personal Data Protection Act
Last scannedAug 24, 2026, 9:06 AM
In one sentence
This law sets rules for certain businesses that collect personal information about Alabama residents, giving those residents rights to control how their data is used.
What it does
- Requires covered controllers to let consumers opt out of having their personal data processed or sold.
- Allows people to ask companies to delete or correct incorrect personal information they hold.
- Mandates that websites display a clear link so users can easily stop the processing of their data.
- Prohibits companies from treating customers worse if they choose not to share their personal data.
- Requires businesses to limit how much data they collect and to keep it secure, including deidentified data.
Who it affects
- Companies doing business in Alabama that control more than 25,000 consumers' data or earn over 25% of revenue from selling such data.
- Residents of Alabama who are not acting as employees, contractors, owners, directors, officers, or government officials.
Limits and unknowns
- The law does not apply to all businesses, only those meeting specific size and revenue thresholds.
- Certain types of data, such as publicly available information and deidentified data, are excluded from these rules.
- Some exemptions exist for certain persons and situations that the text mentions but does not fully list.
Plain language
Terms to know
- Controller
- A person or business that decides why and how personal data is collected and used.
- Processor
- A company hired by a controller to handle personal data on their behalf.
- Dark Pattern
- A user interface designed or manipulated with the effect of substantially subverting or impairing user autonomy, decision-making, or choice.
Official record
Sources
Official summary
This act is the Alabama Personal Data Protection Act. This act: (1) applies to persons conducting business in the state or targeting state residents that control more than 25,000 consumers' personal data and derive more than 25 percent of gross revenue from selling such data; (2) authorizes consumers to invoke, and requires these controllers of personal data to comply with, certain rights of these consumers, including opting out of data processing or requesting deletion and correction of personal data; (3) authorizes parents, guardians, and conservators to exercise these rights on behalf of their child or consumer; (4) provides procedures and guidelines for making and complying with such requests, including that no fees may be charged and a controller must respond to authenticated requests within 45 days and provide information once a year; (5) requires controllers to provide a conspicuous link on their website for consumers to opt out of personal data processing; (6) requires controllers to limit collecting and to protect personal data, including deidentified data; (7) prohibits controllers from certain actions, including processing personal data for not reasonably necessary, undisclosed purposes, processing data of individuals without consent, processing data in a discriminatory manner, and providing a different quality of service to consumers upon opting out of data processing; (8) requires controllers to provide notice when personal data is sold to third parties or processed for targeted advertising; (9) requires personal data processors to adhere to controllers' instructions pursuant to this act; and (10) exempts certain persons and types of data from these requirements.
Official activity
Bill history
- EnactedHouse
- Signature RequestedSenate
- Delivered to GovernorHouse
- EnrolledHouse
- Ready to EnrollHouse
- Shaw Motion to Concur In and Adopt Senate Amendment - Adopted Roll Call 1258 (Yeas 104, Nays 0)House
- Motion to Read a Third Time and Pass as Amended - Adopted Roll Call 1198 (Yeas 34, Nays 0)Senate
- Elliott motion to Adopt - Adopted Roll Call 1197 (Yeas 34, Nays 0)Senate
- Elliott motion to Adopt - Adopted Roll Call 1196 (Yeas 34, Nays 0)Senate
- Elliott motion to Adopt - Adopted Roll Call 1195 (Yeas 34, Nays 0)Senate
- Third Reading in Second House (Yeas 34, Nays 0)Senate
- Ready to EnrollHouse
- Elliott 1st Amendment OfferedSenate
- Elliott motion to Table - Adopted Voice VoteSenate
- County and Municipal Government 2nd Amendment OfferedSenate
- County and Municipal Government 3rd Amendment OfferedSenate
- County and Municipal Government 1st Amendment OfferedSenate
- Read for the Second Time and placed on the CalendarSenate
- Reported Out of Committee Second HouseSenate
- County and Municipal Government 3rd AmendmentSenate
Changes
Amendments
6 stored
This amendment updates the list of official definitions for terms used in a new data privacy law.
This amendment changes how consumers can submit requests to stop their data from being processed by requiring a clear link.
This amendment updates the list of organizations exempt from new data privacy rules to include specific public groups, small businesses with fewer than 500 employees, and regulated electric providers.
This amendment adds new exceptions to data privacy rules for companies that provide analytics or marketing services, and it excludes political groups and businesses that sell data mainly to them from the law.
This amendment adds new exceptions to data privacy rules for companies sharing information with third parties for analytics and marketing, while also exempting small political groups that do not sell personal data.