AlabamaAlabama data privacy rules give consumers control over personal information
Beginning May 1, 2027, covered businesses would have to follow consumer data rights, privacy notices, security duties, and limits on certain data uses.
What it does
Covered businesses would let Alabama consumers access, correct, delete, or copy their personal data and opt out of targeted ads, data sales, and some automated decisions.
Large covered businesses would limit data collection, secure personal data, explain their practices, and follow consent and opt-out rules, with broad listed exemptions.
Starting May 1, 2027, the Attorney General could enforce these rules after giving a business 45 days to fix a violation; courts could impose penalties up to $15,000 per violation.
Argument forConsumers could gain more control over personal data because they could request access, corrections, deletion, copies, and limits on certain uses.
Argument againstBusinesses covered by the rules may face added work to secure data, answer requests, update notices, and track consent and opt-outs.
More detail
Consumers may ask covered businesses to view, correct, delete, or receive a copy of their personal data, and may opt out of certain uses. These rights cover Alabama residents, including a parent or guardian acting for a child or a guardian acting for a consumer. Requests must usually be authenticated. Consumers may opt out of targeted advertising, the sale of their personal data, and certain automated decisions. A business may refuse a request it cannot authenticate or that is excessive, repetitive, technically infeasible, or otherwise allowed under the act. Businesses must provide the information free once in a 12-month period, but may charge a reasonable administrative fee for some repeated or excessive requests. A business generally must respond within 45 days and may extend the response period by 45 more days when reasonably necessary and properly explained.
Covered businesses must limit data collection, protect personal data, explain their practices in a privacy notice, and honor valid consumer choices. The rules apply to businesses operating in Alabama or serving Alabama residents that handle data for more than 25,000 consumers or receive over 25 percent of gross revenue from selling personal data. Businesses must obtain consent before processing sensitive data, except for processing a known child's data under federal children's privacy rules. Businesses may not sell personal data or use it for targeted advertising without consent when they know the consumer is at least 13 but under 16. Businesses generally may not punish a consumer for opting out, although exceptions apply to services that require data processing and voluntary loyalty or discount programs. Many governments, schools, financial institutions, health care entities, small businesses, nonprofits, and federally regulated data are excluded. The act states that these duties and restrictions take effect May 1, 2027.
The Attorney General may enforce the act after giving a business notice and 45 days to correct a violation. Enforcement applies to controllers covered by the act, and a court may order compliance and assess a civil penalty of up to $15,000 per violation. If a business corrects the noticed violation within 45 days and provides the required written statement, the Attorney General may not start an action for that violation. The act does not create a private right for consumers to sue under its enforcement section. The act becomes effective on May 1, 2027; the 45-day correction period begins when the business receives the Attorney General's notice.
Where do you stand?
Choose your position
Tell your reps
Take a position to see your representatives and ways to contact them.
Where it stands
- Introduced
- Passed House
- Passed Senate
- To Governor
- Became Law
Looking ahead
No hearings or votes scheduled.
History
- 2026
- Apr 17EnactedBecame Law
- Apr 8Ready to Enroll
- Apr 8EnrolledTo Governor
- Apr 8Delivered to GovernorMinor
- Apr 8Signature Requested
- Apr 7Third Reading in Second House
- Vote recorded Third Reading in Second House. Result: pass.Upper
- Vote recorded Elliott motion to Adopt - Adopted Roll Call 1196. Result: pass.Upper
- Vote recorded Elliott motion to Adopt - Adopted Roll Call 1195. Result: pass.Upper
- Vote recorded Elliott motion to Adopt - Adopted Roll Call 1197. Result: pass.Upper
- Vote recorded Shaw Motion to Concur In and Adopt Senate Amendment - Adopted Roll Call 1258. Result: pass.Lower
- Vote recorded Motion to Read a Third Time and Pass as Amended - Adopted Roll Call 1198. Result: pass.Upper
- Apr 7County and Municipal Government 1st Amendment Offered (County and Municipal Government)Minor
- Apr 7County and Municipal Government 3rd Amendment Offered (County and Municipal Government)Minor
- Apr 7County and Municipal Government 2nd Amendment Offered (County and Municipal Government)Minor
- Apr 7Elliott motion to Adopt - Adopted Roll Call 1195Major
- Apr 7Elliott motion to Table - Adopted Voice VoteMajor
- Apr 7Elliott motion to Adopt - Adopted Roll Call 1196Major
- Apr 7Elliott 1st Amendment OfferedMinor
- Apr 7Elliott motion to Adopt - Adopted Roll Call 1197Major
- Apr 7Motion to Read a Third Time and Pass as Amended - Adopted Roll Call 1198Passed Senate
- Apr 7Shaw Motion to Concur In and Adopt Senate Amendment - Adopted Roll Call 1258Major
- Apr 7Ready to Enroll
- Mar 10County and Municipal Government 1st Amendment (County and Municipal Government)
- Mar 10County and Municipal Government 2nd Amendment (County and Municipal Government)
- Mar 10County and Municipal Government 3rd Amendment (County and Municipal Government)
- Mar 10Reported Out of Committee Second House
- Mar 10Read for the Second Time and placed on the Calendar (County and Municipal Government)Minor
- Feb 25Read for the first time and referred to the Senate Committee on County and Municipal GovernmentMinor
- Feb 25Pending Committee Action in Second House (County and Municipal Government)
- Feb 24Third Reading in House of Origin
- Vote recorded Third Reading in House of Origin. Result: pass.Lower
- Vote recorded Motion to Adopt - Adopted Roll Call 562. Result: pass.Lower
- Vote recorded Motion to Adopt - Adopted Roll Call 563. Result: pass.Lower
- Vote recorded Motion to Read a Third Time and Pass as Amended - Adopted Roll Call 564. Result: pass.Lower
- Feb 24Commerce and Small Business 1st Substitute Offered (Commerce and Small Business)Minor
- Feb 24Motion to Adopt - Adopted Roll Call 562Major
- Feb 24Shaw 1st Amendment OfferedMinor
- Feb 24Motion to Adopt - Adopted Roll Call 563Major
- Feb 24Motion to Read a Third Time and Pass as Amended - Adopted Roll Call 564Passed House
- Feb 24Engrossed
- Feb 10Commerce and Small Business 1st Substitute (Commerce and Small Business)
- Feb 10Reported Out of Committee House of Origin
- Feb 10Read for the Second Time and placed on the Calendar (Commerce and Small Business)Minor
- Jan 29Read for the first time and referred to the House Committee on Commerce and Small BusinessMinor
- Jan 29Pending Committee Action in House of Origin (Commerce and Small Business)Introduced
TechnologyAI & PrivacyConsumer Protection