Alabama
Alabama Personal Data Protection Act (HB 351)
Alabama’s consumer privacy law. It gives Alabama residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- Starts May 1, 2027
- Citation
- HB 351 (2026)
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses that handle data of more than 25,000 Alabama consumers a year, or get more than 25% of revenue from selling data. Exempt: businesses under 500 employees that don’t sell personal data.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
- Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
- Offer a clear and conspicuous opt-out link.
Who has to comply, from May 1, 2027
The Alabama Personal Data Protection Act (HB 351) was enacted in April 2026 and takes effect on May 1, 2027. It applies to businesses that handle the personal data of more than 25,000 Alabama consumers (not counting payment-only data), or get more than 25% of gross revenue from selling personal data.
Two size exemptions, both lost if you sell personal data: businesses with fewer than 500 employees, and nonprofits with fewer than 100 employees. Financial institutions, HIPAA entities and colleges are also exempt.
Visitors’ rights and your deadlines
- Rights to confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and solely automated profiling for significant decisions.
- Opt-outs go through a clear and conspicuous link, or up-to-date contact information.
- Respond within 45 days, extendable by 45 more.
- The law has no appeal process.
Opt-out signals
The law doesn’t set a stand-alone duty to honor universal opt-out signals such as Global Privacy Control. One clause says to follow a consumer’s opt-out preference signal when it conflicts with a loyalty program or site setting, but the law doesn’t define the term. Honoring GPC is the cautious course.
Sensitive data and teens
Sensitive data, including precise geolocation, needs consent; a known child’s data (under 13) follows COPPA. For consumers you know are 13 to 15, you need consent before targeted advertising or sale. No data protection assessments are required.
Enforcement
The Attorney General enforces the law; there’s no private right of action. Before acting, the Attorney General must send a notice of violation and give 45 days to fix it, with no end date in the law. Penalties are up to $15,000 per violation, among the highest of any state privacy law, plus injunctions.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Children’s Privacy Policy (Pro)
A children’s privacy notice page for sites that may collect information from children under 13.
A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
When does Alabama’s privacy law take effect?
May 1, 2027.
Are small businesses exempt in Alabama?
Businesses with fewer than 500 employees are exempt, unless they sell personal data.
What are the penalties?
Up to $15,000 per violation, after a 45-day chance to cure.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
