Alabama (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Alabama Personal Data Protection Act | Act 2026-552 (HB 351) | Enacted, not yet in force | 1 May 2027 |
| Alabama Data Breach Notification Act of 2018 | Act 2018-396 (SB 318), Ala. Code §§ 8-38-1 to 8-38-12 | In force | 1 June 2018 |
| App store age verification law | Act 2026-59 (HB 161) | Enacted, not yet in force | 1 January 2027 |
- Alabama Personal Data Protection Act: Approved by the Governor on 16 April 2026. Takes effect on 1 May 2027.
- Alabama Data Breach Notification Act of 2018: Also requires reasonable security measures for sensitive personal information.
- App store age verification law: Approved by the Governor on 17 February 2026. Age verification and parental consent duties for app stores and app developers. The act has no official short title; it’s often called the App Store Accountability Act.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”From 1 May 2027, applies to businesses that operate in Alabama or target its residents and either control or process personal data of more than 25,000 consumers (not counting payment-only data) or earn over 25% of gross revenue from selling personal data. Exemptions cover political subdivisions, higher education, financial institutions and GLBA data, HIPAA covered entities, businesses with under 500 staff and nonprofits with under 100 staff that don’t sell data, and political committees. Employee data is out of scope.
Sources: alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS… · arc-sos.state.al.us/cgi/actdetail.mbr/detail
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases. Give a clear privacy notice and honour rights to confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and solely automated significant decisions. Reply within 45 days (one 45-day extension), free once a year. There’s no appeal step. Sensitive data needs opt-in consent, and consent must be as easy to withdraw as to give.
Sources: alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS…
Consent age for online services
Section titled “Consent age for online services”A child is under 13; a known child’s data must be processed in line with COPPA. If a controller knows a consumer is 13 to 15, it needs their consent before using their data for targeted advertising or selling it.
Sources: alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS…
Children
Section titled “Children”Under the privacy act, a known child’s data is sensitive and follows COPPA, and known 13 to 15-year-olds must opt in to targeted ads and sales. From 1 January 2027, the app store law (HB 161) makes app stores verify age and get parental consent for minors. Developers must check age category and consent through the app store, tell it about significant app changes, and may not enforce terms against a minor without parental consent.
Sources: alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS… · alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS… · arc-sos.state.al.us/cgi/actdetail.mbr/detail
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. From May 2027, controllers that sell personal data or use it for targeted advertising must disclose it and put a clear opt-out link on their website. The act says a controller must follow an opt-out preference signal that conflicts with the person’s privacy settings or loyalty-programme membership, but it sets up no general mechanism for such signals, so whether controllers must accept them is unclear.
Sources: alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS…
Electronic marketing
Section titled “Electronic marketing”Adds to CAN-SPAM and the TCPA. Under the Alabama Telemarketing Act, anyone making commercial telephone solicitations needs a yearly licence from the Attorney General ($500, plus $50 for each salesperson) and a $50,000 surety bond, letter of credit or certificate of deposit. Failing to register is a felony. Alabama also runs its own Do Not Call list through the Public Service Commission. Solicitors pay $500 a year for it, update it at least quarterly and may not call listed residents, with fines up to $2,000 per violation.
Sources: alabamaag.gov/licensing-registration/alabama-telemarketing-act · alabamaag.gov/wp-content/uploads/2026/05/File-Consumer-AL-Surety-Bond… · admincode.legislature.state.al.us/api/rule/770-X-5-.31
Breach notification
Section titled “Breach notification”Tell affected individuals as fast as possible and within 45 days of determining that a breach of sensitive personal information is reasonably likely to cause substantial harm. If more than 1,000 people are notified, also tell the Attorney General within 45 days and the nationwide credit reporting agencies. Service providers must tell their client within 10 days.
Sources: alabamaag.gov/data-breach-notification · alison.legislature.state.al.us/files/pdf/SearchableInstruments/2018RS…
Registration and fees
Section titled “Registration and fees”No data protection registration or fee, and no data broker registry. Telephone sellers are licensed separately (see marketing).
Sources: alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS… · alabamaag.gov/licensing-registration/alabama-telemarketing-act
Data protection officer
Section titled “Data protection officer”No duty to appoint a data protection officer.
Sources: alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS…
International transfers
Section titled “International transfers”Alabama law doesn’t restrict sending personal data outside the state or the US. Federal rules are in us-federal.
Sources: alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS…
Impact assessments
Section titled “Impact assessments”None. Unlike most state privacy laws, Alabama’s act doesn’t require data protection assessments.
Sources: alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS…
Automated decisions and AI
Section titled “Automated decisions and AI”People can opt out of profiling that feeds solely automated significant decisions, meaning decisions on credit or lending, housing, insurance, education, criminal justice, jobs, health care or basic necessities.
Sources: alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS…
Penalties
Section titled “Penalties”The Attorney General enforces. It must first send a notice of violation; a business that corrects it within 45 days and confirms in writing can’t be sued, and this right doesn’t expire. Courts can impose civil penalties up to $15,000 per violation. The act creates no private right of action. Breach-notice failures can cost up to $5,000 a day, and wilful or reckless ones up to $500,000 per breach. Under the app store law, only the Attorney General can bring deceptive trade practice actions, for up to $7,500 per knowing or reckless violation plus fees, and punitive damages for a pattern.
Sources: alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS… · alison.legislature.state.al.us/files/pdf/SearchableInstruments/2018RS… · alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS…
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-al.yaml.