Alabama Enacts Comprehensive Privacy Law: What Businesses Need to Know About HB 351

Alabama Enacts Comprehensive Privacy Law: What Businesses Need to Know About HB 351

May 20, 2026

Originally published: May 5, 2026

Law: Alabama Personal Data Protection Act – HB 351

Effective date: May 1, 2027

Status: Enacted; not yet effective.

Alabama has enacted a comprehensive consumer privacy law. On April 17, 2026, Governor Kay Ivey signed HB 351, establishing the Alabama Personal Data Protection Act (“APDPA”). The law creates privacy rights for Alabama consumers and obligations for covered organizations that process their personal data. It takes effect May 1, 2027.

For website operators and other businesses, the first question is whether the law applies. Alabama combines relatively low coverage thresholds with a significant exemption for businesses with fewer than 500 employees that do not sell personal data.

Which Businesses are Covered?

The APDPA applies to persons that conduct business in Alabama or produce products or services targeted to Alabama residents and meet either of these thresholds:

• Control or process personal data of more than 25,000 Alabama consumers, excluding data controlled or processed solely to complete a payment transaction.

• Derive more than 25% of gross revenue from selling personal data, regardless of the number of consumers whose data they control or process.

The consumer-volume threshold does not include a separate minimum revenue requirement. However, meeting a threshold does not automatically mean an organization is covered: exemptions must also be considered.

The law’s definition of “consumer” excludes individuals acting in commercial or employment contexts, including certain communications and transactions conducted solely in their business roles. Businesses should not automatically count employee records or business contacts as covered consumer data.

The Small-Business Exemption Matters.

A business with fewer than 500 employees is exempt if it does not engage in the sale of personal data. A qualifying nonprofit entity with fewer than 100 employees is also exempt if it does not sell personal data.

This means a business below the employee threshold may remain exempt even if it processes data about more than 25,000 Alabama consumers. Conversely, selling personal data can prevent the business from relying on that exemption, but the business must still meet an applicability threshold and consider other exemptions.

The law also contains exemptions for specified financial institutions, HIPAA-covered entities and business associates, institutions of higher education, and other organizations, as well as exemptions for particular categories of information. An organization-level exemption and an exemption for specific data are not the same thing.

What Counts as Selling Personal Data?

Alabama’s definition is broader than simply selling a customer list for cash.

A sale includes exchanging personal data with a third party for monetary consideration. It also includes an exchange for other valuable consideration when the controller receives a material benefit and the third party is not restricted in its subsequent use of the data.

The definition excludes specified transfers, including disclosures to processors, affiliates, providers of analytics services, and providers of marketing services solely to the controller. Other exclusions address consumer-directed disclosures, requested products or services, and qualifying corporate transactions.

Businesses should evaluate the actual arrangement rather than assume that every third-party disclosure is a sale, or that no sale occurs because no money changes hands. This review is especially important when relying on the small-business exemption.

What Rights Will Alabama Consumers Have?

Subject to the law’s conditions and exceptions, consumers may:

• Confirm whether their personal data is being processed and access it.

• Correct inaccuracies.

• Request deletion.

• Obtain certain data they previously provided in a portable format.

• Opt-out of targeted advertising, personal-data sales, and profiling used for solely automated significant decisions concerning them.

Controllers generally must respond within 45 days. They may extend that period once by another 45 days when reasonably necessary, provided they notify the consumer of the extension and its reason during the initial period. A refusal must be explained within 45 days of receipt.

Opt-out requests do not require authentication. A controller may deny an opt-out request based on a good-faith, reasonable, documented belief that it is fraudulent or unauthorized, but must notify the requester. Controllers also may not require consumers to create a new account to exercise their rights.

What Must Covered Businesses Do?

The APDPA requires covered controllers, the organizations deciding why and how personal data is processed, to address several core obligations:

• Privacy notices: Explain the categories of data processed, processing purposes, third-party sharing, contact methods, and how consumers can exercise their rights.

• Data minimization and purpose limitation: Limit collection to what is adequate, relevant, and reasonably necessary, and avoid processing for incompatible or unnecessary undisclosed purposes.

• Security: Maintain reasonable administrative, technical, and physical safeguards appropriate to the data involved.

• Sensitive data: Obtain consent before processing sensitive data about consumers other than known children; processing data about known children must comply with COPPA.

• Teen protections: Obtain consent before targeted advertising or selling personal data when the controller actually knows the consumer is at least 13 but younger than 16.

• Consent: Use clear, affirmative choices, not dark patterns, and provide a withdrawal mechanism at least as easy as the method used to give consent.

• Processor contracts: Use binding agreements addressing processing instructions, confidentiality, deletion or return, compliance information, and subcontractor obligations.

Sensitive data includes specified information about health, race or ethnicity, religion, sex life, sexual orientation, citizenship or immigration status, identifying genetic or biometric data, known children, and precise geolocation.

Website Opt-Outs and Global Privacy Control.

Controllers must provide a clear and conspicuous website link to a page that allows consumers to opt out of targeted advertising or personal-data sales, or provides current contact information for submitting those requests.

The final law does not contain the standalone universal opt-out preference signal mandate included in earlier versions of HB 351. However, it retains a provision requiring compliance with an opt-out signal when it conflicts with an existing controller-specific privacy setting or voluntary participation in a qualifying loyalty or rewards program.

Businesses operating across states should therefore distinguish Alabama’s requirements from signal-recognition obligations under other states’ laws.

How Will the Law be Enforced?

The Alabama Attorney General enforces the APDPA. The statute does not provide a private right of action.

Before initiating an enforcement action, the Attorney General must provide notice of a violation and a 45-day opportunity to correct it. If the controller corrects the violation and provides the required written assurances, an action may not be initiated under that provision. Uncorrected violations may lead to an injunction and civil penalties of up to $15,000 per violation. The cure provision has no stated sunset date.

Unlike many other comprehensive state privacy laws, Alabama’s enacted law does not establish a general requirement for data protection assessments. Organizations may nevertheless need assessments under other applicable state laws.

What Should Businesses do Before May 1, 2027?

Start with five priorities:

1. Determine applicability. Review Alabama consumer-data volume, data-sale revenue, employee count, and exemptions.

2. Review data sharing. Determine whether advertising, analytics, marketing, and other disclosures qualify as sales under Alabama’s definition.

3. Check consumer-rights procedures. Confirm that requests and opt-outs reach the systems that need to act on them.

4. Review consent and vendor arrangements. Focus on sensitive data, known teen consumers, withdrawal mechanisms, and processor contracts.

5. Align notices with actual practices. Ensure the privacy notice and website opt-out method accurately reflect how the business operates.

These preparation steps address the law’s coverage rules and principal operational requirements without replacing an organization-specific legal assessment.

For businesses with an existing multi-state privacy program, Alabama is best treated as a set of state-specific requirements within that program, not an assumption that every state follows the same rules.

For operational guidance and structured compliance documentation tools, visit the CLIClaw Privacy Compliance Library.

© 2026 CLIClaw.com

This article is for information purposes only. This article provides general information and operational commentary. It is not legal advice. Applicability and compliance obligations depend on an organization’s activities, data practices, exemptions, and circumstances. It is not intended to be and should not be relied on as legal advice for any particular matter.