Alabama Personal Data Protection Act (HB 351)
Comprehensive consumer privacy law signed 17 April 2026, the 21st state framework: consumer rights of access, deletion, correction and opt-out of sale and targeted advertising, with Attorney General enforcement and a cure period.
| Jurisdiction | Alabama |
|---|---|
| Category | Privacy & Data Protection |
| Status | Upcoming |
| Effective date | |
| Latest development |
Recent developments
- — Recent practitioner coverage continues to focus on compliance readiness rather than any change to the statute. The ongoing industry impact is that companies are using the lead time before 2027-05-01 to align privacy notices, consumer request workflows, and vendor contracts. (source)
- — A later update to the legislative tracker confirms the law remains on track for the 2027-05-01 effective date. No post-enactment amendment or delay is indicated in the available source. (source)
- — DataGuidance describes the Alabama Personal Data Protection Act as Alabama’s first comprehensive consumer privacy framework and says it is effective 2027-05-01. The jurisdiction page also notes the Attorney General’s enforcement role. (source)
- — This legislative tracker records HB 351 as enacted and signed by Governor Ivey on 2026-04-17, with a 2027-05-01 effective date. It also summarizes consumer rights, sensitive data treatment, and enforcement by the Attorney General. (source)
- — This industry commentary says businesses outside Alabama may still be covered if they target Alabama residents and meet the law’s thresholds. It also highlights implementation details such as 45-day response timelines and the law’s definition of sale. (source)
- — Hunton summarized the new Alabama privacy law after enactment and noted the effective date of 2027-05-01. The post explains the law’s applicability thresholds and confirms it as Alabama’s comprehensive consumer privacy statute. (source)
- — Governor Kay Ivey signed HB 351 into law, enacting the Alabama Personal Data Protection Act. The law establishes consumer privacy rights and obligations for businesses and is set to take effect on 2027-05-01. (source)
- — Industry counsel framed the law as creating new compliance obligations for businesses handling Alabama residents’ data. The post emphasizes operational impacts such as consumer rights handling, data processing controls, and preparation ahead of the 2027-05-01 effective date. (source)
- — Alabama became the 21st state to enact a broad consumer data privacy law, and one of the more business-friendly versions passed in 2026. The article highlights scope, thresholds, and the 2027-05-01 effective date. (source)
- — Consumer Reports urged Governor Ivey to veto HB 351, arguing the bill was too weak to meaningfully protect consumers. The article also reports criticism from privacy advocates about loopholes, carveouts, and enforcement limitations. (source)
Related regulations
- UK Data Protection Act 2018 — United Kingdom, Active
- Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
- General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
- COPPA (Children's Online Privacy Protection Act) — United States, Active
- Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
- Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
- New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01
- Nebraska Data Privacy Act (NDPA) — Nebraska, Active, effective 2025-01-01
Put it into practice
- Generate the policy: Privacy policy generator (generatepolicy.com)
- Buy the policy pack: State Privacy Law Checklist (cyberpolicy.shop)
- Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates