Data privacy laws are evolving fast  and keeping up shouldn't fall entirely on your team. If you're navigating multistate compliance, we're here to help. Get in touch with us today.

With its adoption of the Alabama Personal Data Protection Act (APDPA) in April 2026, Alabama is now the 21st state to pass a comprehensive data-privacy law. (If you count the Florida Digital Bill of Rights, it’s actually the 22nd.) The APDPA is set to take effect on May 1, 2027.

While the APDPA does closely follow a now-familiar model used by almost every other state going back to Virginia’s privacy law, it also contains a few unusual differences that are sure to delight the business and tech community.

Here’s what businesses should know about the Alabama Personal Data Protection Act.

Basic Requirements

The basic outline of compliance for the APDPA is the same as most other privacy laws. Businesses should be transparent about the data they collect, use, and disclose; consumers have rights regarding their own personal data; and consent is required for certain uses of data.

Here’s a quick summary.

• Privacy notices should include the following:
  
  • The categories of personal data processed
  • The purposes for processing that data
  • The categories of personal data shared with third parties
  • The categories of those third parties
  • A contact mechanism
  • A description of privacy rights and how to exercise them
• Alabama residents have the these privacy rights:
  
  • The right to access their personal data
  • The right to delete their data 
  • The right to correct inaccuracies in their data
  • The right to receive their data in a portable format
  • The right to opt-out of:
    
    • The sale of their personal data
    • Targeted advertising
    • Profiling in furtherance of solely automated significant decisions (access to housing, education, loans, etc.)
• Consent is required for:
  
  • Targeted advertising using the data of consumers under the age of 16
  • Processing the personal data of known children (under 13)
  • Processing sensitive data, which includes:
    
    • Precise geolocation
    • Biometric data
    • Data revealing racial or ethnic origin, religious beliefs, health condition or diagnosis, sex life or sexual orientation, and citizenship or immigration status

Of course, this is not a comprehensive list, and it shouldn’t be taken to mean that compliance will be simple. As with other privacy laws, compliance requires a deep dive into an organization’s data practices, advance planning for handling privacy requests, and vigilance to stay current with any changes.

Who Does the Alabama Privacy Law Apply To?

Alabama takes a novel approach to defining its scope. Like most other states, it sets out some numerical thresholds, which are:

• Controlling or processing the personal data of at least 25,000 Alabama residents in a year, or
• Deriving at least 25% of gross revenue from the sale of data, regardless of the number of consumers

On their own, these thresholds are actually quite liberal and would make the APDPA one of the most broadly applicable state privacy laws. However, the statute then significantly  walks back these thresholds by stating that it does not apply to:

• Businesses with fewer than 500 employees, provided they don’t sell personal data
• Nonprofit entities with fewer than 100 employees, provided they don’t sell personal data

There are plenty of businesses that don’t meet these employee numbers, but handle the personal data of millions of people. As for the part about not selling personal data, keep reading to see why that might not be such a limitation after all.

What Is a “Sale” Under the APDPA?

Similarly, the APDPA’s definition of “selling” personal data starts out in familiar territory, then goes to some whacky places.

The bill defines the sale of personal data as:

• The exchange of personal data for money, or 
• The exchange of personal data for any other valuable consideration, if
  
  • The controller receives a material benefit, and
  • The third party is not restricted in its subsequent use of the data

The part about the third party not being restricted in its subsequent use of the personal data has the potential to swallow the entire rule. Under the California Consumer Privacy Act, all disclosures constituting a sale must be accompanied by contractual language specifying that the data is being disclosed for limited and specific purposes. Ironically (or perhaps the intention of savvy tech lobbyists), this restriction on data sales in California may exempt the disclosure from being considered a sale in Alabama.

The APDPA also adds two very significant exceptions to the definition of a sale of personal data:

• The disclosure of personal data to a third party for the purpose of providing analytics services
• The disclosure of personal data to a third party for the purpose of providing marketing services solely to the controller

The first of these creates a loophole you could drive a Google Analytics-sized bus through, and strongly suggests that giving Google unrestricted access to analytics data will not be considered a sale in Alabama.

All of these exceptions raise the question of why Alabama didn’t merely define the sale of personal data as exchanging data solely for monetary consideration (as many other states have done). While Alabama legislators may have been trying to make the APDPA more business friendly, the reality is that the exceptions just make multistate compliance more complicated for most companies.

No Data Protection Assessment Required

Most other state privacy laws require businesses to carry out a data protection assessment (DPA) before engaging in any data processing that is considered high-risk. The most common high-risk activities are targeted advertising, selling personal data, and processing sensitive data. 

The APDPA forgoes the DPA requirement entirely.

No Privacy Request Appeals

Another unusual omission in the Alabama privacy law is that businesses are not required to provide a mechanism for appealing. Virtually all other states (except California and Utah) give consumers this right.

We’re here to help!

Staying on top of laws like the APDPA is complex, time-consuming, and only getting harder. You don't have to figure it out alone. Whether you're just getting started or looking to strengthen your existing privacy program, our team is ready to chat.