Cybersecurity Policy Report, Governor Signs Alabama Consumer Data Privacy Bill Into Law, (Apr 17, 2026)
Organizations Mentioned:Consumer Reports
Alabama Gov. Kay Ivey (R.) has signed into law a comprehensive consumer data privacy bill that will, among other things, give consumers rights to access, delete, and opt out of data processing, despite calls from consumer advocates urging the Legislature to enact stronger consumer protections.
The new law takes effect May 1, 2027.
HB 351 empowers a consumer to confirm whether a controller is processing any of the consumer’s personal data, correct inaccuracies in the consumer's personal data, direct a controller to delete the consumer’s personal data, obtain a copy of the consumer’s personal data, and opt out of the processing of the consumer’s data. Controllers will be required to respond to consumer requests within 45 days, with a possible 45-day extension, and provide a secure and reliable method for consumers to exercise their rights.
The Alabama Personal Data Protection Act will apply to businesses operating in the state that control or process the personal data of more than 25,000 consumers or derive more than 25% of gross revenue from the sale of personal data. Certain entities such as small businesses, nonprofits with fewer than 100 employees, government agencies, and financial institutions governed by federal law will be exempt.
HB 351 directs the state attorney general to enforce the bill’s provisions and requires a 45-day notice of violation to controllers before initiating action. If the violation is not corrected within the 45-day period, the attorney general may seek an injunction and civil penalties of up to $15,000 per violation.
Consumer Reports and the Electronic Privacy Information Center called on the governor to veto what they called a “weak consumer data privacy bill.” Consumer Reports said that although the bill contained some basic consumer rights, “those rights are undercut by weak definitions of key terms like ‘sale’ and ‘targeted advertising,’ no universal opt out or authorized agent provisions, and insufficient enforcement mechanisms.”
“This legislation adopts a lowest-common-denominator approach to privacy that will not meaningfully protect consumers. The bill includes definitions rife with loopholes, creates broad carveouts for key industries, and lacks universal opt-out controls that can help make privacy bills workable for consumers. It also lacks enforcement mechanisms that will actually incentivize companies to comply the first time around,” said Matt Schwartz, a policy analyst at Consumer Reports.
The bill (H.B. 351, Reg Sess.) was sponsored by Rep. Mike Shaw (R.).
News: StateLegislation DataPrivacy