Consumer Data Privacy
Alabama Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines
What Alabama’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed July 2026.
What You Need to Know
The Alabama Personal Data Protection Act is very business-friendly, including lacking a data protection impact assessment requirement and not requiring recognition of opt-out preference signals.
Official law text
Who the law applies to
| Threshold | Requirement |
|---|---|
| Annual gross revenue | N/A |
| Consumers whose data is processed | 25,000 consumers 0.48% of state’s 5.22 million population |
| Revenue from sale of personal data | Derives 25% of gross revenue from the sale of personal data, regardless of the number of consumers whose data the person controls or processes. |
Consumer rights under Alabama's law15
| Right | Provided? |
|---|---|
KnownoteConsumers can confirm whether a controller, or a processor or third party acting on a controller’s behalf, is processing the consumer’s personal data. | Yes |
| Access | Yes |
| Obtain list of third parties to which personal data was disclosed | No |
Data portabilitynoteRight applies only to data provided by the consumer to the controller. | Partial |
| Delete | Yes |
| Correct inaccuracies | Yes |
| Not be discriminated against for exercising rights | No |
| Opt-out of sale | Yes |
| Opt-out of targeted advertising/sharing | Yes |
| Opt-out of certain types of profiling | Yes |
| Opt-out of ADMT | No |
| Recognize opt-out signals | No |
| Revoke consent | Yes |
| Not process data in discriminatory manner | No |
| Appeal | No |
Categories treated as sensitive data10
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Mental or physical health condition
- Sexual orientation
- Sex life
- Citizenship or immigration status
- Genetic or biometric data for purposes of uniquely identifying an individual
- Personal data of known child
- Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data.
How sensitive data must be treated1
- Obtain Consent to Process
Requirements for minors' data1
- Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent
Other notable provisions9
- Definition of “Sale” Includes “Other Valuable Consideration”
- Applies to Nonprofits
note
The law exempts a “nonprofit entity, as defined in Section 10A-1-1.03, with less than 100 employees, provided the entity does not engage in the sale of personal data.” - Data Processing Agreements
- Privacy Policy
- Implement Reasonable Data Security Measures
- Duty to Avoid Secondary Use
- Data Minimization
- Attorney General Enforcement
- Right to Cure
note
45 day right to cure that does not sunset.
Key dates1
| Date | What happens |
|---|---|
| May 1, 2027 | Alabama's consumer data privacy law takes effect |
Questions about Alabama’s privacy law?
Stauss PLLC advises companies on state privacy, AI, and data broker compliance.
Contact Stauss PLLCThis page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.