PRIA Logo™
AlabamaHB3512026 Regular SessionHouseWALLET

Data privacy; processing of data regulated, consumer actions related to data authorized

Sponsored By: Mike Shaw (Republican)

Enacted

Consumer Protection

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

10 provisions identified: 4 benefits, 1 costs, 5 mixed.

Alabama enforces privacy with civil penalties

Beginning May 1, 2027, Alabama’s Attorney General enforces the privacy law. A controller gets notice and 45 days to fix an alleged violation. Timely correction blocks an action if the controller also promises in writing that violations are corrected and will not recur. Otherwise, the Attorney General can seek a court order stopping violations. A court can impose up to $15,000 per violation; this penalty is not a payment to households.

Businesses must limit and secure data

Beginning May 1, 2027, covered businesses must collect only personal data reasonably needed for their disclosed purposes. They must use reasonable safeguards suited to the amount and type of data. Withdrawing consent must be at least as easy as giving it. After withdrawal, further processing must stop as soon as practical. The deadline is 45 days after the business complies with the consumer’s opt-out request.

Sensitive data and children gain safeguards

Beginning May 1, 2027, covered businesses need consent to process sensitive data, including health, religion, race, sexuality, and immigration status. They generally cannot use data for purposes unrelated to those disclosed or use it for unlawful discrimination. Consent obtained through deceptive designs that undermine people’s choices is banned. For known children under 13, businesses must follow federal children’s privacy rules; federally verified parental consent satisfies Alabama’s requirement. Businesses cannot sell data or target ads to someone they know is 13–15 without that consumer’s consent.

Data contractors must support privacy protections

Beginning May 1, 2027, data contractors must follow the responsible business’s instructions and help with consumer requests, security, and breach notices. Binding contracts must state the work’s purpose, data types, duration, instructions, and each party’s duties. Contracts must cover confidentiality, compliance reviews, and matching duties for subcontractors. When services end, contractors must delete or return data as directed unless law or the contract permits keeping it. Contractors making their own processing decisions can become responsible as data controllers.

Some data uses bypass privacy duties

Beginning May 1, 2027, privacy duties do not restrict specified legal, law-enforcement, national-security, legal-claim, and emergency data uses. Exceptions also cover requested services, contracts, warranties, fraud prevention, security, recalls, repairs, and compatible internal operations. Public-interest research requires ethics and privacy compliance plus independent review; public-health uses require safeguards and professional confidentiality. Exempt uses must be reasonably necessary, proportionate, limited to their purpose, and protected by reasonable safeguards. Businesses must prove the exception applies; personal or household processing is excluded, and Alabama evidentiary privileges remain protected.

Alabama consumers gain limited data control

Beginning May 1, 2027, Alabama residents gain rights over covered personal data outside their work or business roles. They can confirm processing, access data, correct errors, delete data, and get a portable copy of data they supplied. The copy right applies to automated processing when technically possible; trade secrets can limit access or copies. Consumers can stop targeted ads, data sales, and profiling used for fully automated decisions with significant effects. These decisions include access to credit, housing, insurance, education, jobs, health care, and basic necessities. Parents and legal representatives can act for people they represent, and contracts cannot take away these rights.

Consumer privacy requests get deadlines

Beginning May 1, 2027, covered businesses must explain their data uses, sharing, contact details, rights, and verification methods. They must offer secure request methods without requiring a new account, though they can require an existing account. Responses and reasons for denial are due within 45 days; complexity or request volume allows one extra 45 days with notice. Information is free once per consumer every 12 months. Businesses can charge reasonable fees or refuse clearly unfounded, excessive, repetitive, or technically impossible requests, but must justify doing so. Most requests require reasonable identity checks; opt-outs do not, though documented fraud or lack of authorization allows denial with notice.

Opting out protects consumers with exceptions

Beginning May 1, 2027, covered businesses must offer a clear website link or current contact details for opting out. They must honor opt-out signals for targeted ads and data sales, even when privacy settings or loyalty programs conflict. Businesses can explain the conflict and offer a choice. They generally cannot deny service, raise prices, or lower quality because someone opts out. Services that need the processing and voluntary, genuine loyalty or discount programs remain exceptions. Businesses announcing a charge in response to an opt-out must disclose the terms of data-linked financial incentives.

Unlinked data gets safeguards and exceptions

Beginning May 1, 2027, businesses holding data stripped of identifying details must prevent linking it back to people. They must not restore identities, must bind recipients by contract, and must oversee compliance and address breaches. Businesses can decline requests they cannot reasonably link to data, or that are unreasonably burdensome to link. That exception requires limits on recognizing consumers, connecting their data, selling it, and voluntarily sharing it beyond permitted recipients. Rights can also exclude coded data when identifying details are held separately and safeguards prevent the business from accessing them.

Alabama privacy coverage has major exemptions

Beginning May 1, 2027, the law covers businesses operating in Alabama or targeting Alabama residents. They must handle more than 25,000 consumers’ personal data, excluding payment-only data, or earn over 25% of gross revenue from data sales. The revenue test applies regardless of consumer count. Businesses with fewer than 500 employees and nonprofits with fewer than 100 are exempt if they do not sell personal data. Exemptions also cover specified public bodies, colleges, financial and health entities, and electric providers meeting reliability standards. Certain health, school, credit, research, employment, benefits, airline, driver, and Farm Credit data are excluded. These exclusions have category-specific limits, and businesses must prove their exemption applies.

Sponsors & Cosponsors

Sponsor

  • Mike Shaw

    Republican • House

Cosponsors

There are no cosponsors for this bill.

Roll Call Votes

All Roll Calls

Yes: 686 • No: 0

House vote • 4/7/2026

Shaw Motion to Concur In and Adopt Senate Amendment - Adopted Roll Call 1258

Yes: 104 • No: 0

Senate vote • 4/7/2026

Motion to Read a Third Time and Pass as Amended - Adopted Roll Call 1198

Yes: 34 • No: 0

Senate vote • 4/7/2026

Elliott motion to Adopt - Adopted Roll Call 1197

Yes: 34 • No: 0

Senate vote • 4/7/2026

Elliott motion to Adopt - Adopted Roll Call 1195

Yes: 34 • No: 0

Senate vote • 4/7/2026

Third Reading in Second House

Yes: 34 • No: 0

Senate vote • 4/7/2026

Elliott motion to Adopt - Adopted Roll Call 1196

Yes: 34 • No: 0

House vote • 2/24/2026

Third Reading in House of Origin

Yes: 104 • No: 0

House vote • 2/24/2026

Motion to Read a Third Time and Pass as Amended - Adopted Roll Call 564

Yes: 104 • No: 0

House vote • 2/24/2026

Motion to Adopt - Adopted Roll Call 563

Yes: 100 • No: 0 • Other: 1

House vote • 2/24/2026

Motion to Adopt - Adopted Roll Call 562

Yes: 104 • No: 0

Actions Timeline

  1. Enacted

    4/17/2026House

  2. Ready to Enroll

    4/8/2026House

  3. Enrolled

    4/8/2026House

  4. Delivered to Governor

    4/8/2026House

  5. Signature Requested

    4/8/2026Senate

  6. Third Reading in Second House

    4/7/2026Senate

  7. County and Municipal Government 1st Amendment Offered

    4/7/2026Senate

  8. County and Municipal Government 3rd Amendment Offered

    4/7/2026Senate

  9. County and Municipal Government 2nd Amendment Offered

    4/7/2026Senate

  10. Elliott motion to Adopt - Adopted Roll Call 1195

    4/7/2026Senate

  11. Elliott motion to Table - Adopted Voice Vote

    4/7/2026Senate

  12. Elliott motion to Adopt - Adopted Roll Call 1196

    4/7/2026Senate

  13. Elliott 1st Amendment Offered

    4/7/2026Senate

  14. Elliott motion to Adopt - Adopted Roll Call 1197

    4/7/2026Senate

  15. Motion to Read a Third Time and Pass as Amended - Adopted Roll Call 1198

    4/7/2026Senate

  16. Shaw Motion to Concur In and Adopt Senate Amendment - Adopted Roll Call 1258

    4/7/2026House

  17. Ready to Enroll

    4/7/2026House

  18. County and Municipal Government 1st Amendment

    3/10/2026Senate

  19. County and Municipal Government 2nd Amendment

    3/10/2026Senate

  20. County and Municipal Government 3rd Amendment

    3/10/2026Senate

  21. Reported Out of Committee Second House

    3/10/2026Senate

  22. Read for the Second Time and placed on the Calendar

    3/10/2026Senate

  23. Read for the first time and referred to the Senate Committee on County and Municipal Government

    2/25/2026Senate

  24. Pending Committee Action in Second House

    2/25/2026Senate

  25. Third Reading in House of Origin

    2/24/2026House

Bill Text

Related Bills

Back to State Legislation