Alabama Personal Data Protection Act (HB 351)
Alabama · 2026 Ala. Acts (HB 351), Alabama Personal Data Protection Act
Alabama's comprehensive consumer privacy law gives residents the right to tell businesses to stop using their personal data for profiling that drives automated decisions with major consequences. This covers decisions about things like lending and credit, housing, insurance, education, employment, healthcare, criminal justice, and access to basic necessities. Consumers can also opt out of targeted advertising and the sale of their data. The Alabama Attorney General enforces the law, and there is no individual lawsuit right.
Technical detail
HB 351 (Alabama Personal Data Protection Act) grants consumers a right to opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, enforced exclusively by the Attorney General with civil penalties up to $15,000 per violation.
Who is protected: Alabama residents acting in an individual or household context (consumers).
Who must comply: Controllers that process the personal data of 25,000+ Alabama consumers, or 10,000+ consumers while deriving over 25% of gross revenue from selling personal data (per the enacted thresholds).
Key facts
| Jurisdiction | Alabama |
|---|---|
| Level | State |
| Status | Enacted (not yet in effect) |
| Protection strength | Limited protection |
| Effective date | 2027-05-01 |
| Enacted | 2026-04-16 |
| Citation | 2026 Ala. Acts (HB 351), Alabama Personal Data Protection Act |
| Enforced by | Alabama Attorney General (exclusive enforcement) |
| Private right of action | No — agency enforcement only |
| Penalties | Civil penalties of up to $15,000 per violation, following a notice of violation and a 45-day cure period. |
| Topics | consumer data privacy · automated decision-making |
| Last verified | 2026-07-22 |
| Official source | Alabama Legislature, HB 351 (2026 Regular Session) ↗ |
More AI rules in Alabama
- Alabama Synthetic Private Images Law · In effect
- Alabama Election Deepfake Law · In effect
- Alabama Child Protection Act (AI-generated CSAM) · In effect
- Executive Order No. 738 - Alabama Generative Artificial Inte · In effect
- Alabama Generative AI Acceptable Use Policy (AI-GV-P2) · In effect
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for lo · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.