Privacy
Alabama Personal Data Protection Act
The act applies to persons that conduct business in Alabama or produce products or services targeted to Alabama residents and that either control or process the personal data of more than 25,000 consumers (excluding data processed solely to complete a payment transaction) or derive more than 25 percent of gross revenue from the sale of personal data. It exempts, among others, businesses with fewer than 500 employees that do not sell personal data, nonprofit entities with fewer than 100 employees that do not sell personal data, political subdivisions, higher education institutions, Gramm-Leach-Bliley financial institutions, and HIPAA covered entities and business associates. Law-firm reports say Governor Kay Ivey signed it in April 2026, and Section 12 makes it effective May 1, 2027.
What the website needs
- A controller must let consumers opt out through a clear and conspicuous link on its website to a page that lets them opt out of targeted advertising or the sale of personal data, or that gives current contact information for submitting the opt-out request (Section 6(b)).
- A controller must provide a reasonably accurate, clear, and meaningful privacy notice listing the categories of personal data processed, the purpose of processing, the categories of personal data shared with third parties, the categories of third parties, an active email address or other contact mechanism, and how consumers can exercise their rights, including a link or contact information for the opt-out method (Section 7(d)).
- A controller must describe in its privacy notice one or more secure and reliable means for submitting rights requests and may not require a consumer to create a new account (Section 7(e)).
- A controller that sells personal data or processes it for targeted advertising must clearly and conspicuously disclose that processing and how to opt out (Section 7(c)).
