Alabama Enacts Nation’s Twenty-First State Comprehensive Privacy Law
On April 16, 2026, Alabama Governor Kay Ivey signed the Alabama Personal Data Protection Act (APDPA) into law, making A labama the twenty-first state to enact a comprehensive privacy law. Alabama is the second state to pass a comprehensive privacy law this year, with Oklahoma passing a comprehensive privacy law last month. Notably, the APDPA has l ow applicability thresholds, applying to entities that control or process personal information of more than 25,000 Alabama residents or derive more than 25% of gross revenue from the sale of personal data. However, the law contains a narrow definition of sale and includes standard entity-wide exemptions for entities covered by the Gramm-Leach-Bliley Act (GLBA), as well as both covered entities and business associates regulated by the Health Insurance Portability and Accountability Act (HIPAA) . It also i ncludes exemptions for personal data processed in a “commercial” or “employment” context. Additionally, unlike many...