Compliance Stuff

On April 7, 2026, the Alabama legislature unanimously passed  House Bill 351 , the Alabama Personal Data Protection Act. The bill cleared the House 104-0 and the Senate 34-0, making Alabama the 21st state to enact a comprehensive consumer privacy statute. If signed by Governor Kay Ivey, the law will take effect on May 1, 2027. While many recent additions to the state privacy patchwork have closely tracked the Virginia model, Alabama’s law introduces several notable departures, particularly around applicability thresholds, the definition of “sale,” and entity-level exemptions, that businesses collecting data of Alabama residents will need to evaluate carefully. Applicability Thresholds The Alabama Personal Data Protection Act applies to persons that conduct business in the state or produce products or services targeted to Alabama residents and that meet either of two thresholds. Section 3 of the Act provides: “The provisions of this act apply to persons that conduct business in thi...

  After a legislative lull last year, 2026 has brought a new wave of state privacy lawmaking activity. A number of states have introduced comprehensive state privacy bills during the legislative cycle, reflecting a continued trend toward expanding individual privacy rights and creating new compliance obligations on businesses that collect and process personal data. While many of these proposals follow established frameworks modeled after existing state privacy laws, several include new provisions addressing emerging issues such as artificial intelligence (AI) and consumer health data. The tables below summarize certain key details of the state privacy bills introduced during the 2026 legislative cycle. Comprehensive privacy bills (in progress as of March 2, 2026) These bills largely mimic existing comprehensive privacy laws passed since 2018. Certain new provisions are summarized in the last column. State Link to bill Date introduced Title Summary of provisions Alabama HB 351 Janua...