U.S.: Alabama Becomes 21st State to Enact Comprehensive Privacy Law
On April 7, 2026, the Alabama legislature unanimously passed House Bill 351 , the Alabama Personal Data Protection Act. The bill cleared the House 104-0 and the Senate 34-0, making Alabama the 21st state to enact a comprehensive consumer privacy statute. If signed by Governor Kay Ivey, the law will take effect on May 1, 2027. While many recent additions to the state privacy patchwork have closely tracked the Virginia model, Alabama’s law introduces several notable departures, particularly around applicability thresholds, the definition of “sale,” and entity-level exemptions, that businesses collecting data of Alabama residents will need to evaluate carefully. Applicability Thresholds The Alabama Personal Data Protection Act applies to persons that conduct business in the state or produce products or services targeted to Alabama residents and that meet either of two thresholds. Section 3 of the Act provides: “The provisions of this act apply to persons that conduct business in thi...