APDPA

Alabama Personal Data Protection Act (HB 351)

Key Facts

Effective Date
May 1, 2027
Enacted
April 17, 2026
Enforcing Authority
Alabama Attorney General
Consent Model
Opt-out

Penalties

AG-enforced; no private right of action.

Data Subject Rights

Access your data45 days

Confirm whether a controller, or a processor or third party acting for it, is processing your personal data and access that data, unless doing so would require the controller to reveal a trade secret.

Correct your data45 days

Correct inaccuracies in your personal data, considering the nature of the data and the purposes of the processing.

Delete your data45 days

Direct a controller to delete your personal data; for data obtained from other sources, the controller may instead keep a minimal record to keep it deleted or opt you out of further processing.

Port your data45 days

Where processing is automated, obtain a copy of the personal data you previously provided in a portable and, where technically feasible, readily usable format you can transmit to another controller, unless that would reveal a trade secret.

Opt out of targeted advertising45 days

Opt out of the processing of your personal data for targeted advertising, meaning ads selected from your activity over time across nonaffiliated websites or apps.

Opt out of sale45 days

Opt out of the sale of your personal data, which the act defines to exclude, among other things, disclosures to processors or affiliates, disclosures to third parties for analytics services, and disclosures for marketing services provided solely to the controller.

Opt out of profiling45 days

Opt out of profiling in furtherance of solely automated significant decisions, meaning decisions that provide or deny credit or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunity, health care services, or access to basic necessities such as food or water.

Revoke your consent45 days

Revoke any consent you gave under the act through a mechanism at least as easy as the one you used to give it, after which the controller must stop processing the data.

Non-discrimination

A controller may not deny goods or services, charge different prices or provide a different quality because you opted out, though it need not provide a service that requires the processing and may run bona fide loyalty, rewards, premium features, discount or club card programs.

US State Specifics

Private Right of Action
No
Global Opt-out Required
No
Sensitive Data Opt-in
Yes

Other North America Regulations

CCPACalifornia, United States
The CCPA was the first comprehensive consumer privacy law in the United States, giving California residents the right to know what personal information businesses collect and to opt out of its sale. It established the opt-out consent model that most subsequent US state privacy laws adopted.
CPRACalifornia, United States
The CPRA is the most comprehensive US state privacy law with a dedicated enforcement agency (CPPA). Cross-context behavioral advertising via cookies constitutes sharing personal information, triggering opt-out obligations. GPC signals must be honored as valid opt-out requests.
PIPEDACanada
Canada's federal private-sector privacy law based on 10 fair information principles. Requires express consent for sensitive data and implied consent for less sensitive data. OPC guidance addresses cookies and online behavioral advertising. The CPPA replacement bill died January 2025; a new bill is expected.
CIPACalifornia, United States
CIPA is a 1967 California chapter covering wiretapping, eavesdropping, and other privacy invasions, not a website-specific law. Since 2022, courts have applied two of its sections to website chat, analytics, and ad tools, and any visitor can sue directly for at least $5,000 per violation, no revenue threshold.
MODPAMaryland, United States
The most restrictive US state privacy law. Sensitive data may only be processed when strictly necessary to deliver a requested service, and sale of sensitive data is completely prohibited even with consent. Under-18 sale and targeted advertising are prohibited regardless of consent. Strictest data minimization in the US.
TDPSATexas, United States
The TDPSA is the broadest US state privacy law: no revenue thresholds and no minimum consumer data volume thresholds. Applies to any non-small-business processing personal data of Texas residents. Must honor GPC signals since January 2025. This breadth means far more businesses are captured than under any other state law.

Stay compliant with APDPA

ConsentStack helps you implement Opt-out consent for Alabama, United States automatically.