Alabama PDPA

Alabama's Personal Data Protection Act was signed April 17, 2026 and takes effect May 1, 2027. It reaches further down than most state laws: controllers that process the personal data of more than 25,000 Alabama consumers, or that derive more than 25 percent of gross revenue from selling personal data, are in scope, though businesses with fewer than 500 employees are exempt if they do not sell personal data. Consumers may access, correct, delete, and port their data and opt out of targeted advertising, sale, and certain profiling, and sensitive data requires consent. The final bill dropped the House version's requirement to honor browser opt-out signals, and it requires no data protection assessments. The Attorney General enforces, with a permanent 45-day cure period and court-assessed penalties of up to $15,000 per violation, twice the $7,500 most states set. The opt-out link has to stop the tags it names.