Regulationsby GlyphAlabama Personal Data Protection Act (APDPA)
Enacted Alabama · In force May 1, 2027 · next deadline May 1, 2027 (in 6 months)
Deadlines
APDPA takes effectConsumer rights and controller/processor obligations apply (HB 351 section 12).
Summaries for reference, not legal advice. Check the official text.
What it does
Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.
- Who it applies to
- Persons doing business in Alabama or targeting residents that control or process personal data of more than 25,000 consumers (excluding payment-only data), or derive more than 25% of gross revenue from the sale of personal data regardless of volume. Exempts businesses with fewer than 500 employees and nonprofits with fewer than 100 employees that do not sell personal data.
- Penalties
- Civil penalty up to $15,000 per violation, only after the controller fails to correct within the permanent 45-day notice-and-cure period; injunctive relief. No private right of action.
- Enforced by
- Alabama Attorney General (exclusive)
- Official name
- Alabama Personal Data Protection Act (HB 351, 2026 Regular Session)
- Citation
- HB 351 (2026 RS), Act 2026-552
- Topics
- Privacy
Research notes
Fact-check 2026-09-22: the official ALISON record lists HB 351 as Act 2026-552, delivered to the Governor 8 Apr 2026 and 'Enacted' 17 Apr 2026; enacted_date uses the official 17 Apr 2026 date (WilmerHale and Privacy Daily reported signing on 16 Apr 2026). Enrolled text Section 12: effective 1 May 2027. The 45-day cure period is permanent, so no cure-expiry deadline.
Related
Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026
CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 monthsCalifornia AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026California Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 monthsCalifornia Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 monthsCalifornia social media account deletionSocial media platforms must offer a clear and conspicuous button to delete an account and must not obstruct deletion. A request to delete an account counts as a CCPA request to delete the user's personal information.In effect since Jan 1, 2026
Colorado AI ActColorado's 2024 high-risk AI law (risk-management programs, impact assessments) never took effect: it was delayed to June 30, 2026 and then repealed and reenacted by SB 26-189, signed May 14, 2026, as a narrower automated decision-making technology (ADMT) law. From January 1, 2027, developers must give deployers technical documentation (intended uses, training data categories, limitations) and deployers must notify consumers at the point of interaction, explain ADMT's role within 30 days after an adverse outcome, and offer data correction and meaningful human review. Impact-assessment and risk-management-program mandates were dropped; 3-year record retention remains.Next: Jan 1, 2027 ADMT obligations apply · in 2 monthsColorado Privacy Act (CPA)Comprehensive privacy law giving Colorado consumers rights to access, correct, delete, port and opt out of targeted advertising, sale and certain profiling, with mandatory recognition of universal opt-out mechanisms and data protection assessments for high-risk processing. 2024 amendments added biometric identifier duties (July 1, 2025) and heightened protections for minors under 18 (Oct 1, 2025); 2025's SB 25-276 expanded precise geolocation rules and requires consent before selling sensitive data.In effect since Jul 1, 2023
Questions about Alabama Personal Data Protection Act (APDPA)
- What are the Alabama Personal Data Protection Act (APDPA) compliance deadlines?
- May 1, 2027: APDPA takes effect.
- When does Alabama Personal Data Protection Act (APDPA) take effect?
- Alabama Personal Data Protection Act (APDPA) takes effect on May 1, 2027. The next milestone is May 1, 2027: APDPA takes effect.
- Who does Alabama Personal Data Protection Act (APDPA) apply to?
- Persons doing business in Alabama or targeting residents that control or process personal data of more than 25,000 consumers (excluding payment-only data), or derive more than 25% of gross revenue from the sale of personal data regardless of volume. Exempts businesses with fewer than 500 employees and nonprofits with fewer than 100 employees that do not sell personal data.
- What are the penalties under Alabama Personal Data Protection Act (APDPA)?
- Civil penalty up to $15,000 per violation, only after the controller fails to correct within the permanent 45-day notice-and-cure period; injunctive relief. No private right of action.