Alabama Personal Data Protection Act (HB 351, Act 2026-552): opt-out of profiling for solely automated significant decisions

Summary

Alabama enacted a comprehensive consumer privacy law in 2026 (HB 351, Act 2026-552), effective May 1, 2027. It applies to persons doing business in Alabama or targeting its residents that control or process personal data of more than 25,000 consumers (excluding payment-only data) or derive more than 25 percent of gross revenue from selling personal data. Consumers may opt out of profiling in furtherance of solely automated significant decisions, which are decisions resulting in the provision or denial of credit or lending services, housing, insurance, education, criminal justice, employment, health care or access to basic necessities. Unlike most state privacy laws, it does not require data protection assessments. Financial institutions and data governed by Title V of the Gramm-Leach-Bliley Act are exempt. The Attorney General enforces after a 45-day notice-and-cure period that does not expire; courts may impose civil penalties of up to $15,000 per violation. Privacy law, profiling opt-out only (no profiling assessment duty).

Key dates

1. April 17, 2026Enacted
2. October 16, 2026Checked against sources
3. October 21, 2026Checked against sources
4. May 1, 2027Takes effect

Developments are added when the record is reviewed. Next review: January 15, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. "actNbr":"2026-552","lastActionDate":"2026-04-17","currentStatus":"Enacted"

   Supports: Act number, enacted status, last-action date

   Alabama Legislature instrument data for HB351 (2026 session) Alabama Legislature (ALISON) Primary source

2. Personal Data Protection Act.

   Supports: Name (Section 1)

   c. Profiling in furtherance of solely automated

   Supports: Profiling opt-out (line 372; continues 'significant decisions concerning the consumer')

   controller of credit or lending services, housing, insurance,

   Supports: Significant decisions include credit and lending

   of not more than fifteen thousand dollars ($15,000) per

   Supports: Penalty

   Section 12. This act shall become effective on May 1,

   Supports: Effective-date clause (year on next line: 2027)

   HB351 Enrolled Alabama Legislature Primary source

3. On April 17, 2026, Governor Kay Ivey signed House Bill 351 into law, enacting the Alabama Personal Data Protection Act

   Supports: Signing

   Consumers may opt out of the processing of their personal data for purposes of targeted advertising, sale of their personal data, or for profiling in furtherance of solely automated significant decisions concerning a consumer.

   Supports: Profiling opt-out

   controlling or processing the personal data of more than 25,000 Alabama consumers (excluding personal data processed solely to complete a payment transaction)

   Supports: Threshold

   the APDPA does not require controllers to conduct data protection assessments for processing activities that pose a heightened risk of harm.

   Supports: No assessment duty

   Alabama Enacts Comprehensive Consumer Data Privacy Law Mayer Brown Reporting or analysis

4. The law goes into effect May 1, 2027.

   Supports: Effective date

   Alabama Enacts Consumer Data Privacy Law Troutman Pepper Locke Reporting or analysis

5. Importantly, this cure provision does not sunset

   Supports: Cure period does not sunset

   U.S.: Alabama becomes 21st state to enact comprehensive privacy law DLA Piper (Privacy Matters) Reporting or analysis