Alabama has joined the expanding patchwork of states enacting consumer privacy laws, with a new statute that will require many businesses to reassess how they collect, use and sell personal data. On April 16, 2026, Governor Kay Ivey signed into law the Alabama Personal Data Protection Act (APDPA), a comprehensive consumer data privacy law. The APDPA will take effect on May 1, 2027. The law applies to many companies doing business in Alabama or targeting its residents and introduces obligations around consumer rights, data use and transparency.
Key Takeaways:
- The APDPA largely follows the “Virginia model” of comprehensive consumer privacy laws, so many requirements will be familiar to companies with existing privacy programs.
- The APDPA’s scope combines a low processing threshold with a broad small business exemption.
- The APDPA prescribes specific mechanisms for opting out of targeted advertising and the sale of personal data but does not include an express requirement for data protection assessments.
- If not already subject to other state privacy laws, companies in Alabama that fall in scope may face significant new compliance obligations.
Threshold and Exemptions
The…..