{"id":253901,"date":"2026-04-28T03:00:00","date_gmt":"2026-04-28T07:00:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/04\/28\/alabama-enacts-comprehensive-consumer-data-privacy-law-insights\/"},"modified":"2026-05-24T05:10:55","modified_gmt":"2026-05-24T09:10:55","slug":"alabama-enacts-comprehensive-consumer-data-privacy-law-insights","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/04\/28\/alabama-enacts-comprehensive-consumer-data-privacy-law-insights\/","title":{"rendered":"Alabama Enacts Comprehensive Consumer Data Privacy Law | Insights"},"content":{"rendered":"<p><a href=\"https:\/\/www.mayerbrown.com\/en\/insights\/publications\/2026\/04\/alabama-enacts-comprehensive-consumer-data-privacy-law\">Alabama Enacts Comprehensive Consumer Data Privacy Law | Insights<\/a><\/p>\n<p><a href=\"https:\/\/www.mayerbrown.com\/en\/insights\/publications\/2026\/04\/alabama-enacts-comprehensive-consumer-data-privacy-law\">https:\/\/www.mayerbrown.com\/en\/insights\/publications\/2026\/04\/alabama-enacts-comprehensive-consumer-data-privacy-law<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-04-28 03:00:00<\/a><\/p>\n<p>Source Domain: <a href=\"www.mayerbrown.com\">www.mayerbrown.com<\/a><\/p>\n<p>On April 17, 2026, Governor Kay Ivey signed House Bill 351 into law, enacting the Alabama Personal Data Protection Act (the &#8220;APDPA&#8221; or the &#8220;Act&#8221;) and making Alabama the 22nd state to adopt a comprehensive consumer privacy law. The APDPA, which takes effect on <strong>May 1, 2027<\/strong>, largely follows the dominant model for state privacy legislation observed in states outside of California; however, it departs from that model in several notable respects, including generally lower applicability thresholds, a novel definition of &#8220;sale,&#8221; and the absence of a data protection assessment requirement. For more information about how the APDPA compares to other privacy laws, please see our state privacy law tracker.<\/p>\n<h4>Who is Covered?<\/h4>\n<p>The APDPA applies to persons that conduct business in Alabama, or that target products or services to Alabama residents, and that meet either of the following thresholds: (1) controlling or processing the personal data of more than <strong>25,000 Alabama consumers<\/strong> (excluding personal data processed solely to complete a payment transaction); or (2) deriving more than <strong>25% of gross revenue<\/strong> from the sale of personal data, regardless of the number of consumers whose data the person controls or processes.<\/p>\n<h4>Entity-Level Exemptions<\/h4>\n<p>A number of entities are exempt from the APDPA, including the following:<\/p>\n<ul>\n<li><strong>Financial institutions<\/strong> and affiliates subject to the Gramm-Leach-Bliley Act (\u201cGLBA\u201d);<\/li>\n<li><strong>Covered entities and business associates<\/strong> as defined by the Health Insurance Portability and Accountability Act of 1996 (\u201cHIPAA\u201d);<\/li>\n<li><strong>State agencies and political subdivisions<\/strong> of Alabama;<\/li>\n<li><strong>Institutions of higher education<\/strong> and their affiliates;<\/li>\n<li><strong>National securities associations<\/strong> registered under federal law;<\/li>\n<li><strong>Small businesses<\/strong> with fewer than 500 employees that do not sell personal data; and<\/li>\n<li><strong>Non-profit organizations<\/strong> with fewer than 100 employees that do not sell personal data.<\/li>\n<\/ul>\n<p>In addition to these entity-level exemptions, the APDPA provides certain data-level&#8230;<\/p>\n<p><a href=\"https:\/\/www.mayerbrown.com\/en\/insights\/publications\/2026\/04\/alabama-enacts-comprehensive-consumer-data-privacy-law\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Alabama Enacts Comprehensive Consumer Data Privacy Law | Insights https:\/\/www.mayerbrown.com\/en\/insights\/publications\/2026\/04\/alabama-enacts-comprehensive-consumer-data-privacy-law Publish Date: 2026-04-28 03:00:00 Source&#8230;<\/p>\n","protected":false},"author":1,"featured_media":253902,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.mayerbrown.com\/cdn-cgi\/image\/width=400,quality=90,format=jpeg\/-\/media\/images\/tile-images-for-insights-and-news\/tile_bucket-300x400_18.jpg?rev=a313d627a74d4b7fb8ff5107687353e8","fifu_image_alt":"","footnotes":""},"categories":[16],"tags":[],"class_list":["post-253901","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-privacy"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/253901"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=253901"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/253901\/revisions"}],"predecessor-version":[{"id":253903,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/253901\/revisions\/253903"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/253902"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=253901"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=253901"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=253901"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}