Alabama Personal Data Protection Act (APDPA)

The Alabama Personal Data Protection Act (APDPA) was signed into law and takes effect on May 1, 2027. Alabama joins the growing list of US states that have enacted comprehensive consumer data privacy legislation.

What Is the APDPA?

The APDPA grants Alabama residents rights over their personal data and places obligations on businesses that collect or process that data. The law follows the opt-out model for general personal data and requires opt-in consent before processing sensitive data.

Who Does the APDPA Apply To?

The APDPA applies to businesses that conduct operations in Alabama or target products or services to Alabama residents, and during the prior calendar year either:

• Controlled or processed the personal data of more than 25,000 consumers (excluding data processed solely to complete a payment transaction); or
• Derived more than 25% of gross revenue from the sale of personal data.

The law includes carve-outs for small businesses. Businesses with fewer than 500 employees that do not sell personal data are generally exempt, as are nonprofits with fewer than 100 employees that do not sell personal data.

Consumer Rights Under the APDPA

Alabama residents are entitled to:

• Right to confirm: confirm whether a business is processing their personal data
• Right to access: request a copy of the personal data a business holds about them
• Right to correction: request correction of inaccurate personal data
• Right to deletion: request deletion of their personal data
• Right to data portability: obtain a portable copy of their personal data in a readily usable format
• Right to opt out: opt out of targeted advertising, the sale of personal data, and automated profiling used to make significant decisions
• Right to appeal: appeal a business's denial of a rights request

Businesses must respond to verified consumer requests within 45 days, with a possible 45-day extension when reasonably necessary.

Sensitive Data

Processing sensitive data requires opt-in consent from consumers. Sensitive data under the APDPA includes:

• Racial or ethnic origin
• Religious beliefs
• Mental or physical health conditions or diagnoses
• Sexual orientation or gender identity
• Biometric data processed to uniquely identify an individual
• Precise geolocation data (within 1,750 feet)
• Personal data of consumers known to be under 13 (applying a known-child standard consistent with COPPA)

Enforcement

The Alabama Attorney General has exclusive authority to enforce the APDPA. There is no private right of action. Businesses receive a 45-day cure period after notice of a violation before the Attorney General may bring an action. Civil penalties of up to $15,000 per violation may be imposed for violations that are not cured within that period.

Notable Features of the APDPA

The APDPA has several characteristics that distinguish it from comparable state laws:

• No data protection impact assessment (DPIA) requirement, unlike Virginia, Colorado, and Connecticut
• A narrow definition of "sale" that requires a material benefit to the controller and unrestricted subsequent use by the recipient, which may exclude some analytics and marketing service arrangements
• A child data threshold of age 13 for the sensitive data opt-in consent requirement, which is lower than the age 16 or 18 thresholds applied in some other states; additionally, the APDPA requires opt-in consent before selling personal data of consumers aged 13 to 15, or using it for targeted advertising
• More generous small business exemptions than many comparable state laws

How UniConsent Supports APDPA Compliance

UniConsent provides the tools businesses need to meet APDPA requirements:

• Opt-out and opt-in consent banners configurable by state
• Global Privacy Control (GPC) signal recognition
• Consumer rights request management
• Sensitive data consent workflows
• Integration with websites, mobile apps, and tag managers

Get started with UniConsent or explore our features.

Other US State Privacy Laws

• CCPA: California Consumer Privacy Act, learn more at CCPA
• CPRA: California Privacy Rights Act, learn more at CPRA
• CPA: Colorado Privacy Act, learn more at CPA
• VCDPA: Virginia Consumer Data Protection Act, learn more at VCDPA
• UCPA: Utah Consumer Privacy Act, learn more at UCPA
• CTDPA: Connecticut Data Protection Act, learn more at CTDPA
• TDPSA: Texas Data Privacy and Security Act, learn more at TDPSA
• DPDPA: Delaware Personal Data Privacy Act, learn more at DPDPA
• NHPA: New Hampshire Privacy Act, learn more at NHPA
• MTCDPA: Montana Consumer Data Privacy Act, learn more at MTCDPA
• FDBR: Florida Digital Bill of Rights, learn more at FDBR
• NJDPA: New Jersey Data Protection Act, learn more at NJDPA
• INCDPA: Indiana Consumer Data Protection Act, learn more at INCDPA
• KCDPA: Kentucky Consumer Data Protection Act, learn more at KCDPA

Compare different US State Privacy Laws