Share on LinkedInShare on LinkedIn

ARTICLE · 08 APRIL 2026

Alabama Sends Consumer Privacy Bill To Governor

Alabama's legislature has passed the Alabama Personal Data Protection Act, establishing new consumer privacy requirements with notably low applicability thresholds that extend to larger nonprofit organizations. The law introduces unique exemptions and compliance obligations that differ from standard state privacy frameworks, requiring companies to evaluate their data processing activities against Alabama-specific requirements.

United StatesPrivacy

On April 8, 2026, Alabama’s legislature passed House Bill 351, the Alabama Personal Data Protection Act (the APDPA), which now goes to Alabama’s governor, Kay Ivey, for signature. If signed, the law will take effect May 1, 2027.

The APDPA has a very low threshold for applicability compared to other state privacy laws and includes some variation from the standard Virginia and Connecticut models. Companies, including larger nonprofits, should therefore evaluate application of the APDPA and prepare for it to come into effect.

In Depth

Who does the APDPA apply to?

The APDPA applies to a controller or processor that conducts business in Alabama or produces products or services that are targeted to Alabama residents and meets either of the following criteria:

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from