Roll Tide: Alabama Rolls Out Its Consumer Privacy Law

Alabama is now the 21st state with a “comprehensive” consumer privacy law. The Alabama Personal Data Protection Act was signed by Governor Ivey last week and takes effect May 1, 2027. The law applies to entities that do business in Alabama or target Alabama residents in certain circumstances. Namely, if they either process personal data of more than 25,000 Alabama residents, or earn more than 25% of their gross revenue from selling personal data. For the latter, regardless of how many people’s data they handle. This is unlike other states, which to the revenue threshold to a minimum number of people whose data a business sells. The 25,000 resident threshold is the lowest people-based threshold of any state privacy law.