When Does Alabama's Personal Data Protection Act Take Effect for Marketers?

Alabama's Personal Data Protection Act, House Bill 351, takes effect May 1, 2027. The bill was signed into law on April 16, 2026, making Alabama the newest state with a comprehensive consumer privacy statute that reaches targeted advertising practices.

A Notably Lower Threshold Than Most States

The law covers businesses that operate in Alabama or target Alabama residents and either process the personal data of more than 25,000 Alabama consumers, or derive more than 25% of gross revenue from selling personal data. That 25,000-consumer threshold is markedly lower than the thresholds most other state privacy laws use, which commonly sit at 100,000 consumers or more — meaning smaller businesses running Alabama-targeted campaigns can fall under this law where they'd be exempt elsewhere.

Standard Consumer Rights, Plus a Teen-Specific Rule

Consumers get the now-standard set of rights: access, correction, deletion, and data portability, plus the right to opt out of targeted advertising, data sales, and certain profiling. Alabama's law adds a provision specific to teenagers: controllers cannot run targeted advertising aimed at a known 13-to-15-year-old without that consumer's consent. That's a narrower, more specific restriction than the opt-out model that applies to adult consumers generally, and it sits between COPPA's under-13 protections and the adult opt-out framework most state laws use.

Opt-Out Signals Aren't Mandatory Here

Unlike several newer state privacy laws, Alabama's act doesn't require controllers to recognize browser-based universal opt-out preference signals, even though the law references them. That's a meaningful difference from a law like Louisiana's, where honoring a signal such as Global Privacy Control is a requirement rather than an option.

Penalties and a Cure Period That Doesn't Expire

The Alabama Attorney General has exclusive enforcement authority, with civil penalties of up to $15,000 per violation. Businesses get a 45-day period to cure a violation before enforcement proceeds — and unlike some other recent state laws, this cure period is permanent rather than set to sunset after an initial window. There's no private right of action, so consumers can't sue directly over a violation; the Attorney General is the only enforcement path.

Why Legal Observers Are Split on the Real Impact

Law firms tracking the bill don't fully agree on how disruptive it will be. Some expect only incremental change for companies that already run a privacy-compliance program built around other states' laws, since the consumer rights themselves — access, correction, deletion, portability, opt-out — are now fairly standardized across states. Others point specifically to the low 25,000-consumer threshold combined with the per-violation penalty as the reason some smaller Alabama-focused or Alabama-targeting businesses may be facing a comprehensive privacy obligation for the first time, rather than extending an existing program.

Bottom Line

Audit any ad targeting, lookalike audiences, or interest-based segments that could reach known 13-to-15-year-old users in Alabama before May 1, 2027, and don't assume the lower consumer-data threshold doesn't apply just because your business is small — 25,000 Alabama consumers is a low bar to clear.

Sources: Alabama HB 351 (Alabama Personal Data Protection Act), signed April 16, 2026; JD Supra, "Alabama Joins the Privacy Club: What In-House Counsel Need to Know."