HB283 Summary - Alabama Personal Data Protection Act

• Establishes comprehensive data privacy law requiring controllers (entities that determine purposes and means of data processing) to limit data collection to what is adequate, relevant, and necessary, and maintain reasonable security practices.

• Grants Alabama residents consumer rights to access, correct, delete, and port their personal data; opt out of targeted advertising and data sales; and opt out of automated profiling, with a 45-day response deadline for controllers.

• Prohibits controllers from processing sensitive data (racial/ethnic origin, health conditions, biometric data, precise geolocation, data from children) without explicit consent, and bans selling personal data of consumers ages 13-15 without consent.

• Applies to for-profit entities conducting business in Alabama that process personal data of more than 50,000 consumers or more than 25,000 consumers while deriving over 25 percent of revenue from data sales; exempts political subdivisions, higher education institutions, financial institutions, and nonprofits with fewer than 100 employees.

• Grants Alabama Attorney General exclusive enforcement authority with a 60-day cure period after notice of violation, with potential fines up to $10,000 per violation; creates no private right of action; becomes effective July 1, 2026.