AL HB263

Health and fitness app operators are prohibited from transferring, disclosing, or using consumers' biological data (genetic, physiological, biochemical) or neural data (central nervous system activity) without express written or electronic consent from Alabama residents.

Covered entities must obtain consent before sharing data with third parties, using data beyond providing requested services, or marketing based on biological/neural data.

The Attorney General has exclusive enforcement authority and must issue a 45-day notice to cure before initiating legal action; civil penalties up to $3,000 per violation may be assessed if violations are not corrected.

Exemptions include law enforcement use, court orders, HIPAA-compliant activities, de-identified data, higher education research, insurance operations, security purposes, and internal product development.

Effective date: October 1, 2026; passed the Alabama House unanimously (104-0) on February 26, 2026.