AL HB351

Consumers may request confirmation of data collection, access their personal data, correct inaccuracies, request deletion, obtain portable copies, and opt out of targeted advertising, data sales, and automated profiling for significant decisions

Applies to entities processing data of more than 25,000 Alabama consumers or deriving over 25% of gross revenue from personal data sales; exempts businesses with fewer than 500 employees (if not selling data), nonprofits with fewer than 100 employees, government entities, higher education institutions, and entities already regulated by HIPAA, Gramm-Leach-Bliley, or FERPA

Controllers must limit data collection to what is reasonably necessary, maintain security practices, obtain consent before processing sensitive data (biometric, health, racial origin, geolocation, children's data), and provide clear privacy notices

By January 1, 2028, controllers must honor opt-out preference signals; controllers have 45 days to respond to consumer requests

Attorney General has exclusive enforcement authority with 45-day cure period before action; civil penalties up to $15,000 per violation; effective date May 1, 2027