Alabama Enacts Comprehensive Consumer Data Privacy Law

Alabama just joined the national patchwork of state data privacy laws, and if you think this is just another boring legislative update, you’re wrong. Every state that passes its own privacy law adds another layer of complexity to a system that’s already a mess — and it’s your personal data sitting in the middle of that mess. This one matters because it shifts real power to real people, and companies doing business in Alabama now have a hard deadline to get their act together.

Alabama’s governor signed the Alabama Data Privacy Act into law in April 2026. According to Mayer Brown’s legal analysis, the law gives Alabama consumers the right to access, correct, delete, and opt out of the sale of their personal data. Sound familiar? It should. Virginia did it. Colorado did it. Connecticut did it. Texas did it. And now Alabama is doing it, with its own particular flavor of enforcement and exemptions baked in.

The law targets companies that collect data on at least 35,000 Alabama consumers annually, or those collecting data on 10,000 consumers while deriving more than 25% of revenue from selling that data. That’s a targeted threshold — it’s not meant to catch your local barbershop’s email list. It’s aimed squarely at data brokers, ad-tech platforms, and the kind of faceless companies that know more about your spending habits than your own family does.

What the Law Actually Does

Consumers get a bundle of rights. Access. Correction. Deletion. Portability. The right to opt out of targeted advertising and profiling that produces legal or similarly significant effects. That last part is important — it’s not just about ads. It’s about automated systems making decisions about you. Credit. Insurance. Employment. These algorithms have been operating in the dark for years. Laws like this force a light on.

Controllers — that’s the legal term for companies handling your data — have 45 days to respond to consumer requests. They can extend that by another 45 days if needed. Processors, meaning third-party vendors handling data on behalf of controllers, are also pulled into compliance requirements. No more hiding behind subcontractors.

Sensitive data gets extra protection. We’re talking about biometric data, health information, precise geolocation, racial or ethnic origin, and data about children. That children’s data provision is particularly relevant given the ongoing global debate — the EU’s child safety regulatory push recently stalled as the ePrivacy derogation expired, age verification apps got hacked, and the CSA Regulation remains stuck in trilogue. Nobody has this fully figured out yet, but Alabama is at least trying to draw a hard line.

The Enforcement Gap

Here’s where it gets complicated. The Alabama Attorney General has exclusive enforcement authority. There is no private right of action. That means if a company violates your privacy rights under this law, you can’t sue them yourself. You have to hope the AG’s office takes notice, prioritizes your complaint, and has the resources to act.

That’s a significant limitation. And it’s a pattern. Most U.S. state privacy laws deliberately cut out private litigation because businesses lobbied hard to keep consumers out of courtrooms. The result is an enforcement model that depends entirely on political will and government bandwidth — two things that are never guaranteed.

Companies get a 30-day cure period before the AG can bring formal action. Which means the first time you get caught, you essentially get a warning. Try that with a speeding ticket.

The Hot Take

The United States desperately needs a federal privacy law, and the fact that we now have over 20 different state privacy frameworks is not a sign of democracy working — it’s a sign of Congress failing spectacularly at its job. Alabama’s law is well-intentioned. But companies now have to maintain compliance across a quilt of overlapping, slightly-different state laws with different thresholds, different definitions, and different enforcement mechanisms. The winners in this system aren’t consumers. They’re big tech companies with armies of lawyers who can afford to navigate this complexity, and privacy consultants charging $500 an hour to explain what “sensitive data” means in each jurisdiction. Small businesses get crushed. Consumers get a patchwork of protections that depends entirely on which state their ZIP code falls in. That’s not privacy. That’s bureaucracy cosplaying as protection.

Why This Fits a Bigger Picture

Data is currency. It’s geopolitical leverage. China is already sharpening its economic weapons ahead of Trump’s visit amid a trade truce with the US, and data flows between nations sit right at the center of that tension. Meanwhile, the music industry is watching Deezer report that 44% of new music uploads are AI-generated and most streams are fraudulent — another industry where data manipulation and opacity are eating the business alive. The thread connecting all of it is the same: when data moves without accountability, someone always gets exploited.

Alabama’s law isn’t perfect. No state law is. But it’s another brick in the wall that companies have been pretending doesn’t exist. The data economy built its empire on the assumption that consumers were passive, uninformed, and powerless. State by state, that assumption is getting tested. The companies that treat this as a compliance checkbox will get caught eventually. The ones that actually build privacy into their products from the start will be the ones still standing when federal regulation finally, inevitably, arrives.

Watch the Breakdown