Alabama Personal Data Protection Act (APDPA) Reference Guide

Section 3 of enrolled HB 351 addresses persons doing business in Alabama or producing products or services targeted to residents that either control or process personal data of more than 25,000 consumers, excluding data handled solely to complete payment transactions, or derive more than 25% of gross revenue from personal-data sales. The sale-revenue route says regardless of the number of consumers. Alabama Legislature: enrolled HB 351

Section 4 includes detailed entity and information exclusions, including specified small businesses that do not sell data and certain smaller nonprofits that do not sell data. The coverage result depends on business model, employee and sale facts as well as data flows; a site scan cannot resolve the exemption analysis. Alabama Legislature: enrolled HB 351

The enrolled act gives eligible Alabama consumers rights to access, correct, delete and obtain eligible data and to opt out of certain uses including targeted advertising and sale. The request provisions describe a 45-day initial response, an available extension under stated conditions and limits on how an opt-out may be denied. Alabama Legislature: enrolled HB 351

A covered controller will need a notice, intake method and vendor process that carry the customer’s decision beyond the website interface. For data obtained from sources other than the consumer, the enrolled deletion section identifies specific ways to comply; legal counsel should evaluate those options instead of treating every request as an identical database operation. Alabama Legislature: enrolled HB 351

Section 6(b) of the enrolled bill requires a clear and conspicuous link on the controller’s website to a page enabling direct opt-out of targeted advertising or sale, or up-to-date contact information to submit the opt-out request. Product teams should choose a usable path and make it discoverable before the effective date. Alabama Legislature: enrolled HB 351

Engineering should compare advertising pixels, storage, conversion APIs and server events before and after the submitted choice. Counsel must classify whether a vendor transfer meets the act’s sale or targeted-advertising definitions; the presence of a tag alone is not a legal conclusion. Alabama Legislature: enrolled HB 351

The enrolled § 6(c) discusses an opt-out preference signal sent in accordance with the section and a conflict with a controller-specific privacy setting or voluntary loyalty program. In that case the controller must comply with the signal but may notify the consumer and offer confirmation of the other setting or program. The text should be read with § 6(b)’s direct-request route and any later implementation guidance. Alabama Legislature: enrolled HB 351

Test the direct website link or contact path and a signal scenario separately, preserving the exact preference state and downstream response. A scanner cannot decide whether a particular implementation satisfies every statutory condition, and no current APDPA obligation may be described as violated before May 2027. Alabama Legislature: enrolled HB 351

Section 12 makes the enacted APDPA effective May 1, 2027. Under § 11, the Attorney General issues a violation notice before an action; if the controller fails to correct it within 45 days, the Attorney General may seek an injunction and a court may assess a civil penalty of up to $15,000 per violation after the stated findings. Alabama Legislature: enrolled HB 351

Curing within the notice period also requires an express written statement that the alleged violation is corrected and will not recur. These are future statutory enforcement procedures, not a present 2026 finding or a substitute for preparing the controls before the law starts. Alabama Legislature: enrolled HB 351

Legal and finance teams should establish whether the organization exceeds the consumer threshold or the independent sale-revenue route, then check entity exceptions and the meaning of each vendor arrangement. Review privacy notices, rights intake and the direct opt-out page against the enrolled act. Alabama Legislature: enrolled HB 351

Run a baseline website scan for rejected consent and GPC, submit the direct opt-out in a separate test, and inventory client and server traffic. Repair controls according to counsel’s classification, keep a dated record and retest before May 1, 2027. Consider other currently applicable laws separately. Alabama Legislature: enrolled HB 351

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, privacy notices, vendor contracts, rights-request procedures, sensitive-data obligations, and organizational governance should be handled by qualified privacy counsel.

This page relies on the Alabama Legislature’s final enrolled HB 351, particularly §§ 3–6 and 11–12. Its provisions are described prospectively, and the independent revenue route is kept distinct from the consumer-count threshold.

Prepared by Etalon Editorial Team. Last reviewed September 28, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for coverage, exclusions, classifications, notices, requests, sensitive data, children, contracts, assessments and governance. The APDPA is enacted but its obligations are not yet in force; a present scan cannot establish a violation of this future-effective law.