Compliance Radar · Privacy and consent
Alabama enacts a personal data protection law effective May 2027
Alabama's privacy law takes effect May 1, 2027.
- Status
- Enacted; not yet in effect
- Takes effect
- May 1, 2027
- Announced
- Apr 16, 2026 (HB 351 signed)
- Type
- law
What changed
Consumers get standard rights, teens 13 to 15 need consent for targeted ads or sales, and a browser signal wins over conflicting settings. A permanent 45-day cure period applies; fines reach $15,000.
Who it affects
Businesses with data of 25,000+ consumers or 25%+ of revenue from data sales. Firms under 500 employees are exempt unless they sell data.
What to do
- Count Alabama consumers and check the employee exemptions.
- Treat GPC as controlling over conflicting settings.
- Add Alabama to rights-request workflows before May 1, 2027.
What ComplyMo already handles
Page audits and daily re-checks: Growth and up. Everything else: every plan, from $19 a month.
Sources
- Future of Privacy Forum: Alabama law (opens in a new tab)
- DLA Piper: Alabama is the 21st state (opens in a new tab)
Summary of public sources, not legal advice.