{
 "jurisdiction_id": "US-AL",
 "jurisdiction": "United States – Alabama",
 "url": "https://dataprotection.gi/jurisdictions/united-states-alabama/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-05",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 25,
  "sub_modules": 57,
  "source_register": 9
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "amber",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alabama/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "A comprehensive framework exists on paper (HB 351) but is not yet legally operative; current in-force coverage is limited to breach notification and sectoral rules.",
   "claims": [
    {
     "statement": "The Alabama Attorney General has authority to issue penalties for violations of the Alabama Data Breach Notification Act of 2018.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance (reporting AG announcement)",
     "source_url": "https://www.dataguidance.com/news/alabama-governor-signs-data-breach-notification-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Alabama Personal Data Protection Act grants residents various data rights and sets obligations for data controllers and processors, with enforcement by the Attorney General.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alabama",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Governor Kay Ivey signed the Alabama Data Breach Notification Act of 2018, following passage by the Alabama House and Senate (SB 318).",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance (reporting AG announcement)",
     "source_url": "https://www.dataguidance.com/news/alabama-governor-signs-data-breach-notification-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Governor Kay Ivey signed House Bill 351, the Alabama Personal Data Protection Act, into law on 16 April 2026; the law takes effect 1 May 2027.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://prod.iapp.org/news/a/alabama-enacts-comprehensive-privacy-bill/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Alabama Personal Data Protection Act generally applies to businesses that control or process the data of more than 25,000 Alabama residents, or that derive 25% of their revenue from data sales involving any number of data subjects.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://prod.iapp.org/news/a/alabama-enacts-comprehensive-privacy-bill/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Alabama Personal Data Protection Act exempts small businesses with fewer than 500 employees and nonprofits with fewer than 100 employees, unless they sell personal data, and also exempts defined political organizations.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/alabama-set-to-add-variation-to-us-state-privacy-patchwork",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "red",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alabama/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "No in-force lawful-basis regime exists; the incoming PDPA's granular consent/special-category text could not be confirmed from available secondary sources.",
   "claims": [
    {
     "statement": "House Bill 263 introduces consumer protections for biological and neural data, requiring consent for data transfer and prohibiting marketing based on such data.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alabama",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Alabama Personal Data Protection Act's children's privacy provisions follow the Children's Online Privacy Protection Act definition of a child, and the bill's definition of minors for PDPA purposes covers children under age 13.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/alabama-set-to-add-variation-to-us-state-privacy-patchwork",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "amber",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alabama/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "A rights regime is legislated but not yet effective, and its granular contours are not independently confirmed in the sources gathered.",
   "claims": [
    {
     "statement": "The Alabama Personal Data Protection Act grants Alabama residents various consumer data rights, enforceable exclusively by the Attorney General.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alabama",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alabama/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "Breach-notification duties are well-evidenced and in force; DPIA/DPO/ROPA/retention duties under the incoming PDPA remain unconfirmed.",
   "claims": [
    {
     "statement": "Under the Insurance Data Security Law, insurance licensees are required to protect personal information and to investigate and respond to breaches of security.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alabama",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Alabama Data Breach Notification Act of 2018 requires entities to notify Alabama residents of a breach within 45 days of its discovery, and to notify the Attorney General within 45 days if the breach affects more than 1,000 individuals, as well as all nationwide consumer reporting agencies; third-party agents must notify the covered entity within ten days of discovering a breach.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance (reporting AG announcement)",
     "source_url": "https://www.dataguidance.com/news/alabama-governor-signs-data-breach-notification-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Under the Insurance Data Security Law, insurance licensees must notify the Alabama Department of Insurance within three business days of determining that a security breach has occurred.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alabama",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "red",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alabama/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "No comprehensive cross-border transfer regime exists at the Alabama state level; this is an explicit and legitimate gap finding rather than a silent omission.",
   "claims": [
    {
     "statement": "Alabama has no comprehensive privacy law establishing a cross-border data-transfer mechanism; general U.S. federal frameworks apply instead of a state-specific regime.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alabama",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "amber",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alabama/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "Insurance overlay is well-evidenced and in force; health, financial, telecoms, employment, credit-scoring and education overlays are only generically referenced without confirmed Alabama-specific statutory text.",
   "claims": [
    {
     "statement": "There are other Alabama statutes that regulate patient and medical records, financial information, and telemarketing and telephone communications.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alabama",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "amber",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alabama/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "Only the PDPA's sale-threshold provision is confirmed as enacted (not yet effective); dark-pattern and marketing-restriction bills have uncertain enactment status.",
   "claims": [
    {
     "statement": "Alabama's House Bill 283 empowers consumers to control their personal data and addresses manipulative user interfaces.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alabama",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Alabama Personal Data Protection Act's sale-related applicability threshold is unique in applying when any number of individuals' data is sold in combination with the 25%-of-revenue test, unlike most other states which pair the 25% revenue test with a 25,000-individual threshold.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/alabama-set-to-add-variation-to-us-state-privacy-patchwork",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "amber",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alabama/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "Several AI-specific bills are documented but enactment status and full scope are only partially confirmed; core ADM/profiling/biometric rights are unconfirmed.",
   "claims": [
    {
     "statement": "Senate Bill 129 mandates transparency for AI-generated content in Alabama, requiring clear disclosures and metadata marking, with enforcement starting 1 October 2026.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alabama",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "House Bill 324 mandates age verification, emergency protocols, and data-collection limits for AI chatbots, with enforcement by the Attorney General of Alabama; House Bill 325 regulates AI chatbot use, requiring consumer notification and establishing penalties for violations.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alabama",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "amber",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alabama/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "Multiple children's-privacy instruments are documented, but a material date conflict (HB 161 effective date) and uncertain enactment status of related bills prevent a green rating.",
   "claims": [
    {
     "statement": "Alabama's App Store Accountability Act (House Bill 161) mandates age verification for minors using app stores; secondary sources report conflicting effective dates of 1 October 2026 and 1 January 2027, which remains unresolved.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alabama",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Alabama's App Store Accountability Act, which requires verifiable parental consent in addition to age verification, applies to minors under age 18.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/alabama-set-to-add-variation-to-us-state-privacy-patchwork",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "green",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-alabama/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "Enforcement powers and penalty structures are clearly documented and the AG has a track record of active, recent enforcement (multistate settlements) even absent a comprehensive law currently in force.",
   "claims": [
    {
     "statement": "Covered entities or third-party agents who knowingly violate the Alabama Data Breach Notification Act's notification provisions can be subject to a penalty not exceeding $500,000 per breach, and covered entities can be liable for a civil penalty of not more than $5,000 per day for each consecutive day of continued non-compliance.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance (reporting AG announcement)",
     "source_url": "https://www.dataguidance.com/news/alabama-governor-signs-data-breach-notification-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Alabama Personal Data Protection Act includes a non-sunsetting 45-day cure provision together with exclusive Attorney General enforcement.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/alabama-set-to-add-variation-to-us-state-privacy-patchwork",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Alabama reached a $12.2 million settlement with Roblox Corporation to enhance child-safety measures on the platform.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alabama",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "A coalition of 42 attorneys general, including Alabama, reached a settlement with 23andMe's bankruptcy trustee over a 2023 data breach affecting 6.9 million customers.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/alabama",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Alabama Personal Data Protection Act's exclusive Attorney General enforcement model, combined with its 45-day cure provision, indicates the statute does not create a private right of action for consumers.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/alabama-set-to-add-variation-to-us-state-privacy-patchwork",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  }
 ]
}