Instruments
Each one links to its
LexLint note, which carries what it requires and what it flags on.
Adult content age verification (AV)
Requires commercial entities whose websites are more than one-third sexual material harmful to minors to use a reasonable age verification method to ensure visitors are 18 or older, without retaining identifying information after access is granted.
Note and primary source →
App store age verification (AV)
Requires app store providers to request and verify a user's age category (under 13, 13-15, 16-17, or 18 and older) at account creation, and to obtain verifiable parental consent before a minor may download an app or make purchases. Accounts existing before October 2, 2026 must be categorized and verified by October 1, 2027. Signed by Governor Kay Ivey on February 18, 2026 after passing both chambers unanimously.
Note and primary source →
Breach notification
The Alabama Data Breach Notification Act of 2018 requires certain entities that experience a data breach to notify the Alabama Attorney General when the breach results in unauthorized acquisition of sensitive personally identifying information and is reasonably likely to cause substantial harm to the affected individuals.
This document could not verify the codified text of Ala. Code section 8-38-1 et seq. directly: Justia served a Cloudflare CAPTCHA challenge on every attempt, and FindLaw's Alabama coverage does not carry Title 8, Chapter 38.
The Act's specific notification deadline, civil penalty amount, and private-right-of-action posture are therefore not coded as verified findings in this document; secondary commentary describes a civil penalty of up to $5,000 per day capped at $500,000 per breach and no private right of action, but that has not been confirmed against the codified text in this pass.
What it asks of an app →
Comprehensive regime
APDPA will govern private-sector processing of Alabama consumers' personal data once it takes effect on May 1, 2027. It applies to a person conducting business in Alabama, or targeting products or services to Alabama residents, who controls or processes personal data of 25,000 or more Alabama consumers, excluding payment-transaction-only data, or derives more than 25% of gross revenue from selling personal data.
Broad entity- and data-level exemptions apply, including government bodies, higher-education institutions, GLBA- and HIPAA-regulated entities, small nonprofits and businesses under the applicability threshold, political committees, and employment or business-to-business data. 'Personal data' excludes deidentified data and publicly available information.
What it asks of an app →
Data subject rights
Once in force, APDPA will give an Alabama consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling in furtherance of a solely automated decision with a legal or similarly significant effect.
A controller must respond within 45 days of receipt, with one 45-day extension available when reasonably necessary, free of charge once per 12-month period; a controller may charge a reasonable fee or decline a manifestly unfounded, excessive, technically infeasible, or repetitive request, with the burden on the controller to show that. The Act provides no separate appeal-of-refusal mechanism.
A parent or guardian may exercise a known child's rights, and a guardian or conservator may exercise an incapacitated consumer's rights.
What it asks of an app →
Enforcement supervision
Once in force, the Alabama Attorney General will have exclusive authority to enforce APDPA. Before any enforcement action, the Attorney General must issue a written notice of violation to the controller; if the controller corrects the violation within 45 days and provides a written statement confirming the cure and that no further violations will occur, no action may be initiated. An uncured violation is subject to a court-assessed civil penalty of not more than $15,000 per violation. The Act creates no private right of action.
What it asks of an app →
Sensitive categories
Once in force, APDPA will require a controller to obtain an Alabama consumer's consent before processing sensitive data, defined to include racial or ethnic origin, religious belief, a mental or physical health diagnosis, sex life or sexual orientation, citizenship or immigration status, precise geolocation, a known child's personal data, and the processing of genetic or biometric data for the purpose of uniquely identifying an individual.
'Biometric data' means data generated by automatic measurements of biological characteristics, such as a fingerprint, voiceprint, retina, or iris, used to identify a specific individual, and the definition expressly excludes a digital or physical photograph and an audio or video recording, but claws that exclusion back for any data generated from a photograph or recording once that data is used to identify a specific individual.
What it asks of an app →
