HB216 Alabama 2021 Session

Summary

Primary Sponsor

Craig LipscombRepresentative

Republican

Co-Sponsors

Mike BallRussell BedsoleChip BrownWill DismukesTracy EstesTommy HanesGil IsbellWes KitchensRhett MarquesParker MooreEd OliverPhillip PettusRex ReynoldsProncey RobertsonMatt SimpsonScott StadthagenShane Stringer

Session

Regular Session 2021

Title

Consumer Protection, Alabama Consumer Privacy Act, created, allow consumers to opt in or out to sale of personal information with certain conditions, require business collecting data to make certain disclosures, violation or deletion of, Deceptive Trade Practices Act

Summary

HB216 would create the Alabama Consumer Privacy Act to give residents more control over their personal information and set rules for how businesses handle it.

What This Bill Does

It gives Alabama residents the right to know what personal data a business collects, where it comes from, why it is used or sold, and who it is shared with, and to request deletion of their data. It also lets residents opt out of the sale of their information and requires protections against discrimination for exercising these rights. The act authorizes enforcement by the Attorney General and provides a private right of action for certain unauthorized access or exfiltration of nonencrypted or nonredacted personal information, with implementing rules to be set by the AG.

Who It Affects

• Alabama residents (consumers) who would gain new rights to access, delete, and opt out of sale of their personal information and protections against retaliation for exercising these rights.
• Businesses that collect, sell, or disclose Alabama residents' personal information, who would must disclose data practices, respond to requests, implement opt-out mechanisms, and potentially face enforcement and damages for noncompliance.

Key Provisions

• Creates the Alabama Consumer Privacy Act to regulate the collection, use, sale, and disclosure of personal information of Alabama residents.
• Empowers consumers to request disclosure of categories and specific pieces of their personal information, data sources, purposes, and third parties with whom information is shared; and to request deletion.
• Allows consumers to opt out of the sale of their information and prohibits discrimination against those who exercise privacy rights; permits certain financial incentives for data collection with proper notice.
• Prohibits selling the personal information of consumers under 18 without affirmative parental authorization and sets conditions for handling such data.
• Requires businesses to provide at least two designated methods for submitting requests, respond free of charge within 45 days (extendable by 45 days with notice), and deliver information in a readable format.
• Establishes a private right of action for unauthorized access or exfiltration of nonencrypted/nonredacted personal information and imposes enforcement by the Attorney General under the Deceptive Trade Practices Act.
• Authorizes the Attorney General to adopt implementing rules; defines key terms (e.g., personal information, consumer, data categories, service provider, third party).
• Includes exemptions related to other federal/state laws (e.g., HIPAA/GLBA/FERPA, consumer reporting, Gramm-Leach-Bliley Act, and driver’s privacy laws) and prevailing local-law considerations; sets effective dates (Section 14 immediate; rest October 1, 2022).
• Announces that the bill is exempt from Amendment 621 local-funding expenditure rules, under the Constitution of Alabama, due to its classification as creating a new crime or amending a crime.

AI-generated summary using openai/gpt-5-nano on Feb 22, 2026. May contain errors — refer to the official bill text for accuracy.

Subjects

Consumers and Consumer Protection