HB283 Alabama 2025 Session

Summary

Primary Sponsor

Mike ShawRepresentative

Republican

Session

2025 Regular Session

Title

Data privacy, processing of data regulated, consumer actions related to data authorized

Summary

Alabama's Personal Data Protection Act would give residents control over their personal data and regulate how companies process and share it.

What This Bill Does

Residents would have rights to confirm whether a controller is processing their data, access and correct it, delete it, obtain a copy, and opt out of certain processing like targeted advertising, sale, or profiling. Controllers must provide a secure way to exercise these rights and an appeals process, and consumers can designate authorized agents to act on their behalf. The act applies to entities doing business in Alabama or targeting Alabama residents, with exemptions for certain sectors, and it sets data security and deidentified data rules; enforcement would be by the Alabama Attorney General with fines for violations and no private right of action; the law takes effect July 1, 2026 (with opt-out signal provisions by 2027).

Who It Affects

• Alabama residents who are consumers, who would gain rights to access, correct, delete, copy, and opt out of the processing of their personal data, with a secure method to exercise these rights.
• Controllers and processors (businesses and organizations) that process Alabama residents' personal data, who must implement rights management, provide notices, restrict certain processing, implement security measures, and may face enforcement actions by the Attorney General.

Key Provisions

• Grants consumers rights to confirm processing, access, correct inaccuracies, delete data, obtain a copy, and opt out of targeted advertising, sale of data, or profiling.
• Requires controllers to provide a secure, reliable method to exercise rights and an appeals process; allows designation of an authorized agent to exercise rights.
• Regulates processing of personal data and deidentified data, including how data may be processed, shared, or kept; defines key terms and sets requirements for notices and protections.
• Sets exemptions and applicability thresholds ( Alabama businesses that process data for more than 50,000 residents, or more than 25,000 residents with more than 25% of gross revenue from selling data; excludes certain sectors like political subdivisions, higher education, regulated financial institutions, HIPAA data, etc.).
• Imposes data minimization, security practices, consent revocation mechanics, and restrictions on processing sensitive data; requires privacy notices describing data categories, purposes, and sharing.
• Enforcement by the Attorney General with a notice of violation, cure period, and fines up to $10,000 per violation; no private right of action; effective July 1, 2026, with opt-out signal requirements by 2027.

AI-generated summary using openai/gpt-5-nano on Feb 22, 2026. May contain errors — refer to the official bill text for accuracy.

Subjects

Consumer Protection