House Bill 263 Alabama 2026 Session

Summary

Primary Sponsor

Ben RobbinsRepresentative

Republican

Session

2026 Regular Session

Title

Biological and neural data of individuals; certain disclosures, transfers, and use by a health and fitness app prohibited without express consent, Attorney General authorized to enforce, civil penalties provided

Summary

HB263 would protect Alabama residents' biological and neural data by requiring express consent for any transfer, disclosure, or use by health and fitness apps, with enforcement and penalties for violations.

What This Bill Does

The bill prohibits covered entities from transferring, disclosing, or using a consumer's biological or neural data without express consent. Consent must be written or electronic and include a clear notice, and the entity may not market to the consumer based on this data. The Attorney General would enforce the law, with a notice-and-cure process and potential civil penalties up to $3,000 per violation; there are specified exemptions and the law takes effect on October 1, 2026.

Who It Affects

• Alabama residents who use health and fitness apps would have protections for their biological and neural data and must give express consent for transfers, disclosures, or uses beyond the allowed purposes.
• Covered entities (owners/operators of health and fitness apps) would need to obtain express consent, limit data handling to approved purposes, and could face civil penalties enforced by the Attorney General for violations.

Key Provisions

• Prohibits transfer, disclosure, or use of a consumer's biological or neural data by a covered entity without express consent.
• Express consent must be written or electronic with a clear, meaningful, and prominent notice.
• Prohibits marketing to consumers based on the data and limits use to what is necessary to provide services.
• If transfer/disclosure/use is for purposes beyond those allowed, the entity must notify the consumer before transfer and offer the ability to limit or prevent.
• Enforcement: the Attorney General has exclusive authority, issues a notice of violation, a 45-day cure period, and may impose up to $3,000 civil penalty per violation; corrected violations with a written statement can stop action.
• Exemptions include law enforcement, subpoenas or court orders, HIPAA-style handling, de-identified data, noncommercial higher education, certain insurance data, data used to provide products/services or fulfill contracts, security and internal operations, product recalls, and related activities; effective date is October 1, 2026.

AI-generated summary using openai/gpt-5-nano-2025-08-07 on Mar 11, 2026. May contain errors — refer to the official bill text for accuracy.

Subjects

Consumer Protection