Law / United States / 
Alabama
Alabama Personal Data Protection Act (HB 351), sensitive data and biometric consent
Ala. HB 351, 2026 Regular Session, Sec. 7(b)(2), Sec. 2(3), Sec. 2(21)
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Obtain an Alabama consumer's consent before processing sensitive data, including genetic or biometric data processed to uniquely identify the individual, racial or ethnic origin, religious belief, a health diagnosis, sexual orientation, citizenship or immigration status, or precise geolocation.
- Do not treat a raw photograph, or an audio or video recording, as biometric data under this Act on its own. Data generated from a photograph or recording becomes biometric data once it is used to identify a specific individual; the exclusion does not survive that use.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Is a faceprint or voiceprint that a controller generates from a photograph or recording, and uses only to match or group records without naming a person, data that "is used to identify a specific individual" under Section 2(3)(c) of the Alabama Personal Data Protection Act?
What it makes you log
Logging duty
Section 7(b)(2) bars a controller from processing sensitive data, including biometric data used to identify an individual, without the consumer's consent (for a known child, without processing under the federal Children's Online Privacy Protection Act). Nothing in the cited provisions or in the definitions of biometric and sensitive data requires the controller to keep a record of the consent or to show it on demand. The scope clause in section 3 is not cited, so no territorial hook is taken from it.
- Kind
- None
- As of
What this law does
APDPA requires a controller to obtain an Alabama consumer's consent before processing sensitive data, defined to include racial or ethnic origin, religious belief, a mental or physical health diagnosis, sex life or sexual orientation, citizenship or immigration status, precise geolocation, a known child's personal data, and the processing of genetic or biometric data for the purpose of uniquely identifying an individual.
'Biometric data' means data generated by automatic measurements of biological characteristics, such as a fingerprint, voiceprint, retina, or iris, used to identify a specific individual, and the definition expressly excludes a digital or physical photograph and an audio or video recording, but claws that exclusion back for any data generated from a photograph or recording once that data is used to identify a specific individual.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .