Alabama Personal Data Protection Act (HB 351), sensitive data and biometric consent

Ala. HB 351, 2026 Regular Session, Sec. 7(b)(2), Sec. 2(3), Sec. 2(21)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force in 220 days, effective 1 May 2027.

A sensitive categories rule binding private bodies.

As of 27 August 2026.

What it requires

This duty does not yet bind. APDPA's effective date is May 1, 2027.
Once effective, obtain an Alabama consumer's consent before processing sensitive data, including genetic or biometric data processed to uniquely identify the individual, racial or ethnic origin, religious belief, a health diagnosis, sexual orientation, citizenship or immigration status, or precise geolocation.
Do not treat a raw photograph, or an audio or video recording, as biometric data under this Act on its own. Data generated from a photograph or recording becomes biometric data once it is used to identify a specific individual; the exclusion does not survive that use.

What it reaches

Excludes recording-derived identifiersNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Once in force, APDPA will require a controller to obtain an Alabama consumer's consent before processing sensitive data, defined to include racial or ethnic origin, religious belief, a mental or physical health diagnosis, sex life or sexual orientation, citizenship or immigration status, precise geolocation, a known child's personal data, and the processing of genetic or biometric data for the purpose of uniquely identifying an individual.

'Biometric data' means data generated by automatic measurements of biological characteristics, such as a fingerprint, voiceprint, retina, or iris, used to identify a specific individual, and the definition expressly excludes a digital or physical photograph and an audio or video recording, but claws that exclusion back for any data generated from a photograph or recording once that data is used to identify a specific individual.

When LexLint raises it

processes_biometrics
processes_voice
crawls_web
trains_models

Read the law

enrolled bill text, Alabama Legislative Information System (ALISON)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app