Law / United States / 
Alabama
Alabama Personal Data Protection Act (HB 351), consumer rights
Ala. HB 351, 2026 Regular Session, Secs. 5-6
A data subject rights rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Give an Alabama consumer a means to confirm processing, access, correct, delete, and receive a portable copy of their personal data, free of charge once every 12 months.
- Offer an Alabama consumer an opt-out of targeted advertising, the sale of personal data, and profiling in furtherance of a solely automated decision with a significant effect.
- Respond to a consumer rights request within 45 days of receipt, with one 45-day extension available when reasonably necessary. This Act has no separate appeal-of-refusal mechanism.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Must a controller honor an opt-out preference signal that a consumer's browser or device sends, given that Section 6(c)(1) of the Alabama Personal Data Protection Act refers to a signal "sent in accordance with this section" but no provision of the Act describes or requires one?
What it makes you log
Who may demand the log
Regulator
Logging duty
A controller may deny an opt-out request only on a good faith, reasonable and documented belief that the request is fraudulent or not authorized, which cannot be shown without a written record of the belief, and on inquiry by an enforcement authority the controller must carry the burden of showing that a request it refused or charged for met one of the listed grounds. The text names no field of the record, sets no retention period and sets no audit schedule. Section 5(d)(5)(a) treats a controller as compliant with a deletion request if it kept a record of the request and the minimum data needed to keep the data deleted, which is an option and not a duty. The scope clause in section 3 is not cited, so no territorial hook is taken from it.
- Kind
- Implicit
- As of
- Provision
- HB 351 section 5(d)(4) (a documented belief that an opt-out request is fraudulent) and section 5(d)(3) (the controller's burden, on inquiry by an enforcement authority, of showing that a request was manifestly unfounded, excessive, technically infeasible or repetitive)
- Trigger
- consent_or_optout
What this law does
APDPA gives an Alabama consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling in furtherance of a solely automated decision with a legal or similarly significant effect.
A controller must respond within 45 days of receipt, with one 45-day extension available when reasonably necessary, free of charge once per 12-month period; a controller may charge a reasonable fee or decline a manifestly unfounded, excessive, technically infeasible, or repetitive request, with the burden on the controller to show that. The Act provides no separate appeal-of-refusal mechanism.
A parent or guardian may exercise a known child's rights, and a guardian or conservator may exercise an incapacitated consumer's rights.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .