Alabama

The Alabama Child Protection Act of 2024 amended Alabama Code sections 13A-12-190, 13A-12-191, 13A-12-192, 13A-12-193, 13A-12-194, 13A-12-196, 13A-12-197, and 13A-12-198, and repealed section 13A-12-195, so that the definition of child sexual abuse material expressly includes a virtually indistinguishable depiction created, altered, or produced by digital, computer generated, or other means.

A person who knowingly disseminates or publicly displays child sexual abuse material is guilty of a Class B felony, as is a person who knowingly advertises, promotes, presents, distributes, or solicits by any means material that reflects, or is intended to cause another to believe, depicts an actual individual under 18 engaged in sexually explicit conduct.

A person who knowingly possesses child sexual abuse material with intent to disseminate it is guilty of a Class B felony, and simple possession is a Class C felony. A parent or guardian who knowingly permits or allows a child, ward, or dependent under 18 to be used in producing child sexual abuse material is guilty of a Class A felony, as is a person who knowingly produces the material.

An individual who commits any of these offenses, or the related private-image offense at section 13A-6-240, is civilly liable to the individual depicted, with actual damages, costs and attorney fees, and punitive damages available on clear and convincing evidence of wantonness or malice.

No civil action may be brought for actions taken to prevent, detect, protect against, report, or respond to the production, generation, incorporation, or synthesization of child sexual abuse material through artificial intelligence. The amendments took effect October 1, 2024.

A health benefit plan provider that uses artificial intelligence to determine medical necessity for a request for prior authorization must base the determination on the enrollee's own medical history, the clinical circumstances the treating health care provider presents, and other clinical information in the enrollee's medical record.

The provider must certify annually to the Alabama Department of Insurance that the artificial intelligence does not rely on a group dataset, is applied fairly and equitably consistent with applicable federal guidance, and does not discriminate against any subscriber group or enrollee.

A determination to deny, delay, or modify a prior-authorization request based on medical necessity must always be made by a licensed physician or other health care professional competent to evaluate the artificial intelligence's recommendation in light of the enrollee's own clinical circumstances.

The provider must make prominent written disclosure of its use of artificial intelligence in utilization review in its policies and procedures, periodically review the outcomes for accuracy, and keep patient data used in that review within its intended purpose under Health Insurance Portability and Accountability Act (HIPAA).

The Department of Insurance may investigate an alleged violation and order corrective changes to the provider's procedures, and for a violation occurring with the frequency of a general business pattern or practice, may impose an administrative fine of up to $5,000 or suspend or revoke the provider's certificate of authority. This act becomes effective October 1, 2026.

A person may not knowingly distribute, or agree with another to distribute, materially deceptive media, defined as an image, audio, or video produced by artificial intelligence that falsely depicts a candidate engaging in speech or conduct that did not occur, within 90 days of an election, where the distribution intends to harm the candidate's reputation or electoral prospects or to change how electors vote.

The duty is a disclosure one: a distributor avoids the prohibition entirely by including a specified clear and conspicuous disclaimer that the media has been manipulated by technical means, with format-specific rules for video, audio, and still images. A violation is a Class A misdemeanor, rising to a Class D felony on a second or subsequent conviction within five years.

The Attorney General, the depicted individual, an injured or threatened candidate, or an entity representing voters may also seek permanent injunctive relief, with fee-shifting against a frivolous complaint. The codified section attributes the enactment to Act 2024-349, sections 1 to 3, which is the citation used here.

The Alabama Data Breach Notification Act of 2018 requires certain entities that experience a data breach to notify the Alabama Attorney General when the breach results in unauthorized acquisition of sensitive personally identifying information and is reasonably likely to cause substantial harm to the affected individuals.

The codified text of Ala. Code section 8-38-1 et seq. is not verified directly: Justia serves a Cloudflare CAPTCHA challenge on every attempt, and FindLaw's Alabama coverage does not carry Title 8, Chapter 38.

The Act's specific notification deadline, civil penalty amount, and private-right-of-action posture are therefore not stated here as verified findings; secondary commentary describes a civil penalty of up to $5,000 per day capped at $500,000 per breach and no private right of action, but that has not been confirmed against the codified text.

APDPA will govern private-sector processing of Alabama consumers' personal data once it takes effect on May 1, 2027. It applies to a person conducting business in Alabama, or targeting products or services to Alabama residents, who controls or processes personal data of 25,000 or more Alabama consumers, excluding payment-transaction-only data, or derives more than 25% of gross revenue from selling personal data.

Broad entity- and data-level exemptions apply, including government bodies, higher-education institutions, Gramm-Leach-Bliley Act (GLBA)- and Health Insurance Portability and Accountability Act (HIPAA)-regulated entities, small nonprofits and businesses under the applicability threshold, political committees, and employment or business-to-business data. 'Personal data' excludes deidentified data and publicly available information.

Once in force, APDPA will give an Alabama consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling in furtherance of a solely automated decision with a legal or similarly significant effect.

A controller must respond within 45 days of receipt, with one 45-day extension available when reasonably necessary, free of charge once per 12-month period; a controller may charge a reasonable fee or decline a manifestly unfounded, excessive, technically infeasible, or repetitive request, with the burden on the controller to show that. The Act provides no separate appeal-of-refusal mechanism.

A parent or guardian may exercise a known child's rights, and a guardian or conservator may exercise an incapacitated consumer's rights.

Once in force, the Alabama Attorney General will have exclusive authority to enforce APDPA. Before any enforcement action, the Attorney General must issue a written notice of violation to the controller; if the controller corrects the violation within 45 days and provides a written statement confirming the cure and that no further violations will occur, no action may be initiated. An uncured violation is subject to a court-assessed civil penalty of not more than $15,000 per violation. The Act creates no private right of action.

Once in force, APDPA will require a controller to obtain an Alabama consumer's consent before processing sensitive data, defined to include racial or ethnic origin, religious belief, a mental or physical health diagnosis, sex life or sexual orientation, citizenship or immigration status, precise geolocation, a known child's personal data, and the processing of genetic or biometric data for the purpose of uniquely identifying an individual.

'Biometric data' means data generated by automatic measurements of biological characteristics, such as a fingerprint, voiceprint, retina, or iris, used to identify a specific individual, and the definition expressly excludes a digital or physical photograph and an audio or video recording, but claws that exclusion back for any data generated from a photograph or recording once that data is used to identify a specific individual.

A person who acts without authority or who exceeds authorization of use commits computer tampering by knowingly doing one of eight things: accessing and altering, damaging, or destroying a computer, program, or network; altering, damaging, deleting, or destroying data; disclosing, using, controlling, or taking programs, data, or documentation; introducing a virus; disrupting or denying computer or network services; preventing a user from exiting a site or connection; obtaining confidential information or non-public records from a government or medical computer system; or giving out a password or other security credential without consent.

Exceeds authorization of use is separately defined as accessing a computer with actual or perceived authorization and then using that access to obtain or alter information the accessor is not entitled to obtain or alter.

The base offense is a Class A misdemeanor; it rises to a Class C felony where the actor intends an unlawful act, benefit, defraud, or harm; to a Class B felony where a victim's expenditure exceeds $2,500 or the intended interruption reaches a government or utility service, and separately where the violation touches Alabama Criminal Justice Information Center or Alabama Justice Information Commission data; and to a Class A felony where a victim's expenditure exceeds $100,000 or the violation causes physical injury to an uninvolved person.

This statute replaced the prior Alabama Computer Crime Act (1985), whose intellectual-property offense provision was repealed by the same 2012 Act.

Each covered entity and third-party agent must implement and maintain reasonable security measures to protect sensitive personally identifying information against a breach of security, including designating an employee to coordinate the measures, identifying internal and external risks, adopting and assessing safeguards, requiring service providers to maintain appropriate safeguards by contract, adjusting the measures for changed circumstances, and keeping management informed of their overall status.

A covered entity or third-party agent must separately take reasonable measures to dispose, or arrange for the disposal, of records containing sensitive personally identifying information within its custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable through any reasonable means consistent with industry standards.

"Covered entity" is defined to include a government entity as well as a private business. There is no private right of action for a violation of either duty, and the chapter's stated civil-penalty amounts apply only to a violation of the chapter's separate notification provisions, not to these two duties.

Requires commercial entities whose websites are more than one-third sexual material harmful to minors to use a reasonable age verification method to ensure visitors are 18 or older, without retaining identifying information after access is granted.

Requires app store providers to request and verify a user's age category (under 13, 13-15, 16-17, or 18 and older) at account creation, and to obtain verifiable parental consent before a minor may download an app or make purchases. Accounts existing before October 2, 2026 must be categorized and verified by October 1, 2027. Signed by Governor Kay Ivey on February 18, 2026 after passing both chambers unanimously.