Alabama

The Alabama Child Protection Act of 2024 amended Alabama Code sections 13A-12-190, 13A-12-191, 13A-12-192, 13A-12-193, 13A-12-194, 13A-12-196, 13A-12-197, and 13A-12-198, and repealed section 13A-12-195, so that the definition of child sexual abuse material expressly includes a virtually indistinguishable depiction created, altered, or produced by digital, computer generated, or other means.

A person who knowingly disseminates or publicly displays child sexual abuse material is guilty of a Class B felony, as is a person who knowingly advertises, promotes, presents, distributes, or solicits by any means material that reflects, or is intended to cause another to believe, depicts an actual individual under 18 engaged in sexually explicit conduct.

A person who knowingly possesses child sexual abuse material with intent to disseminate it is guilty of a Class B felony, and simple possession is a Class C felony. A parent or guardian who knowingly permits or allows a child, ward, or dependent under 18 to be used in producing child sexual abuse material is guilty of a Class A felony, as is a person who knowingly produces the material.

An individual who commits any of these offenses, or the related private-image offense at section 13A-6-240, is civilly liable to the individual depicted, with actual damages, costs and attorney fees, and punitive damages available on clear and convincing evidence of wantonness or malice.

No civil action may be brought for actions taken to prevent, detect, protect against, report, or respond to the production, generation, incorporation, or synthesization of child sexual abuse material through artificial intelligence. The amendments took effect October 1, 2024.

A person may not knowingly distribute, or agree with another to distribute, materially deceptive media, defined as an image, audio, or video produced by artificial intelligence that falsely depicts a candidate engaging in speech or conduct that did not occur, within 90 days of an election, where the distribution intends to harm the candidate's reputation or electoral prospects or to change how electors vote.

The duty is a disclosure one: a distributor avoids the prohibition entirely by including a specified clear and conspicuous disclaimer that the media has been manipulated by technical means, with format-specific rules for video, audio, and still images. A violation is a Class A misdemeanor, rising to a Class D felony on a second or subsequent conviction within five years.

The Attorney General, the depicted individual, an injured or threatened candidate, or an entity representing voters may also seek permanent injunctive relief, with fee-shifting against a frivolous complaint. The codified section attributes the enactment to Act 2024-349, sections 1 to 3, which is the citation used here.

The Alabama Data Breach Notification Act of 2018 binds every covered entity that acquires or uses sensitive personally identifying information, a term defined to include a government entity alongside a person, corporation or nonprofit. A covered entity that determines a breach of security has acquired sensitive personally identifying information, and is reasonably likely to cause substantial harm to the Alabama residents concerned, must notify each affected individual within 45 days.

Where more than 1,000 individuals must be notified, the entity must also give the Attorney General written notice within 45 days. The entity must also notify the nationwide consumer reporting agencies without unreasonable delay when it discovers circumstances requiring notice of more than 1,000 individuals at a single time. The Attorney General has exclusive authority to bring an action for civil penalties under the Act, and a violation does not establish a private cause of action.

A covered entity that violates the notification provisions is liable for a civil penalty of not more than $5,000 for each consecutive day it fails to take reasonable action to comply. Civil penalties assessed for a knowing violation of the notice requirements do not exceed $500,000 per breach. Government entities are subject to the notice requirements of the Act but exempt from any civil penalty it authorizes.

Section 13 of the Act provides that it becomes effective on the first day of the third month following its passage and approval by the Governor. No official record stating the day the Governor approved the Act, or the resulting day, has been located.

A licensee is a person licensed, authorized to operate, or registered, or required to be, under Alabama insurance law, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state.

Each licensee must notify the Commissioner of Insurance as promptly as possible, and in no event later than three business days from a determination that a cybersecurity event involving nonpublic information in its possession has occurred, when either of two statutory criteria is met.

Under section 27-62-6(a)(1), the notice duty applies where Alabama is the insurer's state of domicile or the producer's home state and the event has a reasonable likelihood of materially harming an Alabama consumer or a material part of the licensee's normal operation.

Under section 27-62-6(a)(2), the notice duty also applies where the licensee reasonably believes the nonpublic information involves 250 or more Alabama consumers and the event must be reported to a government body or supervisory body under other law or is reasonably likely to materially harm an Alabama consumer or a material part of its operation.

A licensee giving notice under section 27-62-6 must give the Commissioner, in electronic form as the Commissioner directs, as much as possible of a list of items that includes the date of the event, how the information was exposed, and the number of affected Alabama consumers. A licensee must also comply with the Alabama Data Breach Notification Act of 2018, as applicable, and give the Commissioner a copy of the notice sent to consumers under that law.

A licensee that becomes aware of an event in a system maintained by a third-party service provider must treat the event as its own unless the provider gives the Commissioner the notice. A licensee other than a producer that violates the Insurance Data Security Law may be subject to suspension or revocation of its license or certificate of authority or, in lieu of that, a fine of up to $10,000 per violation.

An insurance producer that violates the Insurance Data Security Law may be penalized in accordance with section 27-7-19. The Insurance Data Security Law may not be construed to create or imply a private cause of action for a violation, or to curtail a private cause of action that would otherwise exist.

The Insurance Data Security Law establishes the exclusive state standards applicable to licensees for data security, the investigation of a cybersecurity event, and notification to the Commissioner of Insurance of a cybersecurity event. The Commissioner of Insurance may examine and investigate the affairs of any licensee to determine whether the licensee has engaged in conduct that violates the Insurance Data Security Law.

A licensee must maintain records concerning all cybersecurity events for at least five years from the date of each event and must produce those records upon demand of the Commissioner of Insurance. Where a cybersecurity event has or may have occurred in a system maintained by a third-party service provider, the licensee must complete the investigation steps in subsection (b) or confirm and document that the provider has completed them.

A licensee is a person licensed, authorized to operate, or registered, or required to be, under Alabama insurance law, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state.

APDPA governs private-sector processing of Alabama consumers' personal data, with an effective date of May 1, 2027. It applies to a person conducting business in Alabama, or targeting products or services to Alabama residents, who controls or processes personal data of more than 25,000 Alabama consumers, excluding payment-transaction-only data, or derives more than 25% of gross revenue from selling personal data.

Broad entity- and data-level exemptions apply, including government bodies, higher-education institutions, Gramm-Leach-Bliley Act (GLBA)- and Health Insurance Portability and Accountability Act (HIPAA)-regulated entities, small nonprofits and businesses under the applicability threshold, political committees, and employment or business-to-business data. 'Personal data' excludes deidentified data and publicly available information.

APDPA requires the contract between a controller and a processor to require the processor to make available to the controller, on the controller's reasonable request, all information in the processor's possession necessary to demonstrate the processor's compliance with the obligations of the Act.

A controller that processes personal data under an exemption in section 10 bears the burden of demonstrating that the processing qualifies for the exemption and complies with the requirements of that section.

APDPA gives an Alabama consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling in furtherance of a solely automated decision with a legal or similarly significant effect.

A controller must respond within 45 days of receipt, with one 45-day extension available when reasonably necessary, free of charge once per 12-month period; a controller may charge a reasonable fee or decline a manifestly unfounded, excessive, technically infeasible, or repetitive request, with the burden on the controller to show that. The Act provides no separate appeal-of-refusal mechanism.

A parent or guardian may exercise a known child's rights, and a guardian or conservator may exercise an incapacitated consumer's rights.

The chapter protects a consumer, defined as a natural person residing in Alabama. A consumer may place a security freeze on the consumer's credit report by making a request in writing by certified mail to a consumer credit reporting agency. The agency must place the freeze no later than three business days after receiving the written request.

The agency must send the consumer written confirmation of the freeze, with a unique personal identification number or password other than the consumer's Social Security number, within 10 business days of placing it. While a freeze is in place, the agency may not release the consumer's credit report or credit score without the consumer's prior express authorization, subject to the exceptions the section lists.

The agency must lift a freeze temporarily within three business days of a written request and within 15 minutes of a qualifying telephone or electronic request received during normal business hours. The agency must remove a freeze within three business days of receiving the consumer's request for removal.

The agency may charge a fee of no more than $10 for each placement, permanent removal or temporary lifting of a freeze, and may not charge a person age 65 or over for placement or an identity theft victim who has submitted a qualifying law enforcement report. A person that violates the section may be fined not more than $100 for a violation concerning a specific consumer.

Whenever a consumer must receive the summary of rights that the federal Fair Credit Reporting Act requires, the consumer must also be given the statutory notice of the right to obtain a security freeze. The enrolled bill made the act effective on the first day of the third month following its passage and approval by the Governor.

Chapter 482-1-122 governs the treatment of nonpublic personal financial information about individuals by all licensees of the Alabama Department of Insurance. Chapter 482-1-122 applies to information about individuals who obtain or seek to obtain products or services primarily for personal, family or household purposes from licensees, and not to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes.

Chapter 482-1-122 applies to all insurers, producers, agents, brokers, service representatives, and other persons licensed or required to be licensed under the Alabama Insurance Code, other than under Chapter 32 of Title 8 (Service Contracts). A licensee must give a customer a clear and conspicuous notice that accurately reflects its privacy policies and practices not later than when it establishes the customer relationship.

A licensee must give a consumer such a notice before it discloses any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as authorized by sections 15 and 16 of Chapter 482-1-122. A licensee must give customers a clear and conspicuous notice of its privacy policies and practices at least once in any period of twelve consecutive months during which the customer relationship exists.

Each initial, annual and revised notice under Chapter 482-1-122 must state the categories of nonpublic personal financial information the licensee collects and the categories it discloses. A licensee may not, directly or through any affiliate, disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has given the initial notice and the opt out notice, has given the consumer a reasonable opportunity to opt out, and the consumer does not opt out.

A licensee may not disclose a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail, other than to a consumer reporting agency.

The opt out requirements of Chapter 482-1-122 do not apply when a licensee gives nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee, if the licensee gives the initial notice and has a contract that prohibits the third party from disclosing or using the information other than to carry out the purposes of the disclosure.

A licensee may not unfairly discriminate against a consumer or customer because that person has opted out of the disclosure of his or her nonpublic personal financial information. A licensee that violates Chapter 482-1-122 may be subject to suspension or revocation of its license or certificate of authority. Chapter 482-1-122 is effective October 1, 2001, and the time for compliance was extended until December 31, 2001.

Until July 1, 2002, a contract that a licensee entered into on or before July 1, 2001 with a nonaffiliated third party to perform services for the licensee satisfied section 14A(1)(b) of Chapter 482-1-122 even if the contract did not require the third party to maintain the confidentiality of nonpublic personal information.

The Alabama Attorney General may enforce violations of APDPA. Before any enforcement action, the Attorney General must issue a written notice of violation to the controller; if the controller corrects the violation within 45 days and provides a written statement confirming the cure and that no further violations will occur, no action may be initiated. An uncured violation is subject to a court-assessed civil penalty of not more than $15,000 per violation. The Act creates no private right of action.

A genetic testing company is any person, other than a health care provider, who directly solicits a biological sample from a consumer for analysis in order to provide products or services to the consumer. A consumer is any individual who is an Alabama resident. A genetic testing company must prominently display to a consumer, in plain language, complete information about its policies and procedures for the collection, use, maintenance and disclosure of genetic data.

A genetic testing company must obtain the consumer's initial express consent to use of the biological sample and resulting genetic data to provide the product or service the consumer ordered. A genetic testing company must obtain the consumer's express consent every time it transfers the sample or discloses the genetic data to a third party other than a contractor for a reason other than fulfilling an order, uses them for another purpose, or markets to the consumer based on the genetic data.

A genetic testing company must provide a process for the consumer to access the genetic data, delete the account, request destruction of the biological sample and genetic data, and revoke any consent given. A genetic testing company must comply with a destruction request as soon as reasonably possible and no more than 30 days after the request is made.

A genetic testing company may not disclose a consumer's genetic data to a health, life, disability or long-term care insurer, or to an employer or prospective employer of the consumer, without the consumer's express written consent.

Chapter 43 of Title 8 of the Code of Alabama does not apply to a covered entity or business associate as defined in the federal health privacy regulations, to noncommercial research and instruction by an institution of higher learning, or to samples and data lawfully obtained by law enforcement in a criminal investigation.

The Consumer Interest Division of the Office of the Attorney General may sue in circuit court to enjoin a violation or to recover a civil penalty of up to $3,000 for each violation. The Alabama Genetic Data Privacy Act took effect on October 1, 2024.

A provider under the Alabama Mental Health Consumers' Rights Act is any agency, corporation, or individual who provides inpatient, residential or outpatient mental health services to a consumer or consumers, and the Act applies to a physician only to the extent that medical services must be provided in accordance with established standards of medical care. A consumer under the Alabama Mental Health Consumers' Rights Act is a person who receives or uses mental health services.

Section 22-56-4(b)(6) gives a consumer of mental health services in an inpatient, residential or outpatient setting the right to confidentiality of all information in the consumer's mental health, medical and financial records.

Section 22-56-4(b)(7) gives a consumer of mental health services in an inpatient, residential or outpatient setting the right to access on request all information in the consumer's mental health, medical and financial records, unless a clinical determination has been made by professional staff that access would be detrimental to the consumer's health.

Section 22-56-4(b)(14) gives a consumer of mental health services in an inpatient, residential or outpatient setting the right to enforce rights in a court of competent jurisdiction or appropriate administrative proceeding. The Alabama Department of Mental Health must establish teams to monitor compliance with its certification standards by state facilities, community mental health centers, and providers under contract to the department.

The Alabama Mental Health Consumers' Rights Act does not reduce or expand the rights of mental health consumers in Alabama beyond the rights guaranteed to any other person under federal and Alabama law. No day on which the Act came into force has been located.

APDPA requires a controller to obtain an Alabama consumer's consent before processing sensitive data, defined to include racial or ethnic origin, religious belief, a mental or physical health diagnosis, sex life or sexual orientation, citizenship or immigration status, precise geolocation, a known child's personal data, and the processing of genetic or biometric data for the purpose of uniquely identifying an individual.

'Biometric data' means data generated by automatic measurements of biological characteristics, such as a fingerprint, voiceprint, retina, or iris, used to identify a specific individual, and the definition expressly excludes a digital or physical photograph and an audio or video recording, but claws that exclusion back for any data generated from a photograph or recording once that data is used to identify a specific individual.

Section 22-11A-22 makes all information, reports and medical records concerning persons infected with sexually transmitted diseases designated by the State Board of Health confidential, and not subject to public inspection or admission into evidence in any court except commitment proceedings brought under the article. Under section 22-11A-22, an individual's medical record may be released on the written consent of the patient.

Anyone violating section 22-11A-22 is guilty of a Class C misdemeanor. Section 22-11A-38(a) authorizes the State Committee of Public Health to establish the rules by which exceptions may be made to the confidentiality provisions of its article.

Section 22-11A-38(g) requires all persons who receive a notification of the contagious condition of an individual under that section to hold the information in the strictest confidence and privilege and to take only the actions necessary to protect health where there is a foreseeable, real or probable risk of transmission. Except as provided in section 22-11A-38, any information required under its article remains confidential.

Any person violating a provision of section 22-11A-38 or its approved guidelines is guilty of a Class C misdemeanor. No day on which the sections came into force has been located.

A health benefit plan is a health insurance policy, including a self-insured health plan, that covers hospital, medical or surgical expenses. A health benefit plan located or domiciled outside Alabama is subject to the chapter if it receives, processes, adjudicates, pays or denies claims for Alabama residents or for care received in Alabama.

A genetic test is a pre-symptomatic laboratory test, generally accepted in the scientific and medical communities, for determining the presence or absence of genetic characteristics that cause or are associated with risk of a disease or disorder. A health benefit plan may not require, as a condition of insurability, that a person take a genetic test to determine whether the person has a predisposition for cancer.

A health benefit plan may not use the results of a genetic test that may show a predisposition for cancer to determine insurability or to discriminate against the person in rates or benefits. Chapter 53 of Title 27 of the Code of Alabama applies to all programs administered by the Alabama Medicaid Agency.

The license of an insurance company or health maintenance organization is subject to suspension, revocation or another administrative penalty, within the discretion of the Commissioner of Insurance, for any violation of Chapter 53 of Title 27 of the Code of Alabama. No day on which the chapter came into force has been located.

A person who acts without authority or who exceeds authorization of use commits computer tampering by knowingly doing one of eight things: accessing and altering, damaging, or destroying a computer, program, or network; altering, damaging, deleting, or destroying data; disclosing, using, controlling, or taking programs, data, or documentation; introducing a virus; disrupting or denying computer or network services; preventing a user from exiting a site or connection; obtaining confidential information or non-public records from a government or medical computer system; or giving out a password or other security credential without consent.

Exceeds authorization of use is separately defined as accessing a computer with actual or perceived authorization and then using that access to obtain or alter information the accessor is not entitled to obtain or alter.

The base offense is a Class A misdemeanor; it rises to a Class C felony where the actor intends an unlawful act, benefit, defraud, or harm; to a Class B felony where a victim's expenditure exceeds $2,500 or the intended interruption reaches a government or utility service, and separately where the violation touches Alabama Criminal Justice Information Center or Alabama Justice Information Commission data; and to a Class A felony where a victim's expenditure exceeds $100,000 or the violation causes physical injury to an uninvolved person.

This statute replaced the prior Alabama Computer Crime Act (1985), whose intellectual-property offense provision was repealed by the same 2012 Act.

Section 27-62-4 requires each licensee to develop, implement, and maintain a comprehensive written information security program based on its risk assessment that contains administrative, technical, and physical safeguards for the protection of nonpublic information and its information system.

A licensee is any person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Alabama, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state. A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information.

A licensee must exercise due diligence in selecting a third-party service provider and require the provider to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information that the provider holds. Each insurer domiciled in Alabama must submit to the commissioner, annually on or before February 15, a written statement certifying that it complies with the chapter.

A licensee is exempt from section 27-62-4 if it has fewer than 25 employees, less than $5 million in gross annual revenue, or less than $10 million in year-end total assets. A licensee other than an insurance producer that violates the chapter may be subject to suspension or revocation of its license or certificate of authority or, in lieu of that, a fine of up to $10,000 per violation.

Licensees had until May 1, 2020 to implement section 27-62-4 other than subsection (f), and until May 1, 2021 to implement subsection (f). The chapter does not create or imply a private cause of action for a violation of its provisions.

Each covered entity and third-party agent must implement and maintain reasonable security measures to protect sensitive personally identifying information against a breach of security, including designating an employee to coordinate the measures, identifying internal and external risks, adopting and assessing safeguards, requiring service providers to maintain appropriate safeguards by contract, adjusting the measures for changed circumstances, and keeping management informed of their overall status.

A covered entity or third-party agent must separately take reasonable measures to dispose, or arrange for the disposal, of records containing sensitive personally identifying information within its custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable through any reasonable means consistent with industry standards.

"Covered entity" is defined to include a government entity as well as a private business. There is no private right of action for a violation of either duty, and the chapter's stated civil-penalty amounts apply only to a violation of the chapter's separate notification provisions, not to these two duties.

Requires commercial entities whose websites are more than one-third sexual material harmful to minors to use a reasonable age verification method to ensure visitors are 18 or older, without retaining identifying information after access is granted.

Requires app store providers to request and verify a user's age category (under 13, 13-15, 16-17, or 18 and older) at account creation, and to obtain verifiable parental consent before a minor may download an app or make purchases. Accounts in existence on October 2, 2026 must be categorized and verified before October 1, 2027. The House passed the bill on January 22, 2026, the Senate amended and passed it on February 5, 2026, and the House concurred in the Senate amendment on February 10, 2026.