Roll privacy. On April 16, 2026, only a few weeks after Oklahoma broke the state comprehensive privacy legislation drought to bring our total to 20, Alabama Governor Kay Ivey signed the Alabama Personal Data Protection Act into law to make it 21.

Like Oklahoma's law, Alabama's adds little that a business with a mature compliance program must address. However, the law deviates from consensus in a few interesting ways:

• Coverage thresholds. Alabama's 25,000-consumer processing threshold is the lowest of any state, covering just 0.48% of the population. Unlike most states, which tie the 25% gross revenue trigger to sales involving at least 25,000 individuals, Alabama's applies regardless of how many consumers' data is sold.

• Sale exemptions. Alabama excludes disclosures for analytics services and for marketing services provided solely to the controller from its definition of a sale, exemptions not found in any other state law. The sale definition is also narrower than most, capturing only transfers where the receiving third party faces no restrictions on how it can subsequently use the data.

• Exemption for businesses selling data to political entities. Often, comprehensive privacy laws will provide an entity-level exemption for political organizations, such as political action committees, parties, or campaign committees, as defined elsewhere in state and federal law. Alabama's law takes this further, also exempting a business entity that sells data primarily to a political entity. 

• Permanent cure period. Alabama Attorney General's Office has sole enforcement authority, and the law includes an unusually long 45-day cure period that does not sunset. 

The law takes effect May 1, 2027. Until then, most businesses should prepare to list yet another state in their privacy policy.