by Arsen Kourinian, Lei Shen, Amber C. Thomson, Megan P. Von Klein, Joshua M. Cohen - Mayer Brown

On April 17, 2026, Governor Kay Ivey signed House Bill 351 into law, enacting the Alabama Personal Data Protection Act (the "APDPA" or the "Act") and making Alabama the 22nd state to adopt a comprehensive consumer privacy law. The APDPA, which takes effect on May 1, 2027, largely follows the dominant model for state privacy legislation observed in states outside of California; however, it departs from that model in several notable respects, including generally lower applicability thresholds, a novel definition of "sale," and the absence of a data protection assessment requirement. For more information about how the APDPA compares to other privacy laws, please see our state privacy law tracker.