Alabama data privacy rights and data broker removal (2026)
How to exercise your data privacy rights in Alabama, opt out of data brokers, and file a complaint — updated for 2026.
At a glance
- Comprehensive privacy law? No. Your rights come from the statutes below.
- In effect since May 1, 2027 (enacted April 2026; NOT in effect at any point during 2026 — therefore has_comprehensive_privacy_law is false for 2026)
- Your core rights access/know, correct, delete, data portability +4 more
- Honors Global Privacy Control? Not required
- Data-broker registry? No
- Enforced by Alabama Attorney General (exclusive)
What Delist can do for you in Alabama
Alabama has no comprehensive privacy law in effect. We submit your requests through each broker's own opt-out channel, on your behalf. Many national brokers honor these requests wherever you live, but none is required to by Alabama law, so we follow up and re-file rather than assume.
From May 1, 2027, Alabama's new privacy law takes effect. It does not set up an authorized-agent process, so we will keep submitting on your behalf.
Basis: Ala. Code § 8-44-1 et seq. (HB 351, Act 2026-552). Reviewed September 1, 2026. How the three groups work: our authorized-agent framework.
What still protects you
As of 2026, Alabamians have no enforceable comprehensive access/delete/opt-out rights. They do have: breach-notification protection (Ala. Code § 8-38-1 et seq.); the practical ability to submit opt-out/deletion requests to CCPA-covered and other-state-registered data brokers; and GPC use against CCPA-covered businesses. They cannot compel businesses that are not covered by another state's law to delete data, honor opt-outs, or provide access until the APDPA takes effect on May 1, 2027.
Your privacy rights in Alabama
- access/know
- correct
- delete
- data portability
- opt out of sale
- opt out of targeted advertising
- opt out of profiling
- appeal
How to exercise your rights
Until May 1, 2027, Alabamians have no comprehensive access/delete/opt-out rights. In the interim they can: submit opt-out and deletion requests to data brokers registered under California's or other states' laws (most national brokers honor requests from any U.S. resident); enable the Global Privacy Control (GPC) in their browser to opt out across CCPA-covered businesses; and rely on Alabama's breach-notification law. From May 1, 2027, residents will submit authenticated access/delete/correct/opt-out requests directly to covered controllers via the mechanisms in each company's privacy notice.
Ready to see who's selling your information? Browse our data broker removal guides for step-by-step opt-out instructions.
Sensitive information
(Effective 2027) Opt-in (affirmative consent) required before processing sensitive data — racial/ethnic origin, religious beliefs, mental/physical health diagnosis, sexual orientation, citizenship/immigration status, genetic/biometric data used to identify, precise geolocation, and the personal data of a known child (processed per COPPA).
Special protections
Data breach notification under the Alabama Data Breach Notification Act of 2018 (Ala. Code § 8-38-1 et seq.), enforced by the AG. The APDPA (from 2027) will protect known children's data via opt-in consent. Alabama also enacted an app-store age-verification law (Feb. 2026) directed at minors. No Daniel's-Law-style address-protection statute for judges/law-enforcement was identified in Alabama as of 2026.
How to file a complaint
Office of the Alabama Attorney General, Consumer Protection Section — https://www.alabamaag.gov/consumer-protection/
Recent updates (2025–2026)
APDPA (HB 351) enacted April 2026, effective May 1, 2027 — Alabama is widely described as the 21st state to pass a comprehensive privacy law. App-store age-verification legislation enacted February 2026. Neither materially changes 2026 rights, which remain limited.
Frequently asked questions
Does Alabama have a data privacy law?
Alabama has no comprehensive consumer privacy law, but federal rules and data-broker opt-out paths still apply.
How do I remove my information from data brokers in Alabama?
Until May 1, 2027, Alabamians have no comprehensive access/delete/opt-out rights. In the interim they can: submit opt-out and deletion requests to data brokers registered under California's or other states' laws (most national brokers honor requests from any U.S. resident); enable the Global Privacy Control (GPC) in their browser to opt out across CCPA-covered businesses; and rely on Alabama's breach-notification law. From May 1, 2027, residents will submit authenticated access/delete/correct/opt-out requests directly to covered controllers via the mechanisms in each company's privacy notice.
Who enforces privacy law in Alabama?
Alabama Attorney General (exclusive). No private right of action. A 45-day right-to-cure that does NOT sunset (permanent). Enforced as an unlawful trade practice; civil penalties under the Alabama Deceptive Trade Practices Act.
Does Alabama have a data broker registry?
No. Alabama does not have a dedicated data-broker registry, but you can still opt out of brokers directly.
Sources
Also in this state
Find out what data brokers know about you
A free scan shows which sites are exposing your name, phone, address and email, and Delist files the removals for you.