Alabama

Obligations

Business Obligations

• AppealsNot requiredNo general internal appeal process required by this omnibus law.
• Data securityRequiredMaintain reasonable administrative, technical, and physical safeguards as required by the statute.
• Privacy noticeRequiredProvide required privacy disclosures/notices.
• Sensitive dataState-specificOpt-in consent is generally required before processing sensitive data, subject to statutory exceptions.
• Data minimizationRequired / state-specificLimit or govern collection/use consistent with the statute's duties and disclosed purposes.
• Universal opt outRequiredHonor qualifying opt-out preference signals/universal mechanisms.
• Processor contractsRequiredUse contracts governing processors/service providers as required.
• Consumer request processRequiredProvide methods for consumers to exercise statutory rights.
• Data protection assessmentNot requiredNo general data protection assessment duty in this omnibus law.

Official Alabama statutory text controls where secondary trackers conflict. Section 8-44-6 expressly addresses an opt-out preference signal; the Act does not create a general consumer appeal process.

Exemptions

Common Exemptions

Exemptions are state-specific and may apply at the entity level, data level, or both. Verify the official statute before relying on an exemption. Treatment commonly varies for government, regulated financial/health information, higher education, nonprofits, employment data, and B2B data.

This list is not exhaustive.