Alabama has joined the expanding patchwork of states enacting consumer privacy laws, with a new statute that will require many businesses to reassess how they collect, use and sell personal data. On April 16, 2026, Governor Kay Ivey signed into law the Alabama Personal Data Protection Act (APDPA), a comprehensive consumer data privacy law. The APDPA will take effect on May 1, 2027. The law applies to many companies doing business in Alabama or targeting its residents and introduces obligations around consumer rights, data use and transparency. Key Takeaways: The APDPA largely follows the “Virginia model” of comprehensive consumer privacy laws, so many requirements will be familiar to companies with existing privacy programs. The APDPA’s scope combines a low processing threshold with a

Ashleigh Bickford and Greg Leighton note that California’s privacy regulators turned up the heat in 2025, shifting enforcement from policies on paper to privacy tools that actually work. Regulators are actively testing opt-outs, vendor contracts and employee notices for real-world compliance. Read the full article in the 2026 Technology Transactions & Data Privacy Annual Report.