Alabama Site Laws: Current Laws and Regular Updates

How Alabama Site Laws Reach Small Businesses

You might assume that state internet laws target large platforms and leave a local shop alone. In Alabama, that holds for some statutes and fails for others. The new privacy law exempts many smaller businesses, but the breach notification law can apply to a business that holds covered sensitive data on Alabama residents, and sales-tax duties can arise when an out-of-state seller’s direct Alabama sales cross the state threshold.

The practical way to sort Alabama site laws is by what your site does. A site that collects customer account, payment, or login information should account for the breach law. A site that sells products or taxable services into Alabama should check the tax rules. A site that makes claims about products, pricing, or privacy should make sure those statements are accurate. Adult-content publishers and mobile-app businesses have additional, feature-specific rules.

The Alabama Personal Data Protection Act (HB 351)

The major recent addition is the Alabama Personal Data Protection Act. HB 351’s enrolled text was enacted in April 2026 and takes effect on May 1, 2027. It applies to a person that conducts business in Alabama or produces products or services targeted to Alabama residents and either controls or processes personal data of more than 25,000 Alabama consumers, excluding data processed solely to complete a payment transaction, or derives more than 25 percent of gross revenue from selling personal data.

The law has important business exemptions. It exempts a business with fewer than 500 employees if it does not sell personal data, and a nonprofit entity with fewer than 100 employees if it does not sell personal data. It also contains entity- and data-level exemptions, including for certain financial institutions, HIPAA-regulated entities, and specified federally regulated data. A typical small store or service site that does not sell personal data may therefore be outside the Act, but a business should document its conclusion rather than rely on its size alone.

For covered controllers, the Act provides consumer rights to confirm and access personal data, correct inaccuracies, delete data, obtain a portable copy of data previously provided by the consumer, and opt out of targeted advertising, sale of personal data, and profiling in furtherance of solely automated significant decisions. Controllers must respond to authenticated requests within 45 days, subject to a permitted 45-day extension in specified circumstances. The Act requires consent for sensitive-data processing and, where the controller has actual knowledge that a consumer is at least 13 but younger than 16, for targeted advertising or sale of that consumer’s data.

Covered controllers must publish a meaningful privacy notice, provide a secure and reliable rights-request method, and disclose sales or targeted-advertising processing and how consumers may opt out. The enacted text also addresses an opt-out preference signal: where a consumer’s signal conflicts with certain controller-specific privacy settings or voluntary loyalty or rewards participation, the controller must comply with the signal while it may notify the consumer of the conflict. The Attorney General may enforce the Act. Before filing an action, the Attorney General must provide notice and a 45-day opportunity to correct the noticed violation; a court may assess up to $15,000 per violation if the violation is not corrected as required.

What to do before May 1, 2027

Count Alabama consumers whose data you control or process, identify whether any sharing could qualify as a sale of personal data, and confirm whether an entity exemption applies. If the Act may apply, map your data flows, update the privacy notice, build a rights-request process, review contracts with processors, and plan opt-out and consent controls. A web form may be a practical request channel, but the law requires a method that is secure and reliable for the way consumers normally interact with the business.

The Data Breach Notification Act of 2018

Unlike the privacy Act, Alabama’s Data Breach Notification Act of 2018 is effective now. The Attorney General’s breach-notification page explains that the law requires notice when unauthorized acquisition of sensitive personally identifying information is reasonably likely to cause substantial harm to affected individuals.

For covered breaches, affected Alabama residents generally must be notified as expeditiously as possible and no later than 45 days after the entity determines that a breach occurred and is reasonably likely to cause substantial harm. If notice is required for more than 1,000 Alabama residents, the Attorney General and consumer reporting agencies also have notice obligations. A third-party agent maintaining covered information for another entity must notify that entity within 10 days of determining that a breach occurred.

For a small site, this Alabama site law rewards three habits: collect only the data you need, protect the sensitive data you retain, and have an incident-response plan that can meet the statutory timelines. Website owners should also know which vendors host, process, or can access customer data, because the vendor-notice rule can affect the response sequence.

Age Verification: Adult Websites and the App Store Accountability Act

Alabama has two separate age-related laws with different targets. First, HB 164 (Act 2024-97) regulates commercial entities that knowingly and intentionally publish or distribute sexual material harmful to minors through an “adult website.” The Act defines an adult website as one where more than 33 1/3 percent of the content is sexual material harmful to minors. The age-verification provisions took effect October 1, 2024.

A covered adult website must use a reasonable age-verification method to provide reasonable assurance that people under 18 cannot access the material. The Act prohibits the covered entity or verification provider from retaining personally identifying information after access has been granted, subject to the Act’s terms. It also requires specified warnings. An injured individual may bring a circuit-court action for violations of the age-verification, private-image-consent, or warning provisions, and the Attorney General may seek a civil penalty of up to $10,000 per violation after a court finding. The Act’s separate 10 percent tax on gross receipts of a commercial entity operating an adult website became effective September 1, 2025. Unless a site falls within this adult-content framework, these requirements ordinarily are not the rules driving a standard business website.

Second, the App Store Accountability Act, HB 161 (Act 2026-59), is enacted but does not take effect until January 1, 2027. It regulates app store providers and app developers, not ordinary websites. It requires an app store provider to request and verify an Alabama user’s age category at account creation and, for a minor, affiliate the account with a parent account and obtain verifiable parental consent before the minor downloads or buys an app or makes an in-app purchase. The statute sets October 1, 2027 as the deadline for verifying accounts that existed on October 2, 2026.

Developers have direct duties too. They must use the app store’s data-sharing methods to verify an Alabama user’s age category and, for a minor account, parental-consent status; notify the store of a defined “significant change” to an app; and limit their use of age-category data. The Act requires the Attorney General to adopt rules on age-verification processes. Knowing or reckless violations are deemed deceptive trade practices, and the Attorney General has exclusive authority to bring an action under that provision, with a stated civil penalty of up to $7,500 per violation.

If you distribute a mobile app, plan for the January 1, 2027 effective date and the app-store integrations and product-change workflows the statute contemplates. If you operate only a website and do not publish covered adult material, these two age-verification laws generally do not impose app-store duties on the website itself.

Sales Tax and the Economic Nexus Rule

Among Alabama site laws, sales-tax rules are the ones out-of-state owners most often overlook. The Alabama Department of Revenue states that remote sellers with annual Alabama sales above the $250,000 small-seller exception must register and collect under the state’s economic-nexus rule. The Department’s online-seller guidance says collection was required beginning October 1, 2018 for remote sellers above that threshold.

The state’s Simplified Sellers Use Tax program lets eligible remote sellers collect and remit a flat 8 percent tax rather than calculate each local rate. Participation requires application and acceptance. Alabama’s Department of Revenue also explains that the threshold calculation for remote sellers and marketplace facilitators includes retail sales made directly by the seller; it excludes qualifying wholesale resale sales and sales made through an SSUT-participating marketplace that collects Alabama tax for the marketplace seller.

Marketplace sales should not simply be assumed to be outside every seller’s analysis. Confirm whether the marketplace is collecting and remitting for the transactions at issue and whether the sales are excluded under the Department’s current guidance. Inventory, personnel, or other contacts in Alabama can raise separate physical-nexus and tax-registration questions.

The Deceptive Trade Practices Act and Older Statutes

The Alabama Deceptive Trade Practices Act remains important because the newer age-verification laws use deceptive-trade-practice enforcement mechanisms. The Act prohibits listed deceptive acts and practices in trade or commerce. For a website owner, that makes accurate product descriptions, prices, promotional claims, and statements about how the business handles customer information an important baseline.

Alabama’s Digital Crime Act and identity-theft laws address computer crimes, fraud, and misuse of identifying information. Alabama’s Uniform Electronic Transactions Act also supplies rules recognizing electronic records and signatures in transactions when the parties have agreed to conduct the transaction electronically. These laws are part of the legal background for online operations, but they do not replace a site-specific review of payment, privacy, marketing, and consumer-protection obligations.

What Alabama Has Not Passed

As of September 21, 2026, this review did not identify an enacted Alabama general automatic-renewal or click-to-cancel statute, a general private-business cookie-banner requirement, a general chatbot-disclosure statute, or a state web-accessibility statute directed at private businesses. The 2026 Legislature considered bills on automatic renewals and AI chatbots, including HB 610 and HB 325, but introduced legislation is not enacted law. The 2026 regular session adjourned on April 9, 2026.

The absence of a directly on-point Alabama statute does not remove federal obligations or obligations triggered by sales to residents of other states. Federal consumer-protection, accessibility, subscription, advertising, email, and privacy rules may still matter, as may the laws of the states where your customers live. Treat Alabama site laws as one layer in a broader compliance picture.

Your Alabama Compliance Timeline

To keep the dates straight, here is the sequence of deadlines that matters for a small business.

1. Now: Confirm that your breach-response plan can meet Alabama’s 45-day individual-notice deadline when the breach law applies, and review site statements for accuracy.
2. Now: Check direct Alabama sales and your marketplace arrangements. If you exceed the remote-seller threshold, address registration and collection duties.
3. January 1, 2027: The App Store Accountability Act takes effect.
4. May 1, 2027: The Alabama Personal Data Protection Act takes effect for businesses within its scope.
5. October 1, 2027: Statutory deadline for app-store verification of accounts that existed on October 2, 2026.

Most small businesses will not need a large Alabama-only compliance program. An organized review of data practices, sales channels, vendor access, and mobile-app features will usually show which of these rules matter.

Key Takeaways

Alabama site laws now span privacy, breach notification, age verification, sales tax, and deceptive practices. The Alabama Personal Data Protection Act is enacted but becomes effective May 1, 2027; it exempts businesses with fewer than 500 employees that do not sell personal data, among other exemptions. The breach law is already effective. The adult-website age-verification law is already effective, while the App Store Accountability Act takes effect January 1, 2027. Remote sellers should review the $250,000 Alabama-sales threshold and the Department of Revenue’s marketplace guidance.

Frequently Asked Questions About Alabama Site Laws

Does the Alabama Personal Data Protection Act apply to my small business?

It may apply if you conduct business in Alabama or target Alabama residents and either process personal data of more than 25,000 Alabama consumers, excluding payment-only data, or derive more than 25 percent of gross revenue from selling personal data. A business with fewer than 500 employees that does not sell personal data is exempt, but other details and exemptions can matter.

When do I have to notify customers after a data breach in Alabama?

When the Data Breach Notification Act applies, notice to affected individuals generally must be made as expeditiously as possible and no later than 45 days after the required determination. Additional notices can be required when more than 1,000 Alabama residents must be notified.

Do I need to collect Alabama sales tax on my online store?

Remote sellers should review whether their annual direct Alabama sales exceed $250,000 and whether they have other Alabama nexus. Marketplace arrangements can change who collects for particular transactions, so confirm the marketplace’s role and the Department of Revenue’s current guidance.

Do Alabama site laws require a cookie banner or chatbot disclosure?

This review found no enacted Alabama general cookie-banner or chatbot-disclosure statute as of September 21, 2026. That does not answer requirements under federal law or the laws of other states.

Are Alabama’s age-verification laws relevant to a regular business site?

The adult-content law applies to covered adult websites, not an ordinary business site. The App Store Accountability Act applies to app store providers and app developers and takes effect January 1, 2027. A business that operates only a conventional website should still evaluate any separate laws that apply to its products, marketing, or users.

Conclusion

Alabama site laws have developed quickly, particularly through the 2024 and 2026 sessions. For many small businesses, the immediate priorities remain breach readiness, accurate customer-facing statements, and tax compliance when sales activity reaches the applicable threshold. The broader privacy law is enacted, but its effective date is May 1, 2027.

Keep the January 1, 2027 app-store effective date, the May 1, 2027 privacy effective date, and the October 1, 2027 existing-account deadline on the calendar if they apply to your business. Revisit this review when you add a mobile app, expand advertising or analytics, begin selling customer data, add an adult-content feature, or materially change how your site collects or shares customer information.