Ala. Code § 8-44-2 (2026)

For the purposes of this chapter, the following terms have the following meanings:

(1) AFFILIATE. A legal entity that shares common branding with another legal entity or that controls, is controlled by, or is under common control with another legal entity.

(2) AUTHENTICATE. To use reasonable methods to determine that a request to exercise any of the consumer rights afforded under this chapter is being made by, or on behalf of, a consumer who is entitled to exercise those consumer rights with respect to the consumer’s personal data at issue.

(3) BIOMETRIC DATA. Data generated by automatic measurements of an individual’s biological characteristics, such as a fingerprint, voiceprint, retina, or iris, which are used to identify a specific individual. The term does not include any of the following:

a. A digital or physical photograph.

b. An audio or video recording.

c. Any data generated from paragraph a. or b. unless the data is used to identify a specific individual.

(4) CHILD. An individual under 13 years of age.

(5) CONSENT. A clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to allow the processing of personal data relating to the consumer, including, but not limited to, a written statement or a statement by electronic means. The term does not include any of the following:

a. Acceptance of a general or broad term of use or similar document that contains descriptions of personal data processing along with other unrelated information.

b. Hovering over, muting, or pausing a given piece of content.

c. An agreement obtained using dark patterns.

(6) CONSUMER. An individual who is a resident of this state. The term does not include an individual acting in a commercial or employment context or as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency whose communications or transactions with the controller occur solely within the context of that individual’s role with the company, partnership, sole proprietorship, nonprofit, or government agency.

(7) CONTROL. Any of the following:

a. Ownership of or the power to vote more than 50 percent of the outstanding shares of any class of voting security of a company.

b. Control in any manner over the election of a majority of the directors or of individuals exercising similar functions.

c. The power to exercise controlling influence over the management of a company.

(8) CONTROLLER. An individual or legal entity that, alone or jointly with others, determines the purposes and means of processing personal data.

(9) DARK PATTERN. A user interface designed or manipulated with the effect of substantially subverting or impairing user autonomy, decision-making, or choice.

(10) DEIDENTIFIED DATA. Data that cannot be used to reasonably infer information about or otherwise be linked to an identified or identifiable individual or a device linked to an identified or identifiable individual if the controller that possesses the data does all of the following:

a. Takes reasonable measures to ensure that the data cannot be associated with an individual.

b. Publicly commits to process the data in a deidentified fashion only and to not attempt to reidentify the data.

c. Contractually obligates any recipients of the data to satisfy the criteria set forth in paragraphs a. and b.

(11) IDENTIFIABLE INDIVIDUAL. An individual who can be readily identified, directly or indirectly.

(12) NONPROFIT ENTITY. As defined in Section 10A-1-1.03.

(13) PERSONAL DATA. Any information that is linked or reasonably linkable to an identified or identifiable individual. The term does not include deidentified data or publicly available information.

(14) PRECISE GEOLOCATION DATA. Information derived from technology, including, but not limited to, global positioning system level latitude and longitude coordinates, which directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet. The term does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.

(15) PROCESS. Any operation or set of operations, whether by manual or automated means, performed on personal data or on sets of personal data, including, but not limited to, the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.

(16) PROCESSOR. An individual or legal entity that processes personal data on behalf of a controller.

(17) PROFILING. Any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

(18) PSEUDONYMOUS DATA. Personal data that cannot be attributed to a specific individual without the use of additional information, provided the additional information is kept separately and is subject to appropriate technical and organizational measures to ensure that the personal data is not attributable to an identified or identifiable individual.

(19) PUBLICLY AVAILABLE INFORMATION. Either of the following:

a. Information that is lawfully made available through federal, state, or local government records or widely distributed media.

b. Information that a controller has a reasonable basis to believe a consumer has lawfully made available to the public.

(20) SALE OF PERSONAL DATA. The exchange of personal data for monetary consideration by a controller to a third party, or for other valuable consideration by a controller to a third party where the controller receives a material benefit and the third party is not restricted in its subsequent uses of the personal data. The term does not include any of the following:

a. The disclosure of personal data to a processor that processes the personal data on behalf of the controller.

b. The disclosure of personal data to a third party for the purposes of providing a product or service requested by the consumer.

c. The disclosure or transfer of personal data to an affiliate of the controller.

d. The disclosure of personal data in which the consumer directs the controller to disclose the personal data or intentionally uses the controller to interact with a third party.

e. The disclosure of personal data that the consumer intentionally made available to the public via a channel of mass media and did not restrict to a specific audience.

f. The disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction, or a proposed merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller’s assets.

g. The disclosure or transfer of personal data to a third party for the purposes of providing analytics services.

h. The disclosure or transfer of personal data to a third party for the purposes of providing marketing services solely to the controller.

(21) SENSITIVE DATA. Personal data that includes any of the following:

a. Data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, information about an individual’s sex life, sexual orientation, or citizenship or immigration status.

b. The processing of genetic or biometric data for the purpose of uniquely identifying an individual.

c. Personal data collected from a known child.

d. Precise geolocation data.

(22) SIGNIFICANT DECISION. A decision made by a controller which results in the provision or denial by the controller of credit or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunity, health care service, or access to basic necessities such as food or water.

(23) TARGETED ADVERTISING. Displaying advertisements to a consumer in which the advertisement is selected based on personal data obtained or inferred from that consumer’s activities over time and across nonaffiliated Internet websites or online applications to predict the consumer’s preferences or interests. The term does not include any of the following:

a. Advertisements based on activities within a controller’s own Internet websites or online applications.

b. Advertisements based on the context of a consumer’s current search query or visit to any Internet website or online application.

c. Advertisements directed to a consumer in response to the consumer’s request for information or feedback.

d. Processing personal data solely to measure or report advertising frequency, performance, or reach.

(24) THIRD PARTY. An individual or legal entity other than a consumer, controller, processor, or an affiliate of the controller or processor.

(25) TRADE SECRET. As defined in Section 8-27-2.

(Act 2026-552, §2.)