Ala. Code § 8-44-4 (2026)

(a) Notwithstanding any other provisions of this chapter, this chapter shall not apply to any of the following:

(1)a. A political subdivision of the state.

b. Any board, authority, district, or public corporation organized pursuant to Title 11 or Chapter 7 of Title 39.

(2) A two-year or four-year institution of higher education, including affiliates of a two-year or four-year institution of higher education.

(3) A national securities association that is registered under 15 U.S.C. § 78o-3.

(4) A financial institution or an affiliate of a financial institution governed by 15 U.S.C. Chapter 94.

(5) A financial institution or an affiliate of a financial institution governed by, or personal data collected, processed, sold, or disclosed in accordance with, Title V of the Gramm-Leach-Bliley Financial Modernization Act, 15 U.S.C. § 6801 et. seq.

(6) A covered entity or business associate as defined in the privacy regulations of 45 C.F.R. § 160.103.

(7) A business, including an organization cooperatively organized under Chapter 6 of Title 37, or an entity that is an instrumentality of a municipal corporation, with fewer than 500 employees, provided the business does not engage in the sale of personal data.

(8) A nonprofit entity, as defined in Section 10A-1-1.03, with less than 100 employees, provided the entity does not engage in the sale of personal data.

(9) Any individual or entity regulated by Chapter 6 of Title 8.

(10) Any individual or entity regulated by Chapter 7A of Title 8.

(11) Any trade association explicitly authorized to receive documents or evidence pursuant to Section 27-12A-23.

(12)a. A political action committee, political party, or principal campaign committee, as defined in Section 17-5-2, Code of Alabama 1975, or any political organization as defined in 26 U.S.C. § 527.

b. A business entity that sells data primarily to a political action committee, political party, or principal campaign committee, as defined in Section 17-5-2, or any political organization as defined in 26 U.S.C. § 527.

(13) An electric provider as defined under Chapter 16 of Title 37, which is subject to the requirements or reliability standards of the North American Electric Reliability Corporation.

(b) This chapter shall not apply to any of the following information or data:

(1) Protected health information under the privacy regulations of the federal Health Insurance Portability and Accountability Act of 1996 and related regulations.

(2) Patient-identifying information for the purposes of 42 C.F.R. Part 2, established pursuant to 42 U.S.C. § 290dd-2.

(3) Identifiable private information for the purposes of 45 C.F.R. Part 46.

(4) Identifiable private information that is otherwise collected as part of human subjects research pursuant to the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use.

(5) The protection of human subjects under 21 C.F.R. Parts 50 and 56, or personal data used or shared in research as defined in the federal Health Insurance Portability and Accountability Act of 1996 and 45 C.F.R. § 164.501, which is conducted in accordance with applicable law.

(6) Information or documents created for the purposes of the federal Health Care Quality Improvement Act of 1986.

(7) Patient safety work products for the purposes of the federal Patient Safety and Quality Improvement Act of 2005.

(8) Information derived from any of the health care related information listed in this subsection which is deidentified in accordance with the requirements for deidentification pursuant to the privacy regulations of the federal Health Insurance Portability and Accountability Act of 1996.

(9) Information derived from any of the health care related information listed in this subsection which is included in a limited data set as described in 45 C.F.R. § 164.514(e), to the extent that the information is used, disclosed, and maintained in a manner specified in 45 C.F.R. § 164.514(e).

(10) Information originating from and intermingled to be indistinguishable with or information treated in the same manner as information exempt under this subsection which is maintained by a covered entity or business associate as defined in the privacy regulations of the federal Health Insurance Portability and Accountability Act of 1996 or a program or qualified service organization as specified in 42 U.S.C. § 290dd-2.

(11) Information used for public health activities and purposes as authorized by the federal Health Insurance Portability and Accountability Act of 1996, community health activities, and population health activities.

(12) The collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency, furnisher, or user that provides information for use in a consumer report and by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the federal Fair Credit Reporting Act.

(13) Personal data collected, processed, sold, or disclosed in compliance with the federal Driver’s Privacy Protection Act of 1994.

(14) Personal data regulated by the federal Family Educational Rights and Privacy Act of 1974.

(15) Personal data collected, processed, sold, or disclosed in compliance with the federal Farm Credit Act of 1971.

(16) Data processed or maintained by an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, or third party to the extent that the data is collected and used within the context of that role.

(17) Data processed or maintained as the emergency contact information of an individual under this chapter and used for emergency contact purposes.

(18) Data processed or maintained that is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information under this section and is used for the purposes of administering the benefits.

(19) Personal data collected, processed, sold, or disclosed in relation to price, route, or service, as these terms are used in the federal Airline Deregulation Act of 1978 by an air carrier subject to the act.

(20) Data or information collected or processed to comply with or in accordance with state law.

(21) Personal data collected or used pursuant to 21 U.S.C. § 830.

(c) Controllers and processors that comply with the verifiable parental consent requirements of the federal Children’s Online Privacy Protection Act of 1998 are compliant with any obligation to obtain parental consent pursuant to this chapter.

(Act 2026-552, §4.)