Ala. Code § 8-44-7 (2026)

(a) A controller shall do all of the following:

(1) Limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which the personal data is processed.

(2) Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the personal data at issue.

(3) Provide an effective mechanism for a consumer to revoke the consumer’s consent under this chapter which is at least as easy as the mechanism by which the consumer provided the consumer’s consent and, on revocation of the consent, cease to further process the personal data as soon as practicable, but no later than 45 days after complying with the consumer’s opt-out request consistent with this chapter.

(b) A controller may not do any of the following:

(1) Except as provided in this chapter, process personal data for purposes that are not reasonably necessary to or compatible with the disclosed purposes for which the personal data is processed as disclosed by the controller.

(2) Process sensitive data concerning a consumer other than a known child without obtaining that consumer’s consent or, in the case of the processing of personal data concerning a known child, without processing the data in accordance with the federal Children’s Online Privacy Protection Act of 1998, 15 U.S.C. § 6501 et seq.

(3) Process personal data in violation of the laws of this state or federal laws that prohibit unlawful discrimination against consumers.

(4) Process the personal data of a consumer for the purposes of targeted advertising or sell a consumer’s personal data without the consumer’s consent under circumstances in which a controller has actual knowledge that the consumer is at least 13 years of age but younger than 16 years of age.

(5) Deny goods or services, charge different prices or rates for goods or services, or provide a different level of quality of goods or services to a consumer if the consumer opts out of the processing of the consumer’s data. However, if a consumer opts out of data processing, the covered entity is not required to provide a service that requires data processing. Controllers may provide different prices or levels for goods or services if the good or service is a bona fide loyalty, rewards, premium features, discount, or club card program in which a consumer voluntarily participates.

(c) If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose the processing, as well as the way a consumer may exercise the right to opt out of the processing.

(d) A controller shall provide consumers with a reasonably accurate, clear, and meaningful privacy notice that includes all of the following:

(1) The categories of personal data processed by the controller.

(2) The purpose for processing personal data.

(3) The categories of personal data that the controller shares with third parties, if any.

(4) The categories of third parties, if any, with which the controller shares personal data.

(5) An active email address or other mechanism that the consumer may use to contact the controller.

(6) How consumers may exercise their consumer rights, including a link or contact information for availing themselves of the opt-out method provided in Section 8-44-6.

(e)(1) A controller shall establish and describe in a privacy notice one or more secure and reliable means for consumers to submit a request to exercise their consumer rights, as established under Section 8-44-5, pursuant to this chapter considering the ways in which consumers normally interact with the controller, the need for secure and reliable communication of consumer requests, and the ability of the controller to authenticate the identity of the consumer or authorized agent making the request.

(2) A controller may not require a consumer to create a new account to exercise consumer rights but may require a consumer to use an existing account as a means of exercising his or her consumer rights.

(f) Any provision of a contract or agreement of any kind which purports to waive or limit in any way a consumer’s consumer rights as established under this chapter shall be deemed contrary to public policy and shall be void and unenforceable.

(Act 2026-552, §7.)