Alabama's New Privacy Law: What Small Businesses Must Do by May 1, 2027

Alabama's Personal Data Protection Act takes effect May 1, 2027 — four months after Oklahoma and Louisiana join the patchwork on January 1. Same consumer-rights framework, but with two features that make Alabama meaningfully different: unusually low applicability thresholds, and a kids'-data rule worth knowing about even if you're nowhere near the thresholds.

Who the law covers — the low thresholds

Alabama's triggers are stand-alone (meeting either one is enough):

• Control or process the personal data of 25,000 or more Alabama consumers, or
• Derive 25% or more of gross revenue from selling personal data.

Compare: the standard model needs 100,000 consumers, or 25,000 plus half your revenue from data sales. Alabama drops the consumer count to a quarter of the standard — and its revenue prong (25%) is half the usual 50%, standing alone rather than paired with a consumer count.

In practice: a mid-size e-commerce business with 30,000 Alabama customers is covered in Alabama while being exempt in Oklahoma. If you operate across multiple Southeastern states, run each state's test separately — the patchwork punishes anyone who assumes one answer fits all.

The kids'-data rule

Alabama requires businesses to obtain consent before processing the personal data of children between 13 and 15 for targeted advertising or the sale of personal data, consistent with COPPA's framework. If your business markets to teens — gaming, apparel, content, apps — this deserves attention regardless of whether you clear the main thresholds, because children's-data rules in several states operate on separate triggers.

Enforcement: AG only, with the longest cure period of the three

Enforcement belongs exclusively to the Alabama Attorney General — no private lawsuits. Before acting, the AG must give notice and a 45-day opportunity to cure, the most generous of the three 2027 states (Oklahoma and Louisiana offer 30 days).

Don't mistake generosity for softness: the cure period is a chance to fix, not a free pass to ignore. Businesses that treat the extra four months before May 1 as procrastination time tend to discover in April that vendor contracts and data inventories take longer than expected.

What covered businesses need to do

• Consumer rights: access, deletion, correction, portability, opt-out of sales, targeted ads, and profiling.
• Privacy notices describing practices in plain language.
• Opt-out mechanisms including universal opt-out signals.
• Teen-data consent flows if you process 13–15-year-olds' data for ads or sales.
• Reasonable security and written processor contracts.

How to use the extra four months wisely

The teen-data rule in practice

Alabama's requirement — consent before processing 13–15-year-olds' data for targeted advertising or sale — deserves practical unpacking, because "we don't market to kids" is often wrong:

• Who it catches: anyone whose analytics show meaningful 13–17 traffic and who runs targeted ads. Apparel, gaming, music, content, and DTC brands skew young without intending to.
• What "consent" means here: opt-in, not opt-out — the user (or parent, depending on age and implementation) must affirmatively agree before you process their data for ads or sale. Your current "accept cookies" flow probably doesn't qualify.
• The COPPA overlap: under-13 data is already covered by federal COPPA. Alabama extends similar protections up to 15 for the ads/sale context. If you're COPPA-compliant for under-13s, you're partway there — but the 13–15 band needs its own handling.

Even if you're below Alabama's main thresholds, audit your age demographics. Teen-data rules in multiple states operate on logic separate from the headline thresholds, and they're the category regulators care about most.

The 25% revenue prong, explained

Alabama's second trigger deserves a closer look because it's genuinely unusual: deriving 25% or more of gross revenue from selling personal data — standing alone, no consumer count required.

In the standard model, the revenue prong is 50% and it's paired with a 25,000-consumer minimum. Alabama halves the percentage and drops the pairing. Who does that catch? Businesses whose product is data, or close to it: lead generators, data-enrichment services, ad-tech intermediaries, list brokers. A 20-person lead-gen firm with $4M in revenue, 80% of it from selling contact data, is covered in Alabama while being nowhere near any consumer-count threshold.

If your business touches data monetization at all — even "we share lead data with partners" — run the 25% math honestly. "Selling" is defined broadly, and revenue-share calculations have a way of surprising people.

Frequently asked questions

We have 30,000 Alabama customers but don't sell data. Covered?

Yes — the 25,000-consumer prong stands alone. You don't need to sell anything; the consumer count is enough. This is the lower bar that makes Alabama the strictest of the three 2027 states for ordinary businesses.

What about the teen-data rule — does it apply below the thresholds?

Children's-data provisions in several states operate on separate logic from the main applicability thresholds. If you market to 13–15-year-olds, don't assume the main thresholds are the whole story — get advice on the teen-data rules specifically.

Can we just do one compliance program for all three 2027 states?

Largely, yes — and you should. The consumer rights, notice duties, and opt-out mechanics are 90% identical across Oklahoma, Louisiana, and Alabama. Build once to the strictest applicable standard (usually Alabama's thresholds + Louisiana's early cure sunset), and you're covered for all three. The remaining 10% is state-specific detail worth an attorney's hour.