Montgomery, Alabama—Consumer Reports urges Governor Kay Ivey to veto HB 351, a weak consumer data privacy bill that passed the Alabama Legislature last week with little input from consumer advocates.
The bill includes some basic consumer rights, such as the right to know the information companies have collected about them, the right to delete certain information, and the right to limit some data disclosures. However, those rights are undercut by weak definitions of key terms like “sale” and “targeted advertising,” no universal opt out or authorized agent provisions, and insufficient enforcement mechanisms. The bill also includes a loophole relating to pseudonymous data that undercuts the opt-out right.
“Governor Ivey should veto HB 351 and ask the legislature to significantly strengthen it,” said Matt Schwartz, policy analyst at Consumer Reports. “This legislation adopts a lowest-common-denominator approach to privacy that will not meaningfully protect consumers. The bill includes definitions rife with loopholes, creates broad carveouts for key industries, and lacks universal opt-out controls that can help make privacy bills workable for consumers. It also lacks enforcement mechanisms that will actually incentivize companies to comply the first time around.”
If Governor Ivey signs HB 351, Alabama will join Oklahoma as the second state to enact a comprehensive privacy law in 2026—both of which Consumer Reports strongly opposes. Since the passage of the California Consumer Privacy Act in 2018, the number of comprehensive state privacy laws has grown to 20, though the strength of these laws varies in terms of consumer privacy protections.
***
Media Contact: Cyrus Rassool, 
cyrus.rassool@consumer.org