Alabama Children’s Privacy Laws (2026)

HB161 (Act 2026-59)

Enacted, not yet effective · App store · effective 2027-01-01 · binds app stores, developers

Ages: Minors under 18; age categories: under 13, 13-15, 16-17, 18+

Requires: App store providers must request each account holder's age category (under 13; 13-15; 16-17; 18+) and verify it using commercially available methods reasonably designed to ensure accuracy or an age-verification system that complies with the Attorney General's rules. For minors (under 18), the store must affiliate the account with a verified parent account and obtain verifiable parental consent before the minor may download an app, purchase an app, or make in-app purchases. App developers receive age-category/consent signals and must re-request consent on significant changes. Existing accounts must be categorized/verified by Oct 1, 2027.

Litigation: No suit found against Alabama's law. Context: on 2026-07-06 the U.S. Supreme Court denied applications to vacate the Fifth Circuit's stay in the Texas App Store Accountability Act litigation (25A1389, Students Engaged in Advancing Texas v. Paxton; 25A1390, CCIA v. Paxton), an emergency-docket order that lets Texas enforce its similar law while the Fifth Circuit appeal proceeds. The Fifth Circuit heard argument in that consolidated appeal (Nos. 25-51073 and 26-50001) on 2026-08-04 and has not yet issued a merits decision. Alabama was one of 27 states on the Florida-led amicus brief supporting Texas.

Entry last reviewed 2026-10-01

HB351 (Act 2026-552)

Enacted, not yet effective · Privacy law (minors) · effective 2027-05-01 · binds operators

Ages: Known child under 13 (COPPA-aligned sensitive-data treatment); consumers ages 13-15 require opt-in consent for targeted advertising or sale of data

Requires: Alabama's comprehensive consumer privacy law treats personal data collected from a known child (under 13) as sensitive data that must be processed in accordance with COPPA; controllers that comply with COPPA's verifiable-parental-consent requirements are deemed compliant with the Act's parental consent obligations, and a parent or legal guardian may exercise a known child's privacy rights. For consumers ages 13-15 whose age a controller actually knows, the controller must get the consumer's own consent (a clear affirmative act) before processing their data for targeted advertising or selling it. Enforcement is by the Alabama AG after a notice of violation and a 45-day cure period, and a court may assess civil penalties of not more than $15,000 per violation; the Act creates no private right of action.

Litigation: None found. Newly enacted comprehensive privacy statute; no legal challenges reported.

Entry last reviewed 2026-10-01