Alabama's Personal Data Protection Act (APDPA) presents new challenges for businesses. Your team might have felt secure under other states' privacy laws, but Alabama's threshold of 25,000 consumers, far lower than Virginia's, brings you into scope.
The law takes effect on May 1, 2027. While that may seem far off, compliance teams know that 18 months can disappear quickly when you're mapping data flows, rewriting vendor contracts, and building request workflows. Here are the mistakes that can turn a manageable project into a last-minute scramble.
Why These Mistakes Keep Happening
Mid-sized organizations often lack dedicated privacy counsel. You're managing compliance alongside other duties, borrowing frameworks from larger companies, and making assumptions about state laws. The APDPA challenges these assumptions. Its definition of "sale" is more nuanced than Virginia's or California's, and its exemptions depend on employee counts and data sales. The details are crucial, and they're new.
Mistake 1: Assuming Your Vendor Agreements Already Cover "Sale"
Why it happens: Your contracts use "sale" definitions from the VCDPA or CCPA. You assume Alabama will interpret the term similarly.
The consequence: Alabama defines sale as an exchange for monetary or other valuable consideration where you receive a material benefit and the third party isn't restricted in data use. If your ad-tech partner can resell audience segments, you've likely triggered the definition. If your analytics provider is contractually limited to processing data on your behalf, you haven't.
Your existing vendor agreements might not address this nuance. You could be telling consumers you don't sell data while your contracts allow partners unrestricted use rights.
The fix: Audit every third-party data transfer. Ask: Does the recipient have unrestricted use rights? Do we receive material benefit beyond the service itself? If both answers are yes, you're selling data under Alabama law. Amend the contract to restrict use, or update your privacy notice and build an opt-out mechanism.
Mistake 2: Treating Targeted Advertising as a "Sale"
Why it happens: California's CPRA treats sharing for targeted advertising as a sale. Colorado, Connecticut, and Texas have similar models. You've built your compliance program around that assumption.
The consequence: The APDPA excludes disclosures for marketing services provided solely to the controller. Targeted advertising isn't a sale under Alabama law, it's a separate category with its own opt-out right. If you're treating ad disclosures as sales in your privacy notice, you're over-promising. If you're routing ad opt-outs through your sale opt-out workflow, you're creating confusion.
Consumers can still opt out of targeted advertising under the APDPA, but the compliance mechanics differ from sale opt-outs.
The fix: Separate your opt-out mechanisms. Build one workflow for sale opt-outs and another for targeted advertising opt-outs. Update your privacy notice to reflect Alabama's distinction. If you operate in multiple states, map which definition applies in each jurisdiction and document the logic.
Mistake 3: Requiring Identity Verification for Opt-Outs
Why it happens: You've read about California's enforcement actions against companies for requiring identity verification before opting out of sales. You assume verification is universally prohibited.
The consequence: Under the APDPA, you may require identity verification for all rights requests, including opt-outs. If you've disabled verification to stay California-compliant, you're exposing yourself to fraudulent requests in Alabama. If you're verifying everywhere because Alabama allows it, you're violating California law.
The fix: Build jurisdiction-aware request workflows. When a consumer submits an opt-out, determine their state. For California requests, process the opt-out without verification. For Alabama requests, you can verify, but you don't have to. Decide based on your fraud risk, not on blanket assumptions about privacy laws.
Mistake 4: Overlooking the Small-Business Exemption Trigger
Why it happens: You have 480 employees. Most state privacy laws exempt small businesses outright, so you've ignored the entire compliance project.
The consequence: The APDPA exempts businesses with fewer than 500 employees, but only if they don't sell personal data. If you're exchanging consumer data for material benefit with third parties who have unrestricted use rights, you've lost the exemption.
The fix: Before claiming the small-business exemption, audit your data-sharing arrangements using the APDPA's sale definition. If you're in scope, you need the full compliance program: privacy notice updates, opt-out mechanisms, data subject request workflows, and security practices. If you're exempt, document why, because the burden of proof will be on you if challenged.
Mistake 5: Building an Appeal Process You Don't Need
Why it happens: Other state laws require controllers to provide an appeal mechanism when they deny a consumer rights request. You've built an internal review workflow and trained your support team.
The consequence: The APDPA doesn't require an appeal process. If you've allocated resources to build one, you've over-invested. If you've promised an appeal process in your privacy notice and then fail to provide it, you've created a compliance risk.
The fix: Review your privacy notice. If you've promised an appeal right to all US consumers, either implement it for Alabama or revise the notice to specify which states receive appeal rights. If you're building a multi-state compliance program, consider implementing appeals everywhere for consistency.
Mistake 6: Ignoring the Trade Secret Carve-Out
Why it happens: You're used to responding to access and portability requests by exporting all data tied to the consumer's identifier.
The consequence: The APDPA allows you to withhold data if providing it would reveal a trade secret. This applies to both access and portability requests. If your recommendation engine's logic is proprietary, you don't have to export the raw model inputs.
The fix: Identify which data elements, if disclosed, would reveal trade secrets. Document the business justification. When you receive an access or portability request, apply the carve-out and explain it in your response. Use it surgically for genuinely sensitive data.
Prevention Checklist
Before May 1, 2027:
- Calculate your consumer processing volume, exclude payment-transaction-only data
- Audit every third-party data transfer for material benefit and unrestricted use rights
- Separate targeted advertising opt-outs from sale opt-outs in your workflows
- Map which states require identity verification and which prohibit it for opt-outs
- If you have fewer than 500 employees, confirm whether you sell data under Alabama's definition
- Decide whether to implement an appeal process (optional in Alabama, required in peer states)
- Identify trade-secret data elements and draft justification language for carve-outs
- Update your privacy notice to reflect Alabama's sale definition and opt-out categories
- Set a 45-day response SLA for all consumer requests, with documented extension procedures
- Train your support team on Alabama-specific rules: verification, trade secret carve-outs, and the absence of GPC mandates
The APDPA's May 2027 effective date gives you time, but only if you start mapping now. Mid-sized businesses have historically flown under state privacy thresholds. Alabama just lowered the ceiling.
