HB 283 Alabama House · 2025 Regular Session

Data privacy, processing of data regulated, consumer actions related to data authorized

HB 283, known as the "Alabama Personal Data Protection Act," grants consumers new rights over their personal data collected online. It allows consumers to confirm if their data is being processed by an entity, correct inaccuracies, request deletion, obtain a copy of their data, and opt out of its processing. The bill requires entities that control personal data ("controllers") to establish secure methods for consumers to exercise these rights and also regulates the manner in which both personal and deidentified data can be processed.

Issues: ✓ Technology

Bill status passed 3 of 5 stages cleared

Introduction

Feb 2025

Committee Review

Apr 2025

House Passage

Apr 2025

Senate Passage

Governor

Introduced Feb 13, 2025 Last action Apr 24, 2025

Maddy AI version diff · 1 comparison

What changed between versions

Introduced → Engrossed · 10 edits · Apr 22, 2025

MAJOR

The bill was revised from its introduced version to an engrossed version, incorporating substantive changes to definitions and requirements for data privacy protections. Key modifications include expanded definitions of biometric data, consent, and controller responsibilities, along with adjustments to how deidentified data is handled and processed.

Scope change

The scope remains focused on data privacy protections for consumers in Alabama, but the engrossed version clarifies and expands certain definitions and requirements.

DEFINITION

Definition of 'BIOMETRIC DATA' was modified to clarify that it includes fingerprints, voiceprints, retina, or iris data used for identification, with specific exclusions for photographs and audio/video recordings.

New definition for 'ARTIFICIAL INTELLIGENCE MODEL' was added to define machine learning algorithms and their parameters, excluding downstream systems that use the model.

Definition of 'CONSENT' was expanded to require freely given, specific, informed, and unambiguous agreement, with clearer exclusions for general terms of use and dark patterns.

Definition of 'CONTROL' was updated to include the power to exercise controlling influence over the management of a company.

New definition for 'DARK PATTERN' was added to define user interfaces designed to subvert user autonomy or decision-making.

Definition of 'DEIDENTIFIED DATA' was modified to update the section reference from Section 10(a) and (b) to Section 11(a) and (b) regarding recipient obligations.

New definition for 'PRECISE GEOLOCATION DATA' was added to specify location data within a 1,750-foot radius, with exclusions for communications content and utility metering data.

New definition for 'PROCESS' was added to define any operation or set of operations performed on personal data, whether manual or automated.

REQUIREMENT

New definition for 'CONTROLLER' was added to define individuals or entities that determine the purposes and means of processing personal data.

The bill's title and synopsis were updated to reflect the engrossed version with more formal language and proper formatting.

Floor votes

How they voted

This bill passed the House by voice vote (no roll call recorded).

Full legislative history

Actions timeline

Total actions

Key actions

Committee

Amendments

Apr 24, 2025

Upper · Passed

Pending Committee Action in Second House (Fiscal Responsibility and Economic Development)

upper

Apr 22, 2025

Lower · Passed

Motion to Read a Third Time and Pass as Amended - Adopted Roll Call 944

lower

Apr 22, 2025

Lower · Passed

Motion to Adopt - Adopted Roll Call 943

lower

Apr 22, 2025

Introduced

Shaw 1st Substitute Offered

lower

Apr 22, 2025

Lower · Passed

Shaw motion to Table - Adopted Roll Call 942

lower

Apr 22, 2025

Introduced

Commerce and Small Business 1st Substitute Offered (Commerce and Small Business)

lower

Apr 9, 2025

Lower · Passed

Reported Out of Committee House of Origin

lower

Feb 13, 2025

Lower · Passed

Pending Committee Action in House of Origin (Commerce and Small Business)

lower

1 primary · 0 co-sponsors