Technology (Data Privacy)

SB 272 requires public schools and government offices to redact financial details like account numbers and tax IDs from public records before releasing them. It also prohibits using school directory lists (names and addresses of individuals or entities) for selling products or services to those listed. Requesters of such records must certify they won’t misuse the data, and violators face civil penalties up to $500 per violation. The law directly affects school districts, businesses seeking public records, and anyone handling school-related personal information.

HB 351, the Alabama Personal Data Protection Act, grants Alabama residents specific rights over their personal data. It allows consumers to confirm if their data is being processed, correct inaccuracies, request deletion, obtain copies of their data, and opt out of data processing. Businesses (referred to as "controllers") must establish secure methods for consumers to exercise these rights and create appeal processes for denied requests. The bill also regulates how businesses handle deidentified data and authorizes the Attorney General to enforce these rules.

HB 324 requires AI chatbot providers to verify the age of all users through a strict process (like government ID, not just birth dates) and prevents minors under 19 from accessing chatbots with human-like features (e.g., those suggesting sentience or emotional bonding). It mandates providers to offer a simplified version without such features to minors if reasonable, implement safety protocols to detect and respond to emergencies (like self-harm), and limit data collection to what’s necessary for legitimate purposes. Therapeutic chatbots meeting specific standards, prescribed by a licensed psychiatrist, may still be used by minors. The bill directly affects AI chatbot providers and minors, creating enforceable requirements without banning chatbots entirely.

SB 230 modifies Alabama's campaign finance rules to allow campaign funds to cover specific security costs for candidates, elected officials, and their immediate families or staff. It permits using contributions for cybersecurity services (like removing personal data from data brokers), home security devices (locks, cameras, alarms - excluding property value improvements), and security personnel. The bill explicitly defines "security expenses" to prevent misuse of funds for non-security purposes. This change applies directly to political campaigns and officeholders seeking to protect themselves or their close associates. The bill is currently pending in the Alabama House Judiciary Committee.

This bill updates Alabama's doxing law by making it a crime to intentionally share someone's personal information (like home addresses or photos of their children) online with the intent that others use it to harass or harm them, even if no actual harm occurs. It increases penalties for repeat offenses and specifically targets doxing directed at law enforcement officers, firefighters, or public servants, with higher penalties when these individuals are harmed or impeded in their duties. The law explicitly excludes protected political speech and publishing public officials' contact information for lobbying purposes. Penalties range from a Class A misdemeanor for a first offense to a Class B felony for repeat offenses targeting public servants.