Consumer Reports—the independent, nonprofit member organization focused on marketplace transparency—is urging Alabama Governor Kay Ivey to veto House Bill 351, the Alabama Personal Data Protection Act, arguing that the legislation does too little to protect consumers.
“Governor Ivey should veto HB351 and ask the legislature to significantly strengthen it,” said Matt Schwartz, policy analyst at Consumer Reports, in a recent written statement. “This legislation adopts a lowest-common-denominator approach to privacy that will not meaningfully protect consumers. The bill includes definitions rife with loopholes, creates broad carveouts for key industries, and lacks universal opt-out controls that can help make privacy bills workable for consumers. It also lacks enforcement mechanisms that will actually incentivize companies to comply the first time around.”
While the organization praised the bill’s inclusion of basic consumer rights—such as the right for consumers to know the information companies have collected about them, the right to delete certain information, and the right to limit some data disclosures—they also argue that those rights are undercut by weak definitions of key terms like “sale” and “targeted advertising” which leave loopholes for companies to continue processing consumer data.
According to the organization, other loopholes in the bill include the lack of a universal opt-out provision, the lack of an authorized agent provision, insufficient enforcement mechanisms and a loophole related to pseudonymous data.
Additionally, the legislation includes carve outs that exempt certain financial institutions, businesses and political organizations from its provisions.
The Electronic Privacy Information Center, EPIC—a nonprofit that advocates for digital privacy rights—has also criticized HB351, stating that the bill would “fail to meaningfully protect consumers from the abuse of their personal data.”
Meanwhile, State Representative Mike Shaw, R-Hoover, HB351’s sponsor, has continued to stand behind his legislation.
“HB351 is the product of two years of hard work to create a common-sense framework that protects consumers while also remaining friendly to those who do business in our state,” Shaw recently told the International Association of Privacy Professionals, IAPP. “As someone with more than 30 years as a technology professional in a regulated environment, my goal with HB351 was to create a practical, workable law that protects the people of Alabama in the most responsible way possible.”
If Ivey does ultimately sign HB351 into law, Alabama would become the 21st state to pass such legislation, and the second to do so in 2026 after Oklahoma passed its own comprehensive privacy law in March.
