Alabama Biometric Privacy Laws: Collection, Consent & Penalties (2026)

Alabama has no standalone biometric privacy law in effect today, and its Data Breach Notification Act (Ala. Code 8-38-1 et seq.) does not list biometric data among the categories that trigger a breach notice. That changes on May 1, 2027, when the Alabama Personal Data Protection Act (HB 351, signed into law April 2026) takes effect and classifies biometric data processed to identify a specific person as sensitive data requiring a consumer''s opt-in consent.

Alabama does not have a standalone biometric privacy law. Unlike Illinois, Texas, and Washington, the state has not enacted legislation that specifically regulates how private businesses collect, store, use, or share biometric identifiers such as fingerprints, facial geometry, or iris scans.

Alabama''s breach notification law does not include biometric data in its definition of protected sensitive personally identifying information, so a breach exposing only biometric identifiers does not, by itself, trigger a notice obligation under current law. That gap narrows in 2027, when the Alabama Personal Data Protection Act begins treating biometric data used to identify a person as sensitive data requiring opt-in consent before it can be processed.

This guide explains the current legal framework, what protections exist, where the gaps are, and what may change.

For broader context on Alabama''s overall privacy framework, see the parent guide to Alabama Data Privacy Laws.

How Alabama Defines Biometric Data

Alabama''s Data Breach Notification Act does not currently define biometric data at all. Ala. Code 8-38-2 defines "sensitive personally identifying information" as a person''s first name or initial and last name combined with categories such as a Social Security number, a driver''s license or state ID number, a financial account number with a security code, medical history or health-insurance information, or a username or email address paired with a password. Biometric identifiers such as fingerprints, voiceprints, or retina and iris images are not among the enumerated categories, so a breach that exposes only biometric data does not by itself trigger the Act''s 45-day notice requirement.

That changes on May 1, 2027, when the Alabama Personal Data Protection Act (HB 351, signed into law April 2026) takes effect. It defines biometric data as data generated by automatic measurements of an individual''s biological characteristics, such as a fingerprint, voiceprint, retina, or iris, used to identify a specific person, and classifies it as sensitive data. Covered businesses will need a consumer''s affirmative opt-in consent before processing it.

Until then, biometric data collected in Alabama can still receive indirect protection if it is combined with other information the Act does cover, such as a name plus a financial account number, but the biometric identifier itself is not the trigger.

Alabama Data Breach Notification Act of 2018 (Ala. Code 8-38-1 et seq.)

Alabama''s primary biometric protection comes from the Data Breach Notification Act of 2018, signed into law as Acts 2018-396. This law was among the last state breach notification laws enacted in the United States. Alabama and South Dakota were the final two states to adopt breach notification requirements.

What the Law Requires

Any covered entity that acquires or uses sensitive personally identifying information of Alabama residents must follow several requirements under this law.

Reasonable security measures. Covered entities must implement and maintain reasonable security measures to protect sensitive personally identifying information against a breach of security (Ala. Code 8-38-3).

Good faith investigation. After discovering or being notified of a breach, a covered entity must conduct a good faith and prompt investigation to determine the likelihood that the information has been or will be misused.

Individual notification within 45 days. If a breach compromises information within the Act''s definition of sensitive personally identifying information, such as a name combined with a Social Security number, financial account number, or medical information, and is reasonably likely to cause substantial harm, the entity must notify affected Alabama residents as expeditiously as possible but no later than 45 days after the determination that a breach occurred (Ala. Code 8-38-5). Biometric data alone, without a name and one of the Act''s other enumerated categories, does not trigger this requirement under current law.

Attorney General notification. If the breach affects more than 1,000 individuals, the entity must also notify the Alabama Attorney General within 45 days.

Third-party agent notification. Third-party agents that maintain data on behalf of a covered entity must notify the covered entity within 10 days of discovering a breach.

Penalties for Non-Compliance

A covered entity that fails to comply with notification requirements faces penalties under Ala. Code 8-38-9.

Ala. Code 8-38-9 sets out two separate penalty tracks rather than a single capped one. A covered entity that knowingly (willfully or with reckless disregard) violates the notice requirements is subject to the penalty under Ala. Code 8-19-11, which is capped at $500,000 per breach. Separately, and notwithstanding that cap, any covered entity that fails to take reasonable action to comply with the notice provisions is liable for a civil penalty of up to $5,000 per day for each consecutive day of non-compliance, with no stated dollar ceiling on that track.

A violation of the Act constitutes an unlawful trade practice under the Alabama Deceptive Trade Practices Act (Ala. Code 8-19-1 et seq.).

The Alabama Attorney General holds exclusive authority to bring enforcement actions for civil penalties and to pursue damages on behalf of named individuals. Recovery in such actions is limited to actual damages plus reasonable attorney fees and costs.

No Private Right of Action

Alabama''s breach notification law does not create a private cause of action. Individuals cannot sue a covered entity directly under this statute for failing to provide timely notification. Only the Attorney General can bring enforcement actions.

This is a significant distinction from states like Illinois, where BIPA grants individuals the right to sue and recover statutory damages of $1,000 to $5,000 per violation.

Exemptions

The law includes several exemptions. Information that has been encrypted, secured, or modified by any method or technology that removes personally identifying elements or renders the information unusable is excluded from the definition of sensitive personally identifying information.

Financial institutions that comply with the Gramm-Leach-Bliley Act and entities that comply with HIPAA are deemed in compliance with Alabama''s security requirements.

What Alabama Law Does Not Cover

Alabama''s existing laws leave significant gaps in biometric privacy protection.

No general consent requirement. Alabama does not require businesses or employers to obtain consent before collecting biometric data from adults. An employer can implement fingerprint time clocks or facial recognition systems without notifying employees or getting their approval.

No retention or destruction timelines. The state does not mandate specific retention schedules or destruction timelines for biometric data held by private entities.

No restrictions on biometric data sales. Alabama does not prohibit or restrict the sale or sharing of biometric data with third parties.

No private right of action for collection practices. There is no state law allowing individuals to sue because a company collected their fingerprints or facial scans without consent.

One narrow law enforcement limit, and nothing broader. Alabama''s only statutory restriction on government biometric surveillance covers facial recognition match results. Under Ala. Code 15-10-111, enacted as Act 2022-420, a state or local law enforcement agency may not use facial recognition technology match results as the sole basis to establish probable cause in a criminal investigation or to make an arrest, and may use those results only in conjunction with other lawfully obtained information and evidence. Ala. Code 15-10-110 supplies the definitions of facial biometric data and facial recognition technology. Outside that rule, Alabama has not limited government collection, retention, or sharing of biometric data.

Employer Use of Biometric Data in Alabama

Alabama has no state law that restricts employers from collecting biometric data from employees. Companies operating in Alabama that use fingerprint scanners for timekeeping, facial recognition for building access, or other biometric systems are not required by state law to:

• Provide written notice before collecting biometric data
• Obtain employee consent
• Establish data retention or destruction policies
• Limit sharing of employee biometric data with vendors or third parties

This stands in sharp contrast to Illinois, where employers face statutory damages of $1,000 to $5,000 per violation of the Biometric Information Privacy Act.

That said, employers should still implement reasonable security measures for biometric data as a matter of practice. Under current Alabama law, a breach that exposes only employee biometric data does not by itself trigger the Data Breach Notification Act''s 45-day notice requirement, since biometric data is not among the Act''s enumerated categories; the duty applies only if the biometric data is exposed together with a name and one of the Act''s other covered categories, such as a Social Security or financial account number.

Alabama's New Comprehensive Privacy Law: What Changes for Biometric Data in 2027

Alabama enacted its first comprehensive consumer privacy law in 2026, and it directly addresses biometric data in a way the 2018 breach notification law does not.

HB 351, the Alabama Personal Data Protection Act (APDPA). The Alabama Legislature passed HB 351 in April 2026, and the governor signed it into law that same month. The Act takes effect May 1, 2027, and applies to businesses that control or process the personal data of more than 25,000 Alabama residents, or that derive more than 25 percent of gross revenue from selling personal data. The APDPA classifies genetic or biometric data processed to uniquely identify a person as sensitive data, and it prohibits a covered controller from processing sensitive data concerning a consumer without first obtaining that consumer''s affirmative opt-in consent. The Act''s definition of consumer excludes an individual acting in a commercial or employment context or as an employee or contractor, so that consent duty runs to consumer-facing processing and does not reach biometric data an employer collects from its own workforce.

One earlier bill did not become this law: HB283 (2025 Regular Session) proposed an earlier version of a comprehensive privacy framework and did not pass. HB 351 is the bill that succeeded. A separate 2026 bill, SB272, introduced by Senator Orr, is unrelated to the comprehensive privacy framework. It requires redaction of financial-transaction information, such as account and routing numbers, from public records requested from local boards of education, and it restricts reselling address lists derived from those records, citing the Data Breach Notification Act''s Section 8-38-2 definition of sensitive personally identifying information.

Once the APDPA takes effect, Alabama''s biometric data protection will move closer to the opt-in consent model used by states like Colorado, Connecticut, and Virginia, though Alabama''s law will only apply to businesses that meet its size or revenue thresholds.

Federal Protections That Apply in Alabama

Because Alabama lacks a comprehensive biometric privacy law, federal statutes provide additional protections for residents.

Section 5 of the FTC Act allows the Federal Trade Commission to take enforcement action against companies engaged in unfair or deceptive practices involving biometric data, including failures to secure biometric information.

HIPAA protects biometric data collected or used by covered healthcare entities and their business associates under the Privacy Rule.

COPPA requires parental consent before collecting biometric data from children under 13, enforced by the FTC.

How Alabama Compares to Other States

Alabama falls into a lower tier of states for biometric privacy protection today, though that will change in 2027. Because Alabama''s breach notification law does not separately cover biometric data, and because the state''s new comprehensive privacy law will not take effect until May 2027, Alabama currently lacks both breach-notification coverage and the collection-level protections found in more protective states.

• Illinois has the strongest biometric law in the nation (BIPA), with a private right of action and statutory damages of $1,000 to $5,000 per violation
• Texas and Washington have biometric-specific statutes enforced by their attorneys general
• States with comprehensive privacy laws (Colorado, Connecticut, Virginia) classify biometric data as sensitive and require opt-in consent
• Alabama currently has no biometric-specific protection; a breach exposing only biometric data does not trigger its 2018 breach notification law. Starting May 1, 2027, the Alabama Personal Data Protection Act will require opt-in consent for consumer biometric data processed by covered businesses

This article provides general legal information about Alabama biometric privacy laws. It is not legal advice. Laws and regulations change frequently, and this content may not reflect the most recent developments. Consult a qualified attorney licensed in Alabama for advice about your specific situation.

More Alabama Laws

• Alabama Deepfake Laws
• Alabama Employee Monitoring Laws
• Alabama GPS Tracking Laws
• Alabama Recording Laws

Frequently Asked Questions

Does Alabama have a biometric privacy law?

Not yet in a comprehensive way. Alabama does not have a standalone biometric privacy statute like Illinois BIPA, and its Data Breach Notification Act of 2018 (Ala. Code 8-38-1 et seq.) does not include biometric data among the categories that trigger a breach notice. That changes on May 1, 2027, when the Alabama Personal Data Protection Act (HB 351, enacted 2026) takes effect and requires covered businesses to obtain opt-in consent before processing biometric data used to identify a person.

Can my employer collect my fingerprints without consent in Alabama?

Yes, under current law. Alabama has no statute requiring employers to obtain consent before collecting biometric data such as fingerprints or facial scans from employees, and employers can implement fingerprint time clocks, facial recognition access systems, or other biometric tools without providing written notice or obtaining approval. A breach that exposes only biometric data does not by itself trigger a notification duty under Alabama''s current breach notification law. The Alabama Personal Data Protection Act does not close this gap when it takes effect on May 1, 2027. The Act defines a consumer to exclude an individual acting in a commercial or employment context or as an employee, owner, director, officer, or contractor, and its opt-in consent duty reaches only sensitive data concerning a consumer, so biometric data an employer collects from its own workforce in that role falls outside it.

What are the penalties for a biometric data breach in Alabama?

Alabama''s Data Breach Notification Act does not treat a breach of biometric data alone as a reportable breach, so its penalties apply only if the biometric data was exposed together with a name and another covered category, such as a Social Security or financial account number. In that scenario, Ala. Code 8-38-9 sets two separate penalty tracks: a covered entity that knowingly violates the notice requirements faces a civil penalty under Ala. Code 8-19-11, capped at $500,000 per breach, while any covered entity that fails to take reasonable action to comply, regardless of intent, is separately liable for up to $5,000 per day for each day of non-compliance, with no stated dollar cap on that track. The Attorney General has exclusive enforcement authority. Starting May 1, 2027, the Alabama Personal Data Protection Act adds separate consent obligations for biometric data, also enforced by the Attorney General.

Can I sue a company in Alabama for collecting my biometric data without permission?

No. Alabama does not provide a private right of action for the unauthorized collection of biometric data. The state''s breach notification law also does not allow individuals to sue directly. Only the Alabama Attorney General can bring enforcement actions. This differs from Illinois, where individuals can recover $1,000 to $5,000 per violation of the Biometric Information Privacy Act.

Does Alabama require businesses to delete biometric data?

No. Alabama does not have a law that requires businesses to delete biometric data after a specific period or upon request. The state has no retention schedule or destruction mandate for biometric information held by private entities. The only data-related destruction requirement exists within the breach notification framework, which focuses on notification obligations rather than data lifecycle management.