Biological and neural data; certain disclosures, transfers, and use by a covered entity prohibited unless consumer provides express consent, Attorney General authorized to enforce, civil penalties provided
HB436 creates new consumer privacy protections for Alabama residents’ biological data and neural data. It defines those terms broadly to cover data generated from biological, genetic, biochemical, physiological, or nervous-system measurements, including data used for identification purposes. The bill applies to “covered entities” that maintain, own, or license such data in the course of business.
Under the bill, a covered entity could not transfer or disclose a consumer’s biological or neural data to a third party, use it for purposes beyond what is necessary to provide the requested goods or services, or market to the consumer based on that data unless the consumer gives express consent before each specific transfer, disclosure, or use. The bill also requires notice to consumers before certain other uses and gives consumers the ability to limit or prevent those uses.
HB436 would add a new layer of state-level privacy regulation for sensitive biometric and neurodata, affecting businesses that collect, store, license, or use such information in Alabama. It would create enforceable duties around consent, notice, and permissible use, and authorize the Consumer Interest Division of the Office of the Attorney General to bring civil actions, seek injunctions, and recover civil penalties of up to $3,000 per violation, with possible fee awards and restitution-related waivers.
The bill appears to be framed as a consumer-protection measure, with no recorded committee transcript or vote history indicating opposition or support beyond its introduction and pending committee status. Its sponsor and caption suggest a privacy-focused intent, and the absence of recorded debate means the available record does not show formalized controversy or consensus. Overall, the bill’s posture suggests a neutral-to-supportive policy environment at this stage, but without documented committee action.
The main points of potential contention are likely to be the scope of the consent requirement, the breadth of the definitions of biological and neural data, and the compliance burden on businesses that collect or process sensitive data. Privacy advocates would likely favor the bill’s restrictions and enforcement tools, while affected industries may object to the need for express consent before each specific use, the marketing ban, and the civil penalty structure. Because there are no committee transcripts or votes, these concerns are inferred from the bill’s provisions rather than from recorded debate.