Alabama · verified official-source register

Alabama Privacy Enforcement Cases

3 verified case records from the authoritative 50-state register. The fields below preserve the supplied amount, date, legal basis and explanation of why the action was brought.

3 official case source links · state register dated August 31, 2026

Actual case links

Alabama case register

Each record links directly to the official Attorney General or state-agency source supplied for this register. Shared multistate amounts are reproduced as stated and should not be summed as unique state penalties.

Verified case 1 of 3

23andMe

Date
2026-07-16
Amount
$150 million in allowed claims for states; recovery limited to $18 million; Alabama share: $260,817; separate $46.75 million class-action settlement for affected U.S. consumers
Legal basis
No statutes or laws cited in the document

Why the action was brought

The 2023 credential-stuffing breach compromised genetic and other customer data of 6.9 million people worldwide, including 69,950 Alabama consumers; subsets appeared for sale on the dark web. Investigators found unreasonable security practices, including inadequate safeguards, rate limiting, monitoring, investigation of unusual logins, vulnerability remediation, and design-feature testing.

View Official Case Source ↗ (opens in a new tab)

Verified case 2 of 3

Blackbaud

Date
2023-10-05
Amount
$49.5 million payment to the states; Alabama’s share: $1.6 million
Legal basis
state consumer protection laws, breach notification laws, and HIPAA

Why the action was brought

Blackbaud’s software served nonprofits and stored contact and demographic information, Social Security and driver’s license numbers, financial, employment and wealth information, donation history, and protected health information. It allegedly failed to implement reasonable security and remediate known gaps, enabling unauthorized network access, then delayed, incomplete, or inaccurate breach notices, exposing information of consumers.

View Official Case Source ↗ (opens in a new tab)

Verified case 3 of 3

Google

Date
November 14, 2022
Amount
$391.5 million; Alabama will receive $7.6 million
Legal basis
state consumer protection laws

Why the action was brought

Google collected consumers’ location data through Location History and Web & App Activity, including Web & App Activity being automatically on. Since at least 2014, it allegedly misled consumers about the settings’ scope, existence, and ability to limit tracking, exposing sensitive location information that could reveal identities, routines, and personal details.

View Official Case Source ↗ (opens in a new tab)

Source data is based on verified concluded privacy, data-breach and data-security enforcement actions located on official state Attorney General or state-agency sources. Multistate settlement amounts are reproduced as stated by the official source and should not be summed as unique state penalties.

Educational information, not legal advice.

Back to AlabamaAll states