The Plot Thickens….. Part 2: Alabama, Kentucky, Maine, And Maryland Join The Fracas

In March I posted about three new AI and Privacy Laws in Colorado, Oklahoma and California. This month, we have four more states adding their own privacy regulations to the field.

Alabama, Kentucky, Maine, and Maryland are the latest states to launch new or revised privacy and AI laws. Alabama is the 21st state to enact a comprehensive consumer privacy law, Kentucky added a new consent rule for smart-TV automatic content recognition data, Maine came surprisingly close to adopting one of the toughest anti-targeting frameworks in the country, and Maryland has moved privacy law further into the realm of recipient- and use-based restrictions. States are increasingly regulating different pieces of the advertising ecosystem in different ways.

Alabama

Alabama’s Personal Data Protection Act was signed in April 2026 and takes effect on May 1, 2027. In doing so, Alabama became the 21st state to enact a comprehensive consumer privacy law.

What makes Alabama particularly notable is scope. The law applies to entities that control or process the personal data of more than 25,000 consumers, excluding payment transaction data, or derive more than 25% of gross revenue from the sale of personal data. That more-than-25,000-consumer threshold is unusually low and should catch the attention of mid-sized businesses that may have assumed they were below the line in most states.

For marketers, the definition of “sale” is also important. Alabama excludes certain disclosures of personal data to third parties providing analytics or marketing services solely on behalf of the controller. That carve-out is not a free pass, but it does matter when evaluating measurement, attribution, ad-tech, and audience-service relationships. In practical terms, businesses should be reviewing contracts and data flows now to determine whether those relationships fit within the law’s narrower permitted-service framework or instead trigger consumer rights and notice implications. The law also includes teen-data protections. Alabama requires consent before processing personal data for targeted advertising or sale when the controller has actual knowledge, or willfully disregards, that the consumer is at least 13 and under 16 years old.

What does this mean for advertisers and marketers? If you operate across multiple states, Alabama is another reason to revisit your thresholds analysis, update your privacy disclosures, and audit whether your vendor arrangements are truly structured as service relationships rather than de facto third-party data-sharing models.

Kentucky
Kentucky’s Consumer Data Protection Act already took effect on January 1, 2026. But the legislature moved again this session, and House Bill 692 was signed by the Governor on April 13, 2026, with an effective date of July 1, 2027. The important compliance point is this: the final enacted bill prohibits controllers from collecting automatic content recognition, or ACR, data without consumer consent.

The final enacted measure does not simply add ACR data into Kentucky’s definition of “sensitive data.” Instead, it imposes a direct consent requirement for ACR collection. The difference matters for lawyers and product teams and for marketers, this means a high-value source of connected-TV and viewing-behavior information is now subject to an explicit consent gate.

What does this mean for marketers and advertisers? This law has implications for audience building, attribution, and measurement. Connected-TV strategies that depend on passively collected viewing data are becoming more legally fragile at the state level. Companies that buy, license, or activate smart-device or connected-TV audience data should be pressing vendors now on consent processes and data collection compliance.

Maine
Maine did not enact LD 1822. The official legislative status shows that the bill died between houses on April 13, 2026. While this is the formal legislative outcome, it’s not the takeaway. LD 1822 was a serious effort to push state privacy law toward more aggressive restrictions on targeted advertising and broader obligations around data minimization and transparency. Even though the bill failed, it revealed what future legislative drafts may look like.

What does this mean for marketers and advertisers? For advertising, ad-tech, retail media, and data-driven consumer marketing, this failed bill may reveal which ideas are gaining traction, what business groups are worried about, and what may return next session with revised language. Maine remains a state to watch closely, especially for businesses that rely heavily on behavioral targeting, broad consumer profiling, or expansive data-collection practices that are increasingly difficult to defend under a necessity-based privacy framework.

Maryland
According to the official bill summary, Maryland House Bill 711 prohibits a controller from knowingly selling personal data to certain governmental units that have engaged in or supported civil immigration enforcement under specified circumstances. The bill also includes provisions involving public records access and message switching systems, reinforcing that this is not a conventional ad-tech amendment alone.

For marketers, the direct day-to-day impact may be less obvious than in Kentucky. But Maryland is still important because it shows how privacy legislation is evolving. This is about regulating who receives data and why and is important for businesses that participate in the data ecosystem, whether as collectors, buyers, licensors, or users.

What does this mean for marketers and advertisers? Even if your business is not operating anywhere near the immigration-enforcement context addressed by the bill, it appears that states are willing to use privacy statutes to regulate downstream use cases that go beyond traditional consumer-marketing concerns. Further, when laws begin to care not only about collection and disclosure, but also about who the recipient is and what the recipient intends to do, contract structure becomes even more important.

What do marketers and advertisers need to focus on now? The already fragmented legal framework for privacy is well, still fragmented. This creates a more complex operating environment for marketing teams as national campaigns will increasingly rely on state-specific rules around consent and vendor management. Now is a good time to audit vendor agreements, map your audience segments, confirm how data is handled (both personal and sensitive), and push legal review earlier in campaign design. That bears repeating – push legal review earlier in campaign design.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.