Alabama became the 21st state with a comprehensive privacy law, enacting the APDPA with low thresholds, narrow “sale” definitions, and limited enforcement risk.