AK HB367: Consumer Data Privacy Act

In one paragraph

Alaska's HB 367 (2026), as the House Judiciary committee substitute CSHB 367(JUD), would have created a consumer data privacy article in AS 45.48 and a data broker registry, amended the social security number laws, and made certain violations unfair or deceptive trade practices. It would have applied to businesses that collected or processed the data of at least 35,000 consumers (or 10,000 consumers with over 20 percent of gross revenue from selling data). It was referred to House Finance on May 12, 2026 and died when the session ended May 20, 2026.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None: the bill died and never became law. It would have required covered businesses to honor consumer access, deletion and opt-out requests, including opt-outs from profiling used for automated decisions.

Key provisions

1. 1Would apply to a person doing business in Alaska that in the preceding calendar year collected or processed the personal data of at least 35,000 consumers (not counting data processed solely to complete a payment transaction), or at least 10,000 consumers while deriving more than 20 percent of gross revenue from selling personal data (AS 45.48.800)
2. 2Would exempt the federal government, the state, public corporations, the University of Alaska, municipalities, school districts, regional educational attendance areas and tribal governments (AS 45.48.800(b))
3. 3Would give consumers the right to confirm and access data, get a list of third-party recipients, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale of data, or profiling used for automated decisions with legal or similarly significant effects (AS 45.48.805)
4. 4Would bar controllers and processors from collecting, processing or transferring personal data in a way that discriminates based on race, color, sex, sexual orientation, gender identity, disability, religion, ancestry or national origin, with listed exceptions
5. 5Would require controllers to offer a clear "Do Not Sell My Personal Information" link and honor an opt-out preference signal (AS 45.48.810(b))
6. 6Would require the state to maintain a data broker registry and create a consumer privacy account; the captured text is cut off before the registry duties and penalties
7. 7Referred to House Finance on May 12, 2026 after Judiciary reported the committee substitute; died when the 34th Legislature's 2026 session ended May 20, 2026

Latest legislative action

May 12, 2026. REFERRED TO FINANCE; died when the 34th Alaska Legislature's 2026 session ended May 20, 2026

Sponsors