The exact details may depend on the filesystem, but conceptually, yes, the ACLs are metadata stored in the file inodes just like traditional permissions, dates, etc.
Since the size of ACLs can vary, they may end up being stored in separate blocks. However the details only matter if you're designing a filesystem or programming a filesystem driver.