Comprehensive state privacy law
Oklahoma privacy law
Oklahoma consumer data privacy act (Enrolled Senate Bill 546; the act gives itself no short title)
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Okla. Stat. tit. 75A, §§ 300 to 320 (to be codified by SB 546 (2026), Secs. 1 to 21)
- In force
- Enacted, in force January 1, 2027
- Effective dates
- January 1, 2027: whole act (Sec. 22)
- January 1, 2027: data protection assessments apply only to processing activities that begin on or after this date (Sec. 10(G))
- Enforcer
- Attorney General (exclusive)
- Private right of action
- No. The act expressly provides no basis for a private right of action (Sec. 14(E)).
- Cure period
- 30 days. The Attorney General must give 30 days' written notice; no action may be brought if the violation is cured and a written statement with supporting documentation and an assurance of no further violations is given. The cure period does not expire. (SB 546 § 13 (75A O.S. § 312))
- Rulemaking
- No. No rulemaking power. The Attorney General must post information on controller and processor duties and consumer rights, and an online complaint mechanism (Sec. 12(B)).
Amendments
No amendments recorded.
Topics
- ApplicabilityThe act applies to controllers and processors that do business in Oklahoma or target products or services to its residents and that, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data. State agencies and political subdivisions (and their service providers), GLBA financial institutions, HIPAA covered entities and business associates, nonprofits and institutions of higher education are excluded at entity level. 'Consumer' excludes people acting in a commercial or employment context, and employment-related data is exempt.
- Consumer rightsConsumers may confirm processing and access their data, correct it, delete it, obtain a portable copy of data they provided (if held digitally), and opt out of targeted advertising, sale and profiling for decisions with legal or similarly significant effects. Controllers must respond within 45 days, extendable once by 45 days with notice, and must offer an appeal answered in writing within 60 days. Responses are free up to twice a year, and controllers must offer at least two request methods.
- Sensitive dataControllers may not process sensitive data without the consumer's consent, and a known child's sensitive data must be processed under COPPA. Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used for unique identification, data collected from a known child (under 13), and precise geolocation within 1,750 feet. The act sets no special rule for teenagers.
- Controller dutiesControllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and get consent for incompatible new purposes. They must publish a clear privacy notice and, if they sell data or use it for targeted advertising, disclose this and how to opt out. Data protection assessments are required for targeted advertising, sales, risky profiling, sensitive data and other high-risk processing. The act contains no duty to honour universal opt-out signals.
- ProcessorsProcessors must follow controller instructions and help with consumer requests, security and breach notification, and assessments. A contract must set clear instructions, nature and purpose, data types, duration and both parties' rights and obligations. It must also require confidentiality, deletion or return at the end, compliance information, cooperation with assessments (or an independent assessment), and written flow-down contracts with subcontractors.
- EnforcementThe Attorney General has exclusive enforcement authority and there is no private right of action. Before suing, the Attorney General must give 30 days' written notice, and no action may follow if the violation is cured and a written statement with supporting documentation is given; this cure right does not expire. Violations after the cure period, or breach of the written statement, carry civil penalties of up to $7,500 per violation, plus injunctions and attorney fees.
Sources
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Oklahoma statute
Reference material, not legal advice.