Oklahoma consumer data privacy act (Enrolled Senate Bill 546; the act gives itself no short title)
Oklahoma privacy law: applicability
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
The act applies to controllers and processors that do business in Oklahoma or target products or services to its residents and that, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data. State agencies and political subdivisions (and their service providers), GLBA financial institutions, HIPAA covered entities and business associates, nonprofits and institutions of higher education are excluded at entity level. 'Consumer' excludes people acting in a commercial or employment context, and employment-related data is exempt.
Key points
Threshold: personal data of at least 100,000 consumers in a calendar year.
Data-seller threshold: at least 25,000 consumers and over 50% of gross revenue from selling personal data.
Entity-level exclusion for financial institutions and for data subject to Title V of GLBA.
Section: SB 546 § 15(B)(2) (75A O.S. § 314)
Entity-level exclusion for HIPAA covered entities and business associates; health records and other health data are also exempt.
Nonprofits (broadly defined, including political organizations) and institutions of higher education are excluded.
Section: SB 546 § 1(18); § 15(B)(4), (5) (75A O.S. §§ 300, 314)
Employment, emergency-contact and benefits data are exempt, as are FCRA, DPPA, FERPA and Farm Credit Act data.
'Sale' covers only exchanges for monetary consideration.
Section: SB 546 § 1(28) (75A O.S. § 300)
Sources
Compare applicability across all states
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Oklahoma statute
Reference material, not legal advice.