DPO SchoolDPO School

Oklahoma consumer data privacy act (Enrolled Senate Bill 546; the act gives itself no short title)

Oklahoma privacy law: consumer rights

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Consumers may confirm processing and access their data, correct it, delete it, obtain a portable copy of data they provided (if held digitally), and opt out of targeted advertising, sale and profiling for decisions with legal or similarly significant effects. Controllers must respond within 45 days, extendable once by 45 days with notice, and must offer an appeal answered in writing within 60 days. Responses are free up to twice a year, and controllers must offer at least two request methods.

Key points

  1. Rights to confirm and access, correct, delete, and obtain a portable copy of data the consumer previously provided, if held in digital form.

    Section: SB 546 § 2(B)(1) to (4) (75A O.S. § 301)

  2. Right to opt out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects.

    Section: SB 546 § 2(B)(5) (75A O.S. § 301)

  3. Response within 45 days; one extension of 45 days with notice and reasons within the first period.

    Section: SB 546 § 3(B) (75A O.S. § 302)

  4. Free of charge up to twice a year per consumer; fee or refusal for manifestly unfounded, excessive or repetitive requests.

    Section: SB 546 § 3(D) (75A O.S. § 302)

  5. Appeal process required; written answer within 60 days; on denial, the controller must give the Attorney General's online complaint mechanism.

    Section: SB 546 § 4 (75A O.S. § 303)

  6. At least two secure and reliable request methods; no new account may be required; online-only controllers may offer just an email address.

    Section: SB 546 § 6 (75A O.S. § 305)

  7. Contract terms that waive or limit these rights are void.

    Section: SB 546 § 5 (75A O.S. § 304)

Sources

Compare consumer rights across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Oklahoma statute

Reference material, not legal advice.