DPO SchoolDPO School

Oklahoma consumer data privacy act (Enrolled Senate Bill 546; the act gives itself no short title)

Oklahoma privacy law: controller duties

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and get consent for incompatible new purposes. They must publish a clear privacy notice and, if they sell data or use it for targeted advertising, disclose this and how to opt out. Data protection assessments are required for targeted advertising, sales, risky profiling, sensitive data and other high-risk processing. The act contains no duty to honour universal opt-out signals.

Key points

  1. Collection limited to what is adequate, relevant and reasonably necessary for the disclosed purposes.

    Section: SB 546 § 7(A)(1) (75A O.S. § 306)

  2. Reasonable administrative, technical and physical security practices.

    Section: SB 546 § 7(A)(2) (75A O.S. § 306)

  3. Consent needed for processing that is neither reasonably necessary to nor compatible with the disclosed purposes.

    Section: SB 546 § 7(B)(1) (75A O.S. § 306)

  4. Privacy notice must state categories of data (including sensitive data), purposes, how to exercise and appeal rights, and categories of data shared and of third parties.

    Section: SB 546 § 8(A) (75A O.S. § 307)

  5. Sale and targeted advertising must be disclosed clearly, with the way to opt out.

    Section: SB 546 § 8(B) (75A O.S. § 307)

  6. Data protection assessments for targeted advertising, sale, risky profiling, sensitive data and other heightened-risk processing; available to the Attorney General on a civil investigative demand.

    Section: SB 546 § 10(A), (C) (75A O.S. § 309)

  7. No provision requires honouring a universal opt-out mechanism or browser signal.

    Section: SB 546 §§ 2 to 8 (75A O.S. §§ 301 to 307)

Sources

Compare controller duties across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Oklahoma statute

Reference material, not legal advice.