--- title: "Oklahoma privacy law: controller duties" canonical: "https://dposchool.com/state-privacy-laws/state/oklahoma/controller-duties" source: "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Oklahoma consumer data privacy act (Enrolled Senate Bill 546; the act gives itself no short title) # Oklahoma privacy law: controller duties Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and get consent for incompatible new purposes. They must publish a clear privacy notice and, if they sell data or use it for targeted advertising, disclose this and how to opt out. Data protection assessments are required for targeted advertising, sales, risky profiling, sensitive data and other high-risk processing. The act contains no duty to honour universal opt-out signals. ## Key points 1. Collection limited to what is adequate, relevant and reasonably necessary for the disclosed purposes. Section: [SB 546 § 7(A)(1) (75A O.S. § 306)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf) 2. Reasonable administrative, technical and physical security practices. Section: [SB 546 § 7(A)(2) (75A O.S. § 306)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf) 3. Consent needed for processing that is neither reasonably necessary to nor compatible with the disclosed purposes. Section: [SB 546 § 7(B)(1) (75A O.S. § 306)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf) 4. Privacy notice must state categories of data (including sensitive data), purposes, how to exercise and appeal rights, and categories of data shared and of third parties. Section: [SB 546 § 8(A) (75A O.S. § 307)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf) 5. Sale and targeted advertising must be disclosed clearly, with the way to opt out. Section: [SB 546 § 8(B) (75A O.S. § 307)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf) 6. Data protection assessments for targeted advertising, sale, risky profiling, sensitive data and other heightened-risk processing; available to the Attorney General on a civil investigative demand. Section: [SB 546 § 10(A), (C) (75A O.S. § 309)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf) 7. No provision requires honouring a universal opt-out mechanism or browser signal. Section: [SB 546 §§ 2 to 8 (75A O.S. §§ 301 to 307)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf) ## Sources - [Enrolled Senate Bill 546 (2025-2026), full text](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf) [Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Oklahoma statute](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf) Reference material, not legal advice. ## Other topics for Oklahoma - [Applicability](https://dposchool.com/state-privacy-laws/state/oklahoma/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/oklahoma/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/oklahoma/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/state/oklahoma/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/oklahoma/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Oklahoma](https://dposchool.com/state-privacy-laws/state/oklahoma) / Controller duties Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/oklahoma/sensitive-data) Next: [Processors](https://dposchool.com/state-privacy-laws/state/oklahoma/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents