Oklahoma consumer data privacy act (Enrolled Senate Bill 546; the act gives itself no short title)
Oklahoma privacy law: sensitive data
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Controllers may not process sensitive data without the consumer's consent, and a known child's sensitive data must be processed under COPPA. Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used for unique identification, data collected from a known child (under 13), and precise geolocation within 1,750 feet. The act sets no special rule for teenagers.
Key points
Sensitive data may be processed only with consent.
Section: SB 546 § 7(B)(4) (75A O.S. § 306)
Sensitive data categories: race or ethnicity, religion, health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric identifiers, known-child data and precise geolocation.
Section: SB 546 § 1(29) (75A O.S. § 300)
'Child' means under 13; a known child's sensitive data must be processed in line with COPPA.
Compliance with COPPA verifiable parental consent satisfies the act's parental consent duties.
Section: SB 546 § 17 (75A O.S. § 316)
Consent excludes broad terms of use, hovering, muting, pausing or closing content, and dark patterns.
Section: SB 546 § 1(7) (75A O.S. § 300)
Biometric data excludes information used for HIPAA treatment, payment or operations.
Section: SB 546 § 1(3) (75A O.S. § 300)
Sources
Compare sensitive data across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 9: Processing of special categories of personal data (sensitive data)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Oklahoma statute
Reference material, not legal advice.