---
title: "Oklahoma privacy law: sensitive data"
canonical: "https://dposchool.com/state-privacy-laws/state/oklahoma/sensitive-data"
source: "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Oklahoma consumer data privacy act (Enrolled Senate Bill 546; the act gives itself no short title)

# Oklahoma privacy law: sensitive data

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Controllers may not process sensitive data without the consumer's consent, and a known child's sensitive data must be processed under COPPA. Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used for unique identification, data collected from a known child (under 13), and precise geolocation within 1,750 feet. The act sets no special rule for teenagers.

## Key points

1. Sensitive data may be processed only with consent.

   Section: [SB 546 § 7(B)(4) (75A O.S. § 306)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

2. Sensitive data categories: race or ethnicity, religion, health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric identifiers, known-child data and precise geolocation.

   Section: [SB 546 § 1(29) (75A O.S. § 300)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

3. 'Child' means under 13; a known child's sensitive data must be processed in line with COPPA.

   Section: [SB 546 § 1(5); § 7(B)(4) (75A O.S. §§ 300, 306)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

4. Compliance with COPPA verifiable parental consent satisfies the act's parental consent duties.

   Section: [SB 546 § 17 (75A O.S. § 316)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

5. Consent excludes broad terms of use, hovering, muting, pausing or closing content, and dark patterns.

   Section: [SB 546 § 1(7) (75A O.S. § 300)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

6. Biometric data excludes information used for HIPAA treatment, payment or operations.

   Section: [SB 546 § 1(3) (75A O.S. § 300)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

## Sources

- [Enrolled Senate Bill 546 (2025-2026), full text](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

[Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Oklahoma statute](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

Reference material, not legal advice.

## Other topics for Oklahoma

- [Applicability](https://dposchool.com/state-privacy-laws/state/oklahoma/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/oklahoma/consumer-rights)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/oklahoma/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/oklahoma/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/oklahoma/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Oklahoma](https://dposchool.com/state-privacy-laws/state/oklahoma) / Sensitive data

Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/oklahoma/consumer-rights)

Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/oklahoma/controller-duties)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents