79%
of Oklahoma's 19 requirements are already met by California (CA). Here is what OCDPA adds, biggest gaps first.
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
OCDPA adds2 Controllers must offer an appeal, decide within 60 days, and on denial give an online way to complain to the Attorney General.
SB 546 (2026); section not confirmed · source ↗
ThresholdsWho it coversGap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
OCDPA adds1 Applies to businesses processing data of 100,000+ Oklahoma consumers, or 25,000+ consumers with over 50% of gross revenue from data sales.
SB 546 (2026); section not confirmed · source ↗
Sensitive dataSensitive data and minorsGap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
OCDPA adds1 Processing sensitive data requires consent; no right to revoke consent is provided.
SB 546 (2026); section not confirmed · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
OCDPA adds3 Deidentified data needs safeguards, a public commitment and contract flow-down; pseudonymous data is personal data when linkable.
SB 546 (2026); section not confirmed · source ↗
Already covered by CA: Exemptions, Children and teens, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.
A gap means OCDPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
