Regulations › US states › Oklahoma
OCDPA
Oklahoma Consumer Data Privacy Act
WhenTakes effect 1 January 2027
Who enforces itState Attorney General (no private right of action)
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsApplies to businesses processing data of 100,000+ Oklahoma consumers, or 25,000+ consumers wit…
Universal opt-outNot required
Cure periodThe AG must give 30 days' written notice
Request deadlineControllers must respond within 45 days, extendable once by 45 days
Maximum penaltyCivil penalty up to $7,500 per violation, plus attorney's fees and investigative costs
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
1
Applies to businesses processing data of 100,000+ Oklahoma consumers, or 25,000+ consumers with over 50% of gross revenue from data sales.SB 546 (2026); section not confirmed · secondary source · source ↗
Enacted as SB 546 (2026), signed by Gov. Stitt March 20, 2026. The enrolled text (oklegislature.gov) blocked automated access, so cells come from law-firm summaries and cite the bill only. Oklahoma Statutes codification not confirmed.
Exemptions
0
Entity-level exemptions for GLBA financial institutions, HIPAA covered entities and business associates, nonprofits and higher education.SB 546 (2026); section not confirmed · secondary source · source ↗
Sensitive data and minors
Sensitive data
1
Processing sensitive data requires consent; no right to revoke consent is provided.SB 546 (2026); section not confirmed · secondary source · source ↗
Children and teens
1
A known child's (under 13) data is sensitive and must be processed under COPPA with parental consent. No teen protections.SB 546 (2026); section not confirmed · secondary source · source ↗
Data minimization
1
Collection must be adequate, relevant and reasonably necessary to disclosed purposes.SB 546 (2026); section not confirmed · secondary source · source ↗
Consumers' rights
Rights
2
Confirm and access, correct, delete, obtain a copy, and opt out of targeted ads, sale and significant profiling.SB 546 (2026); section not confirmed · secondary source · source ↗
Troutman's list omits the copy right; Hunton and Didomi include it.
Request deadline
2
Controllers must respond within 45 days, extendable once by 45 days.SB 546 (2026); section not confirmed · secondary source · source ↗
Appeals
2
Controllers must offer an appeal, decide within 60 days, and on denial give an online way to complain to the Attorney General.SB 546 (2026); section not confirmed · secondary source · source ↗
Universal opt-out
0
Not required; controllers need not recognize universal opt-out signals.SB 546 (2026); section not confirmed · secondary source · source ↗
Business duties
Assessments
2
Assessments are required for targeted ads, sale, risky profiling, sensitive data and other heightened-risk processing; available to the AG on demand.SB 546 (2026); section not confirmed · secondary source · source ↗
Processor contracts
2
Contract with instructions, purpose, data types, duration, confidentiality, return or deletion, assessment cooperation and written subprocessor flow-down.SB 546 (2026); section not confirmed · secondary source · source ↗
Privacy notice
1
Virginia-style notice covering data categories, purposes, rights and appeals, and third-party sharing; sale and targeted ads disclosed with opt-outs.SB 546 (2026); section not confirmed · secondary source · source ↗
Loyalty programs
1
Non-discrimination rule with a loyalty-program carve-out.SB 546 (2026); section not confirmed · secondary source · source ↗
Sources mention the carve-out only briefly.
De-identified data
3
Deidentified data needs safeguards, a public commitment and contract flow-down; pseudonymous data is personal data when linkable.SB 546 (2026); section not confirmed · secondary source · source ↗
Pseudonymous-data exemption details not confirmed; level 3 may overstate.
Enforcement
Who enforces
1
Attorney General has exclusive enforcement authority and must post guidance and a complaint mechanism online.SB 546 (2026); section not confirmed · secondary source · source ↗
Cure period
0
The AG must give 30 days' written notice; a documented cure bars the action. The cure right does not sunset.SB 546 (2026); section not confirmed · secondary source · source ↗
Maximum penalty
2
Civil penalty up to $7,500 per violation, plus attorney's fees and investigative costs.SB 546 (2026); section not confirmed · secondary source · source ↗
Private action
0
No private right of action.SB 546 (2026); section not confirmed · secondary source · source ↗
Rulemaking
0
No rulemaking authority identified.SB 546 (2026); section not confirmed · secondary source · source ↗
Sources do not address rulemaking; not verified in bill text.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws