Oklahoma (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Consumer data privacy act (SB 546) | SB 546 (2026), to be codified at 75A O.S. §§ 300 to 320 | Enacted, not yet in force | 1 January 2027 |
| Security Breach Notification Act | 24 O.S. §§ 161 to 166, as amended by SB 626 (2025) | In force | 1 November 2008 |
| Age verification for material harmful to minors (SB 1959) | SB 1959 (2024), new 15 O.S. §§ 791 to 791.4 | In force | 1 November 2024 |
- Consumer data privacy act (SB 546): Approved by the Governor on 20 March 2026; takes effect on 1 January 2027. The act has no official short title; it’s often called the Oklahoma Consumer Data Privacy Act.
- Security Breach Notification Act: SB 626 became law without the Governor’s signature on 28 May 2025. From 1 January 2026 it added notice to the Attorney General, a reasonable-safeguards safe harbour and new penalty rules.
- Age verification for material harmful to minors (SB 1959): Approved by the Governor on 26 April 2024. Applies to websites where more than a third of the material is harmful to minors.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”From 1 January 2027, applies to businesses that operate in Oklahoma or target its residents and, in a calendar year, control or process personal data of at least 100,000 consumers, or of 25,000 while earning over 50% of gross revenue from selling personal data. Government, financial institutions and GLBA data, HIPAA covered entities and business associates, nonprofits and higher education are exempt. Employee and business-contact data are out of scope.
Sources: oklegislature.gov/cf_pdf/2025-26 ENR/SB/SB546 ENR.PDF · okhouse.gov/posts/news-20260323_2
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases. Give a clear privacy notice and honour rights to confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and significant profiling. Reply within 45 days (one 45-day extension), free twice a year, and decide appeals within 60 days. Sensitive data needs opt-in consent. Collect only what’s adequate, relevant and reasonably necessary for the disclosed purposes.
Sources: oklegislature.gov/cf_pdf/2025-26 ENR/SB/SB546 ENR.PDF · okhouse.gov/posts/news-20260323_2
Consent age for online services
Section titled “Consent age for online services”A child is under 13. A known child’s sensitive data must be processed in line with COPPA, and parents can use the child’s rights. There’s no teen consent rule.
Sources: oklegislature.gov/cf_pdf/2025-26 ENR/SB/SB546 ENR.PDF
Children
Section titled “Children”Data collected from a known child is sensitive data and must be handled under COPPA. Meeting COPPA’s verifiable parental consent rules counts as compliance. The privacy act sets no extra rules for teenagers. Separately, since 1 November 2024, websites where more than a third of the material is harmful to minors must block access when an internet or mobile subscriber asks, and a minor’s parent can sue if they don’t. Reasonable age verification shields a site, and identifying data from age checks may not be kept.
Sources: oklegislature.gov/cf_pdf/2025-26 ENR/SB/SB546 ENR.PDF · oklegislature.gov/cf_pdf/2023-24 ENR/SB/SB1959 ENR.PDF
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. From 2027, controllers that sell personal data or use it for targeted advertising must disclose it clearly and explain how to opt out. Opt-outs are made by request to each controller; the act has no duty to honour universal opt-out signals such as Global Privacy Control.
Sources: oklegislature.gov/cf_pdf/2025-26 ENR/SB/SB546 ENR.PDF
Electronic marketing
Section titled “Electronic marketing”Adds to CAN-SPAM and the TCPA. Under the Telephone Solicitation Act of 2022, sales calls or texts using automated dialling or recorded messages need the recipient’s prior express written consent. Sales calls are limited to 8 a.m. to 8 p.m. and three a day on the same subject, with true caller ID. People can sue for $500 per violation or actual loss, trebled if wilful.
Sources: oklegislature.gov/cf_pdf/2021-22 ENR/hB/HB3168 ENR.PDF
Breach notification
Section titled “Breach notification”Tell affected Oklahoma residents without unreasonable delay when a breach of unencrypted personal information causes, or is likely to cause, identity theft or fraud. From 1 January 2026, also tell the Attorney General within 60 days of notifying residents if 500 or more residents are affected (1,000 for credit bureaus). Using reasonable safeguards and giving notice is a defence to civil penalties.
Sources: oklegislature.gov/cf_pdf/2025-26 ENR/SB/SB626 ENR.PDF · oklahoma.gov/oag/complaints-tiplines/complaints/data-breach.html
Registration and fees
Section titled “Registration and fees”No data protection registration or fee, and no data broker registry.
Sources: oklegislature.gov/cf_pdf/2025-26 ENR/SB/SB546 ENR.PDF
Data protection officer
Section titled “Data protection officer”No duty to appoint a data protection officer.
Sources: oklegislature.gov/cf_pdf/2025-26 ENR/SB/SB546 ENR.PDF
International transfers
Section titled “International transfers”Oklahoma law doesn’t restrict sending personal data outside the state or the US. Federal rules are in us-federal.
Sources: oklegislature.gov/cf_pdf/2025-26 ENR/SB/SB546 ENR.PDF
Impact assessments
Section titled “Impact assessments”Do and document a data protection assessment for targeted advertising, selling personal data, risky profiling, sensitive data and other high-risk processing. It covers processing activities that start on or after 1 January 2027. The Attorney General can demand it through a civil investigative demand, and it stays confidential.
Sources: oklegislature.gov/cf_pdf/2025-26 ENR/SB/SB546 ENR.PDF
Automated decisions and AI
Section titled “Automated decisions and AI”People can opt out of profiling (solely automated evaluation of things like their finances, health or behaviour) used for decisions with legal or similarly significant effects, such as on lending, housing, insurance, health care, education, jobs, criminal justice or basic necessities. Risky profiling also needs a data protection assessment.
Sources: oklegislature.gov/cf_pdf/2025-26 ENR/SB/SB546 ENR.PDF
Penalties
Section titled “Penalties”The Attorney General has exclusive enforcement. It must give 30 days’ written notice first; if the business cures and confirms in writing, no action follows. The cure right doesn’t expire. Civil penalties up to $7,500 per violation, plus injunctions and fees. No private right of action. Breach-law violations that injure residents are enforced by the Attorney General or a district attorney, for actual damages and up to $150,000 per breach or series of similar breaches; a business that gave notice but lacked reasonable safeguards pays actual damages and a fixed $75,000.
Sources: oklegislature.gov/cf_pdf/2025-26 ENR/SB/SB546 ENR.PDF · oklegislature.gov/cf_pdf/2025-26 ENR/SB/SB626 ENR.PDF
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-ok.yaml.