Oklahoma Act Relating to Data Privacy (SB 546)

Comprehensive consumer privacy law enacted 2026 after several failed attempts; applies to businesses meeting Oklahoma resident data thresholds with rights to access, delete and opt out of sale and targeted advertising.

Analysis

Oklahoma’s SB 546 – Oklahoma Consumer Data Privacy Act is a comprehensive state privacy law enacted in March 2026 that establishes consumer rights (access, correction, deletion, portability, opt-out of sale and targeted advertising) and prescribes obligations for businesses meeting specified Oklahoma resident data thresholds, with enforcement by the Attorney General and an effective date of January 1, 2027.Oklahoma House News ReleaseOklahoma Legislature Bill Information SB 546Engrossed SB 546 PDF – Ok LegislatureLexLint – Oklahoma Consumer Data Privacy Act OverviewCookieScript – Oklahoma Data Privacy Act Summary

Key Requirements

Scope and Applicability

• Covered entities and thresholds
• SB 546 applies to businesses (controllers/processors) that do business in Oklahoma or target Oklahoma residents and, in a calendar year, either:
• Control or process personal data of at least 100,000 consumers, or
• Control or process personal data of at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal data.Oklahoma House News ReleaseDavis Wright Tremaine Analysis of SB 546Usercentrics Guide – Oklahoma Consumer Data Privacy ActOsano – U.S. Data Privacy Laws Guide
• The Act defines “consumer” as a natural person residing in Oklahoma acting only in a personal context, excluding individuals acting in employment or commercial contexts.Davis Wright Tremaine Analysis of SB 546LexLint Consumer Rights Sections

• Entity-level exemptions
• SB 546 exempts:
• HIPAA-covered entities and business associates.
• GLBA-covered financial institutions and data.
• Non-profit organizations.
• Governmental entities.National Law Review – Seven Years in the MakingDavis Wright Tremaine Analysis of SB 546

Consumer Rights

• Right to access personal data
• Consumers have the right to access their personal data held by a controller and obtain information about categories of data processed and purposes of processing.Oklahoma House News ReleaseLexLint Consumer Rights SectionsLinkedIn Analysis – Oklahoma Enacts SB 546

• Right to correction
• Consumers can correct inaccuracies in their personal data, considering the nature of the data and purposes of processing.Oklahoma House News ReleaseLexLint Consumer Rights SectionsLinkedIn Analysis – Oklahoma Enacts SB 546

• Right to deletion
• Consumers have the right to request deletion of personal data collected from or about them, subject to specified exceptions.Oklahoma House News ReleaseLexLint Consumer Rights SectionsCookieScript – Oklahoma Data Privacy Act Summary

• Right to data portability
• Consumers can obtain a copy of their personal data in a portable and, to the extent technically feasible, readily usable format that allows them to transmit the data to another entity.Oklahoma House News ReleaseNational Law Review – Seven Years in the MakingLexLint Consumer Rights Sections

• Right to opt out of sale, targeted advertising, and certain profiling
• Consumers have the right to opt out of:
• The sale of personal data.
• Targeted advertising based on cross-site tracking and profiling.
• Profiling in furtherance of decisions that produce legal or similarly significant effects.Oklahoma House News ReleaseNational Law Review – Seven Years in the MakingCookieScript – Oklahoma Data Privacy Act SummaryUsercentrics Guide – Oklahoma Consumer Data Privacy Act

• Appeal rights
• Controllers must provide consumers with an appeal process if the controller declines to take action on a request, and inform the consumer of how to contact the Attorney General if their appeal is denied.Oklahoma Legislature Bill Information SB 546LegiScan SB 546 Text – 2026Osano – U.S. Data Privacy Laws Guide

Obligations for Controllers and Processors

• Privacy notices and transparency
• Controllers must provide clear and accessible privacy notices detailing categories of personal data, purposes of processing, categories of data shared, and how consumers can exercise their rights, including opt-out mechanisms.Oklahoma House News ReleaseLegiScan SB 546 Text – 2026CookieScript – Oklahoma Data Privacy Act Summary

• Data security requirements
• Businesses must maintain reasonable data security practices appropriate to the volume and nature of personal data to protect against unauthorized access, use, or disclosure.Oklahoma House News ReleaseLexLint – Oklahoma Consumer Data Privacy Act OverviewOsano – U.S. Data Privacy Laws Guide

• Consent for sensitive data
• SB 546 requires affirmative consent (opt-in) before processing sensitive personal data, including precise geolocation, health data, certain financial data, and data collected from a known child under 13, which must also be handled in accordance with COPPA.Oklahoma House News ReleaseLexLint – Oklahoma Consumer Data Privacy Act OverviewLinkedIn Analysis – Oklahoma Enacts SB 546

• Data protection assessments (privacy impact assessments)
• Controllers must perform documented data protection assessments for high‑risk processing activities, including:
• Targeted advertising.
• Sale of personal data.
• Profiling that presents risk of unfair treatment or harm.
• Processing of sensitive data.
• Other processing that poses a heightened risk to consumers.National Law Review – Seven Years in the MakingOsano – U.S. Data Privacy Laws GuideDavis Wright Tremaine Analysis of SB 546

• Processor obligations and contracts
• Processors must follow controllers’ instructions, implement appropriate security measures, assist with consumer rights requests, and be subject to contracts specifying processing instructions, data types, duration, confidentiality, and deletion or return of data.LegiScan SB 546 Text – 2026LexLint Consumer Rights SectionsDavis Wright Tremaine Analysis of SB 546

Enforcement, Penalties, and Effective Date

• Attorney General enforcement and no private right of action
• SB 546 is enforced exclusively by the Oklahoma Attorney General, with no private right of action for consumers.National Law Review – Seven Years in the MakingDavis Wright Tremaine Analysis of SB 546LinkedIn Analysis – Oklahoma Enacts SB 546

• Permanent right to cure and penalties
• Businesses receive a 30‑day right to cure alleged violations before penalties are imposed, and this cure period does not sunset.National Law Review – Seven Years in the MakingDavis Wright Tremaine Analysis of SB 546CookieScript – Oklahoma Data Privacy Act Summary
• The maximum civil penalty is USD 7,500 per violation.National Law Review – Seven Years in the MakingDavis Wright Tremaine Analysis of SB 546Osano – U.S. Data Privacy Laws Guide

• Effective date and codification
• SB 546 was signed by the Governor on March 20, 2026 and codified as 2026 Oklahoma Session Law Chapter 8, establishing new privacy provisions in Title 75A, Sections 300–320 of the Oklahoma Statutes.CookieScript – Oklahoma Data Privacy Act SummaryOklahoma House News ReleaseOklahoma Legislature Bill Information SB 546
• The operative provisions take effect January 1, 2027, providing businesses a transition period before enforcement begins.Oklahoma House News ReleaseNational Law Review – Seven Years in the MakingCookieScript – Oklahoma Data Privacy Act Summary

Compliance Challenges

• Determining applicability and thresholds across multi‑state operations
• Organizations operating nationally must determine whether their Oklahoma consumer counts meet the 100,000 / 25,000 + 50% revenue thresholds, which can be complex when data systems do not track residency consistently.Usercentrics Guide – Oklahoma Consumer Data Privacy ActOsano – U.S. Data Privacy Laws GuideDavis Wright Tremaine Analysis of SB 546

• Aligning Oklahoma requirements with existing state privacy programs
• Many companies already comply with laws like California, Virginia, Colorado, and others, and must harmonize SB 546 obligations (e.g., specific definitions of targeted advertising and profiling, permanent cure period) with existing multi‑state frameworks.Usercentrics Guide – Oklahoma Consumer Data Privacy ActOsano – U.S. Data Privacy Laws GuideLinkedIn Analysis – Oklahoma Enacts SB 546

• Implementing opt‑out mechanisms for targeted advertising and sale of data
• SB 546’s opt‑out rights for targeted advertising and sale require operational changes: building consumer-facing preference centers, honoring universal opt‑out signals (where implemented), and coordinating across ad-tech partners.CookieScript – Oklahoma Data Privacy Act SummaryUsercentrics Guide – Oklahoma Consumer Data Privacy ActNational Law Review – Seven Years in the Making

• Conducting and documenting data protection assessments at scale
• The requirement to conduct privacy/data protection assessments for multiple high‑risk processing activities can be challenging, especially for organizations that do not yet have mature privacy risk assessment processes.National Law Review – Seven Years in the MakingOsano – U.S. Data Privacy Laws GuideDavis Wright Tremaine Analysis of SB 546

• Managing children’s data and COPPA alignment
• SB 546 treats personal data from a known child under 13 as sensitive data, requiring consent and compliance with COPPA, which adds complexity to age detection and consent management.LexLint – Oklahoma Consumer Data Privacy Act OverviewUsercentrics Guide – Oklahoma Consumer Data Privacy ActNational Law Review – Seven Years in the Making

• Example – Ad‑tech and targeted advertising compliance
• Industry guidance for Oklahoma and similar laws shows ad‑tech companies must update cross-site tracking and audience segmentation practices to accommodate opt‑out rights and updated definitions of targeted advertising, often requiring re‑engineering of cookie and SDK behavior.[CookieScript – Oklahoma Data Privacy Act Summary](https://cookie-script.com/privacy-laws/oklahoma-data-privacy-act-odpa-202

Recent developments

• 2026-08-30 — Overview of Oklahoma SB 546 as the state’s new comprehensive data privacy law, enacted March 20, 2026 and taking effect January 1, 2027, including scope thresholds (100,000/25,000 consumers plus revenue test), core consumer rights, and key compliance obligations for businesses[15][12][3]. (source)
• 2026-04-20 — Jurisdictional summary explaining that SB 546 (the Oklahoma data privacy act) was signed into law on March 20, 2026 and will enter into effect on January 1, 2027, establishing consumer rights (access, correction, deletion, portability, opt-outs) and controller/processor obligations such as DPIAs and rules on de-identified data[12]. (source)
• 2026-03-25 — Law firm analysis noting Oklahoma became the 21st state with a comprehensive consumer privacy law when Governor Stitt signed SB 546, comparing the act’s Virginia-style model, its definition of “sale,” opt-out rights for targeted advertising and profiling, and detailing controller/processor obligations ahead of the 2027 effective date[3][4]. (source)
• 2026-03-23 — Official Oklahoma House news release announcing SB 546’s enactment as a comprehensive data privacy law, describing new rights for Oklahomans (access, correct, delete, copy, opt-out of sale/targeted ads), applicability thresholds, exemptions, and enforcement by the Attorney General, and confirming the effective date of January 1, 2027[1][4]. (source)
• 2026-03-16 — Article chronicling the seven-year effort leading to SB 546, summarizing coverage thresholds, consumer rights, mandatory data protection assessments, exclusive Attorney General enforcement with a 30‑day cure period, and noting a key amendment pushing the effective date from July 1, 2026 to January 1, 2027 for additional compliance runway[4][2]. (source)
• 2026-03-16 — Consumer Reports press release urging a veto of SB 546, arguing that although the bill grants core privacy rights, they are undercut by weak definitions of “sale” and “targeted advertising,” the absence of a universal opt-out or authorized agents, and limited enforcement, signaling concern that the law is overly industry-friendly[8][10]. (source)
• 2026-03-06 — Letter from the U.S. Chamber of Commerce strongly supporting SB 546 as aligned with the multistate “Consensus Privacy Approach,” praising its Virginia-style framework and signaling broad business community approval, while positioning the law as a model that avoids conflicting state requirements[13][9]. (source)
• 2026-02-24 — Joint statement from Consumer Reports and EPIC opposing SB 546, acknowledging that it gives consumers rights to know, access, correct, delete, and limit disclosure of their data but arguing that, in its current form, it would do little to truly protect personal information or rein in large tech platforms and risks locking in weak protections[10][11]. (source)
• 2026-02-22 — Privacy law update reporting the Oklahoma House’s 84–4 passage of SB 546 and describing it as “big news” in state privacy developments, noting the bill’s return to the Senate for concurrence on amendments before heading to Governor Stitt, and framing Oklahoma as poised to join the ranks of comprehensive privacy states[14][4]. (source)
• 2026-02-13 — Report on a Senate committee action advancing SB 546 while amending it to delay the initial effective date from January 1, 2026 to July 1, 2026, highlighting lawmakers’ desire to give stakeholders more time for review and signaling early recognition of the bill’s significant compliance and operational impacts before later movement to a January 1, 2027 start[5][6]. (source)

Related regulations

• UK Data Protection Act 2018 — United Kingdom, Active
• Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
• General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
• COPPA (Children's Online Privacy Protection Act) — United States, Active
• Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
• Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
• New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01
• Nebraska Data Privacy Act (NDPA) — Nebraska, Active, effective 2025-01-01

Put it into practice

• Generate the policy: Privacy policy generator (generatepolicy.com)
• Buy the policy pack: State Privacy Law Checklist (cyberpolicy.shop)
• Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates