Oklahoma Act Relating to Data Privacy (SB 546)

Comprehensive consumer privacy law enacted 2026 after several failed attempts; applies to businesses meeting Oklahoma resident data thresholds with rights to access, delete and opt out of sale and targeted advertising.

JurisdictionOklahoma
CategoryPrivacy & Data Protection
StatusUpcoming
Effective date
Latest development

Recent developments

  • — Overview of Oklahoma SB 546 as the state’s new comprehensive data privacy law, enacted March 20, 2026 and taking effect January 1, 2027, including scope thresholds (100,000/25,000 consumers plus revenue test), core consumer rights, and key compliance obligations for businesses[15][12][3]. (source)
  • — Jurisdictional summary explaining that SB 546 (the Oklahoma data privacy act) was signed into law on March 20, 2026 and will enter into effect on January 1, 2027, establishing consumer rights (access, correction, deletion, portability, opt-outs) and controller/processor obligations such as DPIAs and rules on de-identified data[12]. (source)
  • — Law firm analysis noting Oklahoma became the 21st state with a comprehensive consumer privacy law when Governor Stitt signed SB 546, comparing the act’s Virginia-style model, its definition of “sale,” opt-out rights for targeted advertising and profiling, and detailing controller/processor obligations ahead of the 2027 effective date[3][4]. (source)
  • — Official Oklahoma House news release announcing SB 546’s enactment as a comprehensive data privacy law, describing new rights for Oklahomans (access, correct, delete, copy, opt-out of sale/targeted ads), applicability thresholds, exemptions, and enforcement by the Attorney General, and confirming the effective date of January 1, 2027[1][4]. (source)
  • — Article chronicling the seven-year effort leading to SB 546, summarizing coverage thresholds, consumer rights, mandatory data protection assessments, exclusive Attorney General enforcement with a 30‑day cure period, and noting a key amendment pushing the effective date from July 1, 2026 to January 1, 2027 for additional compliance runway[4][2]. (source)
  • — Consumer Reports press release urging a veto of SB 546, arguing that although the bill grants core privacy rights, they are undercut by weak definitions of “sale” and “targeted advertising,” the absence of a universal opt-out or authorized agents, and limited enforcement, signaling concern that the law is overly industry-friendly[8][10]. (source)
  • — Letter from the U.S. Chamber of Commerce strongly supporting SB 546 as aligned with the multistate “Consensus Privacy Approach,” praising its Virginia-style framework and signaling broad business community approval, while positioning the law as a model that avoids conflicting state requirements[13][9]. (source)
  • — Joint statement from Consumer Reports and EPIC opposing SB 546, acknowledging that it gives consumers rights to know, access, correct, delete, and limit disclosure of their data but arguing that, in its current form, it would do little to truly protect personal information or rein in large tech platforms and risks locking in weak protections[10][11]. (source)
  • — Privacy law update reporting the Oklahoma House’s 84–4 passage of SB 546 and describing it as “big news” in state privacy developments, noting the bill’s return to the Senate for concurrence on amendments before heading to Governor Stitt, and framing Oklahoma as poised to join the ranks of comprehensive privacy states[14][4]. (source)
  • — Report on a Senate committee action advancing SB 546 while amending it to delay the initial effective date from January 1, 2026 to July 1, 2026, highlighting lawmakers’ desire to give stakeholders more time for review and signaling early recognition of the bill’s significant compliance and operational impacts before later movement to a January 1, 2027 start[5][6]. (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates