Oklahoma Consumer Data Privacy Act (House Bill 2969)

Proposed comprehensive privacy legislation that would establish consumer rights similar to CCPA. Includes provisions for access, deletion, and opt-out rights. Would require businesses to provide privacy notices and honor consumer rights requests. Currently under legislative review.

JurisdictionOklahoma
CategoryPrivacy & Data Protection
StatusProposed
Latest development

Analysis

Key Requirements

  • Consumer Rights: Oklahoma HB 2969 grants consumers rights to access, delete, and opt out of the sale of their personal data. Businesses must respond to consumer requests and provide mechanisms for exercising these rights. See the official bill text and Oklahoma Legislature bill information.
  • Privacy Notices: Businesses are required to provide clear and accessible privacy notices detailing categories of personal information collected, purposes of collection, and third-party disclosures. Refer to the bill summary and DataGuidance jurisdiction overview.
  • Opt-In Consent: The bill mandates opt-in consent for the collection and sale of personal information, especially for sensitive data. See the IAPP analysis.
  • Attorney General Enforcement: The Oklahoma Attorney General is empowered to enforce the Act, including issuing civil penalties for non-compliance. See official bill text.
  • Coverage Thresholds: The Act applies to businesses that meet certain thresholds for data processing, similar to the CCPA. See NCSL summary.

Compliance Challenges

  • Data Mapping Complexity: Organizations often struggle to inventory and categorize all personal data, especially across legacy systems. See IAPP industry commentary.
  • Responding to Consumer Requests: Managing and verifying consumer requests for access, deletion, or opt-out can be resource-intensive. Real-world examples from CCPA compliance show similar challenges; see DataGuidance analysis.
  • Updating Privacy Notices: Ensuring privacy notices are accurate and updated for all data collection activities is a common pain point. See Mondaq industry report.
  • Cross-Jurisdictional Compliance: Businesses operating in multiple states must harmonize compliance efforts across varying privacy laws. See CAGW national framework discussion.

Implementation Best Practices

Recent Updates

Related Regulations

Industry Impact

  • Retail and E-Commerce: Businesses must overhaul data collection and marketing practices to comply with opt-in and opt-out requirements. See IAPP industry analysis.
  • Technology Companies: Increased compliance costs for data mapping, consumer request handling, and privacy notice updates. See Mondaq sector impact report.
  • Small Businesses: May face challenges meeting compliance thresholds and implementing required processes. See CAGW framework discussion.

Sources

Recent developments

  • — Client alert summarizing practical impacts: companies over the 100,000/25,000‑consumer thresholds that operate or target products to Oklahoma residents must inventory data, update privacy notices, amend processor contracts, and build processes for access/correction/deletion/opt‑out requests, with many organizations treating Oklahoma as part of a broader “US omnibus” privacy compliance program.[1] (source)
  • — Commentary highlighting that express consent is required only for sensitive data but that Oklahoma’s purpose‑compatibility rule still pushes companies to refine notice and consent flows; practitioners flag the absence of an explicit right to revoke consent as a nuance compared to some other regimes that may affect how organizations design preference‑management tools.[5] (source)
  • — Further analysis pointing out that mandatory data protection assessments for targeted advertising, sale of personal data, and high‑risk profiling may increase governance and documentation burdens, with businesses expected to adjust risk‑assessment frameworks and internal review processes to meet Oklahoma’s standards while leveraging work done for other state laws.[3] (source)
  • — Follow‑up industry reaction emphasizing that Oklahoma’s law largely aligns with other state privacy regimes, reducing fragmentation for multi‑state businesses but adding another jurisdiction to compliance maps; commentators note the importance of harmonizing Oklahoma’s requirements with existing programs ahead of the 2027 effective date.[4] (source)
  • — Official Oklahoma House news release announcing that Gov. Kevin Stitt signed **SB 546**, a comprehensive consumer data privacy law giving Oklahomans rights to access, correct, delete, and opt out of sale/targeted advertising of their personal data, effective January 1, 2027; this law supersedes earlier HB 2969 proposals.[2] (source)
  • — Law firm analysis explaining that Oklahoma has enacted the **Oklahoma Consumer Data Privacy Act** via SB 546, making it the 21st state with a comprehensive privacy statute, detailing scope thresholds (100,000/25,000 consumers and revenue from data sales), consumer rights, consent requirements for sensitive data, and AG enforcement with penalties up to $7,500 per violation.[1] (source)
  • — Policy update describing SB 546 as the **Oklahoma Data Privacy Act**, effective January 1, 2027, outlining new consumer rights, privacy notice obligations, mandatory data protection assessments for targeted advertising, sale of personal data, profiling and sensitive data processing, and a standing 30‑day AG cure period with civil penalties up to $7,500 per violation.[3] (source)
  • — Industry legal commentary noting Oklahoma becomes the 20th state with a broad consumer privacy law, highlighting applicability thresholds, exemptions (GLBA, HIPAA entities, nonprofits, higher education), standard consumer rights, exclusive AG enforcement, fines up to $7,500 per violation, and compliance deadline of January 1, 2027, prompting multi‑state program updates.[4] (source)
  • — Detailed practitioner blog on Oklahoma’s new privacy law under SB 546, focusing on privacy notice content requirements, non‑retroactive data protection assessments for processing commencing on or after January 1, 2027, opt‑in consent for sensitive data and purpose‑limitation rules, and the 30‑day AG cure period; it frames operational impacts for controllers and processors planning implementation.[5] (source)
  • — Background article on HB 2969 (Oklahoma Computer Data Privacy Act) describing the House’s March 23, 2022 passage of the bill, its relatively low applicability thresholds and consent‑for‑collection model; subsequent developments show that this HB 2969 proposal did not become law and has effectively been replaced by the later SB 546 framework, shifting industry focus.[6] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates