Oklahoma Privacy & Security Compliance Guide

Signed into law — not yet in effect

Oklahoma SB 546 (consumer data privacy law, 75A O.S. § 300 et seq.)

Takes effect January 1, 2027

The law takes effect January 1, 2027. From that date, covered businesses need opt-out, request and appeal processes, opt-in consent for sensitive data, and data protection assessments for new high-risk processing.

What Oklahoma's law means for your website

SB 546 takes effect January 1, 2027. It only reaches businesses handling data of 100,000+ Oklahomans (or 25,000+ if most revenue comes from selling data), so many small sites will fall below the line.

  • Add an opt-out link for targeted advertising and sales.
  • Collect opt-in consent before processing sensitive data such as precise location or health information.
  • Update your privacy notice and request process, including an appeal step.
  • Document data protection assessments for ad targeting and other high-risk processing.

The Attorney General must give 30 days to fix a violation before suing. See every change on January 1, 2027 or scan your site.

Oklahoma at a Glance

4.1 million

Population

30 days (permanent)

Cure Period

Up to $7,500 per violation

Max civil penalty

Who Must Comply in Oklahoma?

Oklahoma SB 546 (consumer data privacy law, 75A O.S. § 300 et seq.) (from January 1, 2027):

Businesses that conduct business in Oklahoma or target products or services to its residents and, in a calendar year, control or process personal data of 100,000+ Oklahoma consumers, or of 25,000+ consumers while earning over 50% of gross revenue from selling personal data; nonprofits, colleges, HIPAA-covered entities and GLBA financial institutions are exempt.

  • Applies to businesses that collect personal data of Oklahoma residents and meet the law's applicability thresholds — wherever the business is located
  • Enforced by the Oklahoma Attorney General
  • Website essentials: an accurate privacy notice, working opt-out links, and consent before sensitive-data processing

Oklahoma-Specific Requirements

Consumers gain rights to confirm, access, correct, delete and port their data, to opt out of targeted advertising, sale and significant-decision profiling, and to appeal a refused request (answered within 60 days). Sensitive data, including health diagnoses, precise geolocation, biometric data and data of known children under 13, requires opt-in consent. 'Sale' covers only exchanges for money, and there is no Global Privacy Control requirement. Data protection assessments are required for targeted ads, sales, sensitive data and other high-risk processing.

Recent Oklahoma Privacy & Security Cases

SB 546 signed March 20, 2026 — Oklahoma's first comprehensive consumer privacy law

Oklahoma joined the 36-AG, $220M General Motors settlement (Oct 2026) over selling drivers' location and driving data

Major Oklahoma Business Centers

Key cities where privacy compliance is critical for business success:

  • Oklahoma City
  • Tulsa
  • Norman
  • Broken Arrow
  • Edmond

Test Your Oklahoma Website's Privacy & Security Compliance

Don't wait for regulators or hackers. Check your compliance status now.

Free Privacy Scan →

Last reviewed November 6, 2026. See all upcoming privacy deadlines or compare every state. This page is general information, not legal advice.