April 10, 2026
Signed into law: March 20, 2026
Law: Senate Bill 546
Effective date: January 1, 2027
Status: Enacted; not yet effective.
Oklahoma has enacted a comprehensive consumer privacy law. On March 20, 2026, Governor Kevin Stitt approved Senate Bill 546, establishing consumer privacy rights and obligations for covered organizations processing Oklahoma residents’ personal data. The law takes effect January 1, 2027.
SB 546 addresses consumer requests, targeted advertising, data sales, sensitive-data consent, privacy notices, security, processor contracts, and data protection assessments. Businesses should treat it as an operational compliance requirement, not simply a privacy-policy update.
Which Businesses are Covered?
SB 546 applies to a controller or processor that conducts business in Oklahoma or produces products or services targeted to Oklahoma residents and, during a calendar year, meets either threshold:
-
Controls or processes personal data of at least 100,000 consumers.
-
Controls or processes personal data of at least 25,000 consumers and derives more than 50% of gross revenue from selling personal data.
There is no separate general dollar-revenue threshold. Coverage depends on consumer-data volume and, for the lower threshold, the percentage of revenue from personal-data sales.
A consumer is an Oklahoma resident acting in an individual or household context. Individuals acting in commercial or employment contexts are excluded.
What Exemptions Apply?
The law contains exemptions for specified organizations, including state agencies and political subdivisions, certain service providers acting on their behalf, financial institutions subject to the Gramm-Leach-Bliley Act, HIPAA-covered entities and business associates, nonprofit organizations, and institutions of higher education.
It also excludes specified categories of information, including certain health, financial, consumer-reporting, education, research, and employment-related data.
Businesses should distinguish between an exemption covering the organization and one covering only particular information. An exemption for some records does not necessarily exempt all of the business’s activities.
What Rights Will Oklahoma Consumers Have?
Subject to the law’s conditions and exceptions, consumers may:
-
Confirm whether their personal data is being processed and access it.
-
Correct inaccuracies.
-
Request deletion of data provided by or obtained about them.
-
Obtain a portable copy of certain data they previously provided.
-
Opt-out of targeted advertising, personal-data sales, and profiling used for decisions producing legal or similarly significant effects.
A parent or legal guardian may exercise applicable rights on behalf of a known child.
Controllers, the organizations deciding why and how personal data is processed, must generally respond to authenticated requests within 45 days. They may extend the period once by an additional 45 days when reasonably necessary, with notice and an explanation during the initial period. Responses generally must be provided free of charge up to twice annually per consumer.
If a controller declines a request, it must explain the reason and provide appeal instructions within 45 days. Appeals must be decided within 60 days; a denied appeal must include the online mechanism for submitting a complaint to the Oklahoma Attorney General.
Request Methods and Opt-Out Signals.
Controllers generally must provide two or more secure and reliable methods for submitting privacy requests. Consumers cannot be required to create a new account, although use of an existing account may be required. The law also addresses website request mechanisms and permits an email-only approach for certain exclusively online controllers with direct consumer relationships.
Unlike some state privacy laws, SB 546 does not establish a requirement to recognize universal browser- or device-based opt-out signals. Controllers still must provide request methods and honor applicable opt-out rights.
Oklahoma’s Definition of “Sale” is Narrower Than Some States’.
Oklahoma generally defines a sale as exchanging personal data with a third-party for monetary consideration. It excludes specified transfers, including qualifying disclosures to processors, affiliates, providers of consumer-requested services, and parties to certain corporate transactions.
This differs from laws that also include exchanges for other valuable consideration. A disclosure may therefore qualify as a sale in another state but not in Oklahoma.
However, a disclosure that is not a sale may still involve targeted advertising. Businesses should evaluate those activities separately because the law provides distinct opt-out rights for each.
Targeted advertising generally involves advertisements selected using personal data from activities over time across nonaffiliated websites or applications. The definition excludes specified first-party, contextual, consumer-requested, and advertising-measurement activities.
What Must Covered Businesses Do?
SB 546 establishes several core obligations:
-
Privacy notices: Explain data categories, processing purposes, consumer rights and appeals, and applicable third-party sharing.
-
Sales and advertising disclosures: Clearly disclose personal-data sales and targeted advertising and explain how consumers can opt-out.
-
Data minimization: Limit collection to what is adequate, relevant, and reasonably necessary for disclosed purposes.
-
Purpose limitation: Obtain consent before processing for purposes that are neither reasonably necessary to nor compatible with the disclosed purpose.
-
Security: Maintain reasonable administrative, technical, and physical safeguards appropriate to the data involved.
-
Processor contracts: Include required terms governing processing instructions, confidentiality, deletion or return, compliance information, assessments, and subcontractors.
Processors must follow controller instructions and provide assistance with consumer rights, security and breach-related obligations, and data protection assessments.
Sensitive Data Requires Consent.
Controllers generally must obtain consent before processing sensitive data. Sensitive data about known children must be processed in accordance with the Children’s Online Privacy Protection Act.
Sensitive data includes specified information about race or ethnicity, religion, health diagnoses, sexual orientation, citizenship or immigration status, identifying genetic or biometric data, known children, and precise geolocation.
Consent must be affirmative, freely given, specific, informed, and unambiguous. The definition excludes agreement obtained through dark patterns, certain passive interactions, and acceptance of broad terms containing unrelated processing descriptions.
Assessments Apply to New Higher-Risk Processing.
Controllers must conduct and document data protection assessments for specified processing, including:
-
Targeted advertising.
-
Personal-data sales.
-
Sensitive-data processing.
-
Certain profiling presenting reasonably foreseeable risks.
-
Other processing presenting a heightened risk of consumer harm.
Assessments must weigh benefits against consumer risks and consider safeguards, reasonable consumer expectations, and processing context. A reasonably comparable assessment prepared under another law may satisfy Oklahoma’s requirement.
The assessment obligation applies to processing activities that commence on or after January 1, 2027, and is not retroactive. Businesses should identify relevant new activities before deployment and separately evaluate whether changes to existing processing create a new activity.
The Attorney General may request assessments through a civil investigative demand. Confidentiality protections apply, and production does not itself waive applicable attorney-client privilege or work-product protection.
Enforcement and the 30-Day Cure Period.
The Oklahoma Attorney General has exclusive enforcement authority. SB 546 does not create a private right of action.
Before bringing an enforcement action, the Attorney General must provide written notice and a 30-day opportunity to cure. To avoid an action under that provision, the controller or processor must correct the violation and provide a written statement that includes supporting documentation and assurances that further violations will not occur. The cure procedure has no express sunset date.
Failure to cure, or breach of the written cure statement, may lead to enforcement. Available remedies include civil penalties of up to $7,500 per violation and injunctive relief. The cure process does not postpone the January 1, 2027 compliance deadline.
Businesses with existing multi-state privacy programs should incorporate Oklahoma’s requirements into those systems while accounting for its narrower sale definition, lack of a universal opt-out signal mandate, prospective assessment requirement, and documented cure process.
For operational guidance and structured compliance documentation tools, visit the CLIClaw Privacy Compliance Library.
© 2026 CLIClaw.com
This article is for information purposes only. This article provides general information and operational commentary. It is not legal advice. Applicability and compliance obligations depend on an organization’s activities, data practices, exemptions, and circumstances. It is not intended to be and should not be relied on as legal advice for any particular matter.