Oklahoma Enacts Comprehensive Privacy Law, Andrew Folks

https://technologylaw.fkks.com/post/102mnkj/oklahoma-enacts-comprehensive-privacy-law

Publish Date: 2026-03-21 21:40:00

Not a moment too soon(er), we have our twentieth state comprehensive privacy law. Ending a nearly two year national drought, Oklahoma Governor Kevin Stitt signed SB 546 into law on March 20, 2026.

For businesses concerned about preparing for the law’s effective date of January 1, 2027, it will be welcome news that SB 546 breaks little, if any, new ground compared to the consensus formed across the 18 (non-California) state comprehensive laws currently in effect. That said, a few provisions are worth noting.

Standard Scope and Definitions

SB 546 applies to controllers and processors doing business in Oklahoma or targeting Oklahoma residents that either (1) process personal data of at least 100,000 consumers annually, or (2) process data of at least 25,000 consumers and derive more than 50% of gross revenue from selling personal data. These thresholds track other state laws closely.

The law’s definitions similarly generally follow the narrower formulation. Notably, the definition of “sale” is limited to exchanges for monetary consideration only, not other valuable consideration. This exempts many common data-sharing arrangements in the advertising ecosystems from the opt-out requirement.

Oklahoma’s definition of biometric data, which includes data generated from photographs, video, or audio recordings when used to identify a specific individual, mirrors Minnesota’s approach and stands in contrast to many other state comprehensive privacy laws, which often expressly exclude photo- and video-derived data.

Familiar Consumer Rights

The consumer rights package is standard: access, correction, deletion, portability, and opt-out of targeted advertising, data sales, and certain profiling. Controllers must notify consumers within 45 days if declining to act on a request, and must provide appeal instructions.

Two absences are worth noting: the bill includes no provisions for authorized agents, and no provisions requiring recognition of opt-out…

Source