Oklahoma
Oklahoma consumer data privacy law (SB 546)
Oklahoma’s consumer privacy law. It gives Oklahoma residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- Starts January 1, 2027
- Citation
- SB 546 (2026)
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses that handle data of 100,000+ Oklahoma residents a year, or 25,000+ if they earn revenue from selling data.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
- Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
- Offer an appeal when you turn down a privacy request.
Who has to comply, from January 1, 2027
Oklahoma’s privacy law (SB 546) was approved on March 20, 2026 and takes effect on January 1, 2027. It applies to businesses that operate in Oklahoma or target its residents and handle the personal data of 100,000 or more Oklahoma consumers, or 25,000 or more while getting over 50% of gross revenue from selling personal data.
Nonprofits are exempt, as are government bodies, colleges, Gramm-Leach-Bliley financial institutions and HIPAA covered entities.
Visitors’ rights and your deadlines
- Rights to confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and significant profiling. Parents can act for children.
- Respond within 45 days, extendable once by 45 more.
- Appeals: answer within 60 days with a written explanation; a denial must point to the Attorney General’s online complaint form.
Opt-out signals and sensitive data
The law doesn’t require honoring universal opt-out signals such as Global Privacy Control; opt-outs are made by request.
Sensitive data needs consent. It includes racial or ethnic origin, religion, health diagnoses, sexual orientation, citizenship or immigration status, genetic and biometric data, data of a known child under 13, and precise geolocation. Children’s data follows COPPA.
Your privacy notice
Give a reasonably accessible and clear notice: the categories of data you process, including sensitive data, and why; how to use and appeal rights; and the categories of data and third parties you share with. If you sell data or do targeted advertising, disclose it clearly and conspicuously, with how to opt out.
Enforcement
The Attorney General has exclusive authority and must publish guidance and an online complaint form; there’s no private right of action. The Attorney General must notify a business in writing at least 30 days before suing, giving it a chance to cure. Penalties are up to $7,500 per violation, plus injunctions, attorney fees and investigation costs.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Children’s Privacy Policy (Pro)
A children’s privacy notice page for sites that may collect information from children under 13.
A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
When does Oklahoma’s privacy law take effect?
January 1, 2027.
Do I have to honor Global Privacy Control in Oklahoma?
The law doesn’t require it.
Are nonprofits covered in Oklahoma?
No. Nonprofit organizations are exempt.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
