Law note · Oklahoma
Oklahoma Consumer Data Privacy Act, sensitive data and biometric data definitions
SB 546 Sec. 1 classifies genetic or biometric data processed to uniquely identify a person as sensitive data, requiring the consumer's prior opt-in consent before a controller may process it.
Biometric data means data from automatic measurement of an individual's biological characteristics, such as a fingerprint, voiceprint, or eye retina or iris, or other unique biological pattern or characteristic, used to identify a specific individual; the definition excludes a physical or digital photograph, a video or audio recording, or data generated from either, unless that data is generated to identify a specific individual, at which point it falls back inside the definition.
A faceprint or voiceprint deliberately extracted from a public photograph or recording for identification purposes is therefore biometric data, and sensitive data, under this Act, the same clawback structure as Kentucky's and New Hampshire's comprehensive acts.
What it asks of an app
- Obtain an Oklahoma consumer's opt-in consent before processing sensitive data, including genetic or biometric data collected to uniquely identify the individual.
- Treat a faceprint or voiceprint generated from a photograph, video, or audio recording, for the purpose of identifying a specific individual, as covered biometric and sensitive data. This Act's exclusion does not reach data generated for that purpose.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, crawls_web, trains_models
Primary source: official Oklahoma enrolled bill text, Senate Bill 546, 60th Legislature (2026 Regular Session)