Law note · Oklahoma
Oklahoma Consumer Data Privacy Act, general applicability and exemptions
The Oklahoma Consumer Data Privacy Act (SB 546 Secs. 15-16) applies to a controller or processor that conducts business in Oklahoma, or produces a product or service targeted to Oklahoma residents, and that during a calendar year controls or processes the personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data.
The Act exempts state agencies and political subdivisions and their service providers, GLBA-regulated financial institutions, HIPAA and HITECH covered entities and business associates, nonprofits, institutions of higher education, purely personal or household processing, and Controlled Substances Act listed-chemicals data.
Signed into law in the 2026 Regular Session of the 60th Legislature after passing the House on February 19, 2026 and the Senate on March 16, 2026; Section 22 of the enrolled act sets the effective date as January 1, 2027, not yet reached.
What it asks of an app
- Confirm you conduct business in Oklahoma, or target a product or service to Oklahoma residents, and meet the 100,000-consumer or 25,000-consumer-plus-majority-revenue-from-data-sales threshold before relying on this Act's scope in compliance planning.
- Confirm whether a sector exemption applies before this Act's January 1, 2027 effective date. It excludes state agencies, GLBA-regulated financial institutions, HIPAA covered entities, nonprofits, and higher-education institutions.
When LexLint raises it
Declared activities: automated_outreach, crawls_web, deploys_chatbot, processes_biometrics, processes_voice, trains_models
Primary source: official Oklahoma enrolled bill text, Senate Bill 546, 60th Legislature (2026 Regular Session)