Oklahoma OKCDPA
Enacted Oklahoma · In force Jan 1, 2027 · next deadline Jan 1, 2027 (in 3 months)
Deadlines
| Date | What happens | When |
|---|---|---|
| Jan 1, 2027 | Oklahoma Consumer Data Privacy Act takes effectin 3 months | in 3 months |
Summaries for reference, not legal advice. Check the official text.
What it does
New Virginia-style comprehensive privacy law: consumers get access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), with opt-in consent for sensitive data, privacy notices and data protection assessments. It treats pseudonymous data as personal data and lets controllers authenticate opt-out requests.
- Who it applies to
- Controllers and processors doing business in Oklahoma or targeting Oklahoma residents that in the preceding calendar year controlled or processed personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data. Exempts government, nonprofits, GLBA financial institutions, HIPAA entities, higher education; FCRA, FERPA, DPPA data; employee data.
- Penalties
- Civil penalty up to $7,500 per violation not cured, plus attorney fees and investigative costs. Mandatory 30-day notice-and-cure period that does not sunset. No private right of action.
- Enforced by
- Oklahoma Attorney General (exclusive)
- Official name
- Oklahoma Consumer Data Privacy Act (SB 546, 2026)
- Citation
- SB 546 (60th Leg., 2nd Sess., 2026)
- Topics
- privacy
Research notes
SB 546 was introduced in 2025 and passed the Senate in March 2025, but it was not enacted until the 2026 session; the Governor approved it March 20, 2026 per the Oklahoma Legislature bill history. So it was not effective Jan 1, 2026. Oklahoma Statutes codification is not yet confirmed. Thresholds, penalty and cure terms are from DWT, WilmerHale and the Oklahoma House press release.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)
Delaware Personal Data Privacy Act (DPDPA)Questions about Oklahoma OKCDPA
- What are the Oklahoma OKCDPA compliance deadlines?
- Jan 1, 2027: Oklahoma Consumer Data Privacy Act takes effect.
- When does Oklahoma OKCDPA take effect?
- Oklahoma OKCDPA takes effect on Jan 1, 2027. The next milestone is Jan 1, 2027: Oklahoma Consumer Data Privacy Act takes effect.
- Who does Oklahoma OKCDPA apply to?
- Controllers and processors doing business in Oklahoma or targeting Oklahoma residents that in the preceding calendar year controlled or processed personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data. Exempts government, nonprofits, GLBA financial institutions, HIPAA entities, higher education; FCRA, FERPA, DPPA data; employee data.
- What are the penalties under Oklahoma OKCDPA?
- Civil penalty up to $7,500 per violation not cured, plus attorney fees and investigative costs. Mandatory 30-day notice-and-cure period that does not sunset. No private right of action.