United States – Oklahoma

Regulator And AuthorityAmber

The Oklahoma Attorney General (currently Gentner Drummond) is the designated state enforcement authority for consumer protection and will hold exclusive enforcement authority under SB 546 once effective. The FTC is the concurrent federal enforcement authority under Section 5.

Claims (1):

• The current Oklahoma Attorney General, Gentner Drummond, was sworn in on 9 January 2023 and serves as the state's chief legal officer with consumer-protection enforcement authority.

Act And InstrumentsAmber

Current in-force instruments: FTC Act Section 5; Oklahoma Security Breach Notification Act (breach notice only). Enacted-not-yet-effective instrument: SB 546.

Claims (3):

• The FTC Act prohibits companies and individuals from engaging in unfair or deceptive acts or practices in or affecting commerce, and constitutes the operative general federal privacy-enforcement baseline applicable to Oklahoma businesses absent a state omnibus law.
• The Oklahoma Legislature enacted a comprehensive consumer data privacy law, Senate Bill 546, which passed the House on final passage 84-4 on 19 February 2026 and was substituted on the House floor with a compromise text aligning mostly with the Virginia Consumer Data Protection Act framework.
• SB 546 was reported signed into law in March 2026 by the Oklahoma Governor; this is based on a secondary-source headline and was not corroborated against the primary enrolled-bill or Secretary of State record in this research pass.

Material ScopeAmber

SB 546 will apply to businesses controlling/processing personal data of at least 100,000 Oklahomans, or 25,000 consumers combined with deriving at least 50% of gross revenue from data sales.

Claims (1):

• SB 546 covers businesses that control or process the personal data of at least 100,000 Oklahomans, or the data of at least 25,000 consumers while deriving at least 50% of gross revenue from data sales.

Territorial ScopeAmber

FTC Section 5 authority is not geographically limited within the US and reaches any entity engaged in commerce affecting Oklahoma consumers. SB 546's precise territorial-scope language (e.g., conducting business in the state or targeting state residents, per the typical Virginia-model formulation) was not independently verified against primary bill text in this research pass.

Absence provenance: not recorded. Searched: S, B, , 5, 4, 6, , e, n, r, o, l, l, e, d, , b, i, l, l, , t, e, x, t, , t, e, r, r, i, t, o, r, i, a, l, -, s, c, o, p, e, , c, l, a, u, s, e.

Claims (1):

• FTC Act Section 5 unfair/deceptive-practices authority applies to conduct affecting commerce nationally, including transactions with Oklahoma consumers, regardless of where the responsible entity is established.

Regulator Registration And FilingRed

No general controller/processor registration or filing regime currently exists in Oklahoma, and none was identified as part of SB 546 in the secondary sources reviewed.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , S, B, , 5, 4, 6, , r, e, g, i, s, t, r, a, t, i, o, n, , o, r, , f, i, l, i, n, g, , o, b, l, i, g, a, t, i, o, n, ;, , O, k, l, a, h, o, m, a, , A, G, , d, a, t, a, , b, r, o, k, e, r, , r, e, g, i, s, t, r, y.

Lawful BasesRed

No GDPR-style enumerated lawful-bases regime exists or is confirmed for SB 546; Virginia-model laws generally use a general opt-out processing standard rather than an enumerated lawful-basis list.

Absence provenance: not recorded. Searched: S, B, , 5, 4, 6, , l, a, w, f, u, l, , b, a, s, i, s, , /, , p, r, o, c, e, s, s, i, n, g, -, p, u, r, p, o, s, e, , p, r, o, v, i, s, i, o, n, s.

Consent ThresholdsAmber

Virginia-CDPA-modeled laws typically require opt-in consent only for processing of sensitive/special-category data. This is an analogy, not a confirmed OK-specific finding.

Claims (1):

• SB 546 is modeled mostly on the original framework of Virginia's Consumer Data Protection Act, which conditions processing of sensitive personal data on prior opt-in consent; the presence of an equivalent OK-specific opt-in requirement was not independently confirmed against SB 546 bill text.

Special CategoriesAmber

Sensitive-data category definitions for SB 546 were not independently retrieved; Virginia-model laws typically include health, genetic, biometric, ethnicity/race, religion, sexual orientation/status, citizenship/immigration status, and precise geolocation as sensitive categories.

Claims (1):

• SB 546's definition of sensitive/special-category personal data was not independently retrieved; a Virginia-CDPA-analogous definition (health, genetic, biometric, racial/ethnic origin, religion, sexual orientation, citizenship/immigration status, precise geolocation, data of known minors) is presumed but unconfirmed.

Pseudonymisation And AnonymisationRed

No Oklahoma-specific pseudonymisation/anonymisation safe-harbour provision was identified in this research pass.

Absence provenance: not recorded. Searched: S, B, , 5, 4, 6, , p, s, e, u, d, o, n, y, m, i, s, a, t, i, o, n, , /, , d, e, -, i, d, e, n, t, i, f, i, c, a, t, i, o, n, , s, a, f, e, , h, a, r, b, o, u, r.

Access RightAmber

SB 546 contains standard data subject access rights as part of its rights package.

Claims (1):

• SB 546 contains standard data subject access rights as part of the consumer rights package taking effect 1 January 2027.

Rectification And ErasureAmber

Correction and deletion rights are presumed included within the 'standard data subject access rights' described for SB 546, consistent with the Virginia-model rights package, but explicit bill-text confirmation was not obtained.

Claims (1):

• Correction and deletion rights are presumed part of SB 546's standard consumer rights package but were not itemized separately in the secondary sources reviewed.

Restriction And ObjectionAmber

SB 546 explicitly provides opt-outs for targeted advertising and sale of personal data.

Claims (1):

• SB 546 contains standard data subject access rights, including opt-outs for targeted advertising and data sales as defined under the bill.

Data PortabilityAmber

Portability is presumed part of the 'standard' rights package referenced for SB 546 but not independently itemized in sources reviewed.

Claims (1):

• A data-portability right is presumed included in SB 546's standard rights package but was not independently itemized in sources reviewed.

Deadlines And Response WindowsRed

No OK-specific statutory response-window (e.g., 45-day) figure was independently confirmed for SB 546 in this research pass.

Absence provenance: not recorded. Searched: S, B, , 5, 4, 6, , c, o, n, s, u, m, e, r, , r, e, q, u, e, s, t, , r, e, s, p, o, n, s, e, , d, e, a, d, l, i, n, e.

Accountability And DpiaAmber

SB 546 requires data protection assessments for a range of processing activities.

Claims (1):

• SB 546 requires controllers to conduct data protection assessments for a range of processing activities, effective 1 January 2027.

Dpo RequirementsRed

No DPO-appointment threshold was identified for SB 546 or any current OK statute in this research pass.

Absence provenance: not recorded. Searched: S, B, , 5, 4, 6, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , o, f, f, i, c, e, r, , a, p, p, o, i, n, t, m, e, n, t, , r, e, q, u, i, r, e, m, e, n, t.

Ropa RequirementsRed

No records-of-processing (ROPA) obligation was identified for SB 546 in this research pass.

Absence provenance: not recorded. Searched: S, B, , 5, 4, 6, , r, e, c, o, r, d, s, , o, f, , p, r, o, c, e, s, s, i, n, g, , a, c, t, i, v, i, t, i, e, s, , r, e, q, u, i, r, e, m, e, n, t.

Joint Controller ArrangementsRed

No Oklahoma-specific joint-controller provision was identified; Virginia-model laws typically use standard controller/processor contract-clause requirements, but this was not independently confirmed for SB 546.

Absence provenance: not recorded. Searched: S, B, , 5, 4, 6, , j, o, i, n, t, , c, o, n, t, r, o, l, l, e, r, , /, , p, r, o, c, e, s, s, o, r, , c, o, n, t, r, a, c, t, , c, l, a, u, s, e.

Security MeasuresGreen

The GLBA Safeguards Rule requires covered financial institutions to maintain a written information-security program with administrative, technical and physical safeguards.

Claims (1):

• The FTC Safeguards Rule requires covered financial institutions to develop, implement, and maintain an information security program with administrative, technical, and physical safeguards designed to protect customer information.

Breach NotificationAmber

Oklahoma's general Security Breach Notification Act requires notification of affected residents following a breach of computerized personal information; sector-specific breach rules (HIPAA Breach Notification Rule, GLBA Safeguards Rule notification-event requirement) also apply. Precise OK statutory citation/timelines were not independently re-verified against primary text in this pass.

Claims (2):

• Financial institutions subject to the FTC Safeguards Rule must notify the FTC as soon as possible, and no later than 30 days after discovery, of a notification event involving unauthorized acquisition of at least 500 consumers' unencrypted information.
• Oklahoma maintains a general Security Breach Notification Act requiring notice to affected residents following a breach of computerized personal information; the precise statutory citation and notification timeline were not independently re-verified against primary statutory text in this research pass.

Retention And DisposalRed

No general Oklahoma data-retention-limit or disposal-duty statute was identified in this research pass.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , g, e, n, e, r, a, l, , d, a, t, a, , r, e, t, e, n, t, i, o, n, /, d, i, s, p, o, s, a, l, , s, t, a, t, u, t, e.

Transfer MechanismsRed

No formal transfer-mechanism regime (adequacy/SCCs/BCRs/derogations) applies to Oklahoma as a matter of state or applicable federal general-commercial-data law.

Claims (1):

• The United States, including Oklahoma, has no GDPR-style cross-border transfer mechanism regime (adequacy, SCCs, BCRs) applicable to general commercial personal data.

Adequacy ReceivedRed

Not applicable; the US does not operate an adequacy-reception framework.

Absence provenance: not recorded. Searched: U, S, -, O, K, , a, d, e, q, u, a, c, y, , d, e, c, i, s, i, o, n, s, , r, e, c, e, i, v, e, d.

Adequacy GrantedRed

Not applicable; the US does not issue GDPR-style adequacy determinations.

Absence provenance: not recorded. Searched: U, S, -, O, K, , a, d, e, q, u, a, c, y, , d, e, c, i, s, i, o, n, s, , g, r, a, n, t, e, d.

Sccs And BcrsRed

No SCC/BCR-equivalent regime exists at Oklahoma state level; use of EU-style SCCs by OK-based entities would arise only as counterparties to EU GDPR-regulated transfers, outside this JID's own instrument.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , s, t, a, t, e, , S, C, C, /, B, C, R, , f, r, a, m, e, w, o, r, k.

Transfer Impact AssessmentRed

No TIA requirement exists under Oklahoma or applicable federal general-commercial-data law.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , t, r, a, n, s, f, e, r, , i, m, p, a, c, t, , a, s, s, e, s, s, m, e, n, t, , r, e, q, u, i, r, e, m, e, n, t.

Data LocalisationRed

No general data-localisation mandate applies to commercial personal data in Oklahoma.

Claims (1):

• No data-localisation mandate applies to general commercial personal data processed by Oklahoma-based or Oklahoma-serving entities.

Financial Sector OverlayGreen

GLBA requires financial institutions to explain information-sharing practices and safeguard sensitive data; the FTC Safeguards Rule imposes information-security-program obligations.

Claims (1):

• The Gramm-Leach-Bliley Act requires financial institutions to explain their information-sharing practices to customers and to safeguard sensitive data, applicable to covered Oklahoma-based financial institutions.

Health Sector OverlayGreen

HIPAA Privacy, Security, and Breach Notification Rules govern covered entities and business associates handling protected health information; the FTC Act and FTC Health Breach Notification Rule fill gaps for non-HIPAA-covered health data (e.g., health apps).

Claims (2):

• The HIPAA Privacy Rule sets limits and conditions on uses and disclosures of protected health information by covered entities and business associates and provides individuals with rights regarding their health information.
• The FTC Act's obligations apply to HIPAA-covered entities and business associates, as well as to companies that collect, use, or share health information that are not required to comply with HIPAA, filling coverage gaps for non-HIPAA health data.

Telecoms And EprivacyRed

No Oklahoma-specific telecoms/eprivacy overlay (cookie-consent-style regime) was identified; federal TCPA-type protections were not independently re-verified in this pass.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , t, e, l, e, c, o, m, s, /, e, p, r, i, v, a, c, y, , o, v, e, r, l, a, y.

Employment DataRed

No Oklahoma-specific employment-data privacy statute was identified in this research pass.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , e, m, p, l, o, y, m, e, n, t, , d, a, t, a, , p, r, i, v, a, c, y, , s, t, a, t, u, t, e.

Credit And ScoringAmber

The federal Fair Credit Reporting Act (FCRA) applies nationally including Oklahoma, but a dedicated verification pass on FCRA text/enforcement for this run was not performed.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, -, s, p, e, c, i, f, i, c, , c, r, e, d, i, t, /, s, c, o, r, i, n, g, , o, v, e, r, l, a, y, , b, e, y, o, n, d, , F, C, R, A.

EducationAmber

The federal Family Educational Rights and Privacy Act (FERPA) applies nationally including Oklahoma; no OK-specific education-sector privacy overlay was identified.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , e, d, u, c, a, t, i, o, n, -, s, e, c, t, o, r, , p, r, i, v, a, c, y, , o, v, e, r, l, a, y, , b, e, y, o, n, d, , F, E, R, P, A.

InsuranceRed

No Oklahoma-specific insurance-sector data-privacy overlay (e.g., genetic-information-and-insurance statute) was identified in this research pass; a search for an Oklahoma Genetic Information Privacy Act returned no confirming results.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , G, e, n, e, t, i, c, , I, n, f, o, r, m, a, t, i, o, n, , P, r, i, v, a, c, y, , A, c, t, , /, , i, n, s, u, r, a, n, c, e, , g, e, n, e, t, i, c, -, t, e, s, t, i, n, g, , s, t, a, t, u, t, e.

Cookies And TrackersRed

No Oklahoma-specific cookie/tracker consent law was identified.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , c, o, o, k, i, e, , c, o, n, s, e, n, t, , s, t, a, t, u, t, e.

Dark PatternsRed

Dark-pattern prohibitions were proposed in earlier Oklahoma privacy bill drafts (2021-era HB 1602 lineage) but confirmation of an equivalent provision surviving into enacted SB 546 was not obtained.

Absence provenance: not recorded. Searched: S, B, , 5, 4, 6, , d, a, r, k, , p, a, t, t, e, r, n, s, , p, r, o, v, i, s, i, o, n.

Opt Out SignalsAmber

SB 546 omits recognition of universal opt-out mechanisms.

Claims (1):

• SB 546 omits some of the more common provisions passed by other states in recent years, including recognition of universal opt-out mechanisms and enhanced children's privacy protections.

Clean Rooms And DcrRed

No clean-room/data-collaboration-room rule was identified for Oklahoma.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , c, l, e, a, n, , r, o, o, m, , /, , d, a, t, a, , c, o, l, l, a, b, o, r, a, t, i, o, n, , r, o, o, m, , r, e, g, u, l, a, t, i, o, n.

Cross Context AdvertisingAmber

SB 546 provides opt-outs for targeted advertising and data sales as defined under the bill.

Claims (1):

• SB 546 provides consumer opt-outs for targeted advertising and data sales as defined under the bill, effective 1 January 2027.

Direct MarketingRed

No Oklahoma-specific direct-marketing consent/suppression regime beyond general federal FTC Act oversight was identified in this research pass.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , d, i, r, e, c, t, , m, a, r, k, e, t, i, n, g, , c, o, n, s, e, n, t, /, s, u, p, p, r, e, s, s, i, o, n, , s, t, a, t, u, t, e.

Profiling RestrictionsAmber

A profiling opt-out is plausible by analogy to the Virginia-model framework underlying SB 546, but was not independently confirmed in the sources reviewed.

Claims (1):

• SB 546's Virginia-CDPA-modeled framework may include a profiling opt-out right consistent with other Virginia-model state laws, but an OK-specific profiling-restriction clause was not independently confirmed in the sources reviewed.

Automated Decision Making TransparencyRed

No ADM transparency/explanation-right provision was confirmed for SB 546.

Absence provenance: not recorded. Searched: S, B, , 5, 4, 6, , a, u, t, o, m, a, t, e, d, , d, e, c, i, s, i, o, n, -, m, a, k, i, n, g, , t, r, a, n, s, p, a, r, e, n, c, y, , p, r, o, v, i, s, i, o, n.

Ai Risk AssessmentsRed

No Oklahoma AI-specific risk-assessment statute was identified.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , A, I, , r, i, s, k, , a, s, s, e, s, s, m, e, n, t, , s, t, a, t, u, t, e.

Biometric RegimeRed

No Oklahoma biometric-data statute analogous to Illinois BIPA was identified.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , b, i, o, m, e, t, r, i, c, , i, n, f, o, r, m, a, t, i, o, n, , p, r, i, v, a, c, y, , s, t, a, t, u, t, e.

Genetic DataRed

A search for an Oklahoma Genetic Information Privacy Act returned no Oklahoma-specific results (only other-state examples such as Maryland).

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , G, e, n, e, t, i, c, , I, n, f, o, r, m, a, t, i, o, n, , P, r, i, v, a, c, y, , A, c, t, , 2, 0, 2, 3.

State Surveillance CarveoutsRed

No Oklahoma-specific state-surveillance carveout provision was researched in this pass.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , s, t, a, t, e, , s, u, r, v, e, i, l, l, a, n, c, e, , /, , n, a, t, i, o, n, a, l, -, s, e, c, u, r, i, t, y, , c, a, r, v, e, o, u, t, , i, n, , p, r, i, v, a, c, y, , l, a, w.

Age VerificationRed

No Oklahoma-specific age-verification statute (e.g., social-media age-verification law) was identified in this research pass.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , a, g, e, , v, e, r, i, f, i, c, a, t, i, o, n, , /, , s, o, c, i, a, l, , m, e, d, i, a, , m, i, n, o, r, s, , l, a, w.

Parental ConsentGreen

COPPA gives parents control over what information websites can collect from children and requires verifiable parental consent mechanisms.

Claims (1):

• The Children's Online Privacy Protection Act (COPPA) gives parents control over what information websites can collect from their children, applicable to covered Oklahoma-serving operators.

Minor Profiling BansAmber

SB 546 explicitly omits enhanced children's privacy protections found in some other state comprehensive privacy laws.

Claims (1):

• SB 546 omits enhanced children's privacy protections found in some other states' comprehensive privacy laws, leaving COPPA as the primary child-data safeguard in Oklahoma.

Education SettingsAmber

The federal FERPA regime applies nationally including Oklahoma; no OK-specific education-settings privacy rule was identified in this research pass.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , e, d, u, c, a, t, i, o, n, -, s, e, t, t, i, n, g, s, -, s, p, e, c, i, f, i, c, , p, r, i, v, a, c, y, , r, u, l, e, , b, e, y, o, n, d, , F, E, R, P, A.

Dependent AdultsRed

No Oklahoma-specific dependent-adults data-protection provision was identified in this research pass.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , d, e, p, e, n, d, e, n, t, , a, d, u, l, t, s, , /, , e, l, d, e, r, l, y, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , s, t, a, t, u, t, e.

Regulator Powers And PenaltiesAmber

SB 546 grants the Oklahoma Attorney General exclusive enforcement authority with a non-sunsetting 30-day cure provision.

Claims (1):

• SB 546 will take force 1 January 2027 and offers a 30-day cure provision under exclusive Attorney General enforcement that does not sunset.

Enforcement Activity IndexRed

No Oklahoma-specific privacy-enforcement action tally (breach-notification enforcement or FTC actions specifically targeting OK entities) was identified in this research pass.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , A, t, t, o, r, n, e, y, , G, e, n, e, r, a, l, , p, r, i, v, a, c, y, /, b, r, e, a, c, h, , e, n, f, o, r, c, e, m, e, n, t, , a, c, t, i, o, n, s, , 2, 0, 2, 5, -, 2, 0, 2, 6.

Regulator Funding And CapacityRed

No specific funding or headcount data for the Oklahoma AG's Consumer Protection Unit relevant to privacy enforcement was researched in this pass.

Absence provenance: not recorded. Searched: O, k, l, a, h, o, m, a, , A, t, t, o, r, n, e, y, , G, e, n, e, r, a, l, , C, o, n, s, u, m, e, r, , P, r, o, t, e, c, t, i, o, n, , U, n, i, t, , f, u, n, d, i, n, g, /, h, e, a, d, c, o, u, n, t.

Collective Redress And Class ActionsAmber

SB 546's exclusive AG enforcement model implies no collective/class-action mechanism for consumers under the Act itself.

Claims (1):

• Because SB 546 vests exclusive enforcement in the Attorney General, no consumer collective-redress or class-action mechanism is created directly by the Act.

Private Right Of ActionAmber

SB 546 provides exclusive Attorney General enforcement, precluding a private right of action under the Act; whether the existing breach-notification statute separately allows a private right of action was not independently confirmed.

Claims (1):

• SB 546 does not create a private right of action, enforcement being exclusive to the Oklahoma Attorney General under a non-sunsetting 30-day cure provision.

Recent Developments 180DAmber

Within the 180 days preceding the dispatch date (2026-08-06), Oklahoma's House gave final passage to SB 546 on 19 February 2026 (84-4 vote), and the bill was reported signed into law in March 2026 — the single most material recent development for this JID.

Claims (1):

• On 19 February 2026, the Oklahoma House approved final passage of Senate Bill 546 on an 84-4 vote, sending the state's first comprehensive consumer data privacy law toward enactment.