Industry - Policy Change
Executive Summary
Oklahoma Governor Stitt signed Senate Bill 546 on March 20, 2026, making Oklahoma the 21st state with a comprehensive consumer privacy law, effective January 1, 2027. The law applies to businesses that serve Oklahoma residents and either process data of 100,000+ consumers annually or process data of 25,000+ consumers while earning over 50% of revenue from selling personal data. Covered businesses must honor consumer requests to access, correct, delete, or port their data, and allow opt-outs f...
What Happened
Oklahoma Governor Stitt signed Senate Bill 546 into law on March 20, 2026, establishing comprehensive consumer privacy protections that take effect January 1, 2027. The law makes Oklahoma the 21st U.S. state to enact such legislation. It applies to businesses serving Oklahoma residents that process data for 100,000 or more consumers annually, or 25,000 or more consumers while earning over half their revenue from selling personal data.
Who Is Affected
Oklahoma residents gain new privacy rights under this law, while businesses meeting the thresholds that operate in Oklahoma or target its residents must comply. Certain entities are exempt, including nonprofits, colleges and universities, state agencies, and organizations already subject to HIPAA or the Gramm-Leach-Bliley Act. Employment-related data collection is also excluded from coverage.
Why It Matters
This law continues the national trend of state-level privacy regulation in the absence of comprehensive federal legislation, creating another jurisdiction with distinct compliance requirements for businesses. Oklahoma residents will gain meaningful control over their personal information through access, correction, deletion, and opt-out rights. The law's inclusion of automated profiling restrictions reflects growing concern about algorithmic decision-making affecting consumers.
What You Should Do
Oklahoma residents should familiarize themselves with their new rights to request access to, correct, delete, or obtain portable copies of their personal data from covered businesses starting January 2027. You can opt out of targeted advertising, certain automated profiling, and the sale of your personal data by contacting businesses that hold your information. If a business denies your request, use the required internal appeal process and contact the Oklahoma Attorney General if violations persist.
AI-Assisted
Event summaries are generated by Claude AI from verified sources and reviewed by humans before publication.