Oklahoma has its first comprehensive consumer data privacy law. Gov. Kevin Stitt signed Senate Bill 546 on March 20, 2026, after the bill cleared the House 84-4 and the Senate 38-7, per the Oklahoma Legislature's bill record. The law takes effect in 2027, per the Oklahoma House, giving businesses and residents more than nine months to prepare.
Until now, Oklahomans' data rights depended on other states' laws, because most large platforms and data brokers operate nationwide and build to the strictest standard. SB 546 brings the rules home. This article publishes information, not legal advice.
What rights does the law give Oklahomans?
Consistent with the comprehensive privacy laws adopted by other states since 2018, SB 546 gives residents a package of control rights over personal data held by covered businesses: the right to confirm what data a company holds, to correct it, to delete it, and to opt out of targeted advertising, the sale of personal data and certain profiling, per the House's summary of the measure.
- Signed: March 20, 2026, per the Oklahoma Legislature
- House vote: 84-4; Senate vote: 38-7
- Effective: 2027, per the Oklahoma House
- Coverage: businesses meeting thresholds for volume or share of revenue from personal data
Who has to comply?
Like the Connecticut, Virginia and Colorado laws it parallels, the Oklahoma statute applies to companies that process large volumes of consumer data or derive a meaningful share of revenue from selling it. Small businesses below the thresholds are generally out of scope, which is a deliberate carve-out: compliance programs cost money, and the exemptions keep the burden off Main Street merchants while reaching the platforms where Oklahomans actually spend their screen time.
Related stories: Stitt Signs the $12.8 Billion Budget — Now the Line Items · Oklahoma's Early $12.9 Billion Budget Deal, Explained.
What it means for Tulsa businesses
Local companies in advertising technology, health services and app development should expect two workstreams before 2027: a data inventory, so they can answer a consumer's confirm-and-delete request, and vendor contract updates, because service agreements must now allocate privacy duties. Companies already compliant with other states' privacy laws will find the lift smaller — the Oklahoma law follows the same architecture.
Enforcement is expected to run through the Attorney General's office, the standard model in peer states, with a cure period that lets companies fix violations before penalties attach. The specifics of the cure window are worth confirming in the enrolled text.
How does Oklahoma compare nationally?
Oklahoma joins a growing bloc; roughly twenty states have adopted comprehensive privacy statutes, with California's 2018 law as the template. The pattern is now routine: red and blue states alike pass near-identical frameworks because Congress has not. For Oklahomans, the practical effect is that a deletion request sent to a major app will finally be backed by their own state's law rather than someone else's.
What to watch next
Rulemaking and guidance between now and 2027 will set the practical details — what counts as valid consent, how businesses verify who is asking. Businesses should watch the Attorney General's office for compliance guidance, and consumers can expect the first usable rights on January 1, 2027.
For more context, read Oklahoma's 2026 Session Hits Its May 29 Finish Line.
For more context, read stitt signs oklahoma budget.
For more context, read Oklahoma's Early $12.9 Billion Budget Deal, Explained.