Cybersecurity Policy Report, Oklahoma Governor Signs Consumer Data Privacy Bill, (Mar 23, 2026)
Organizations Mentioned:Consumer Reports
Gov. Kevin Stitt (R.) has signed into law a bill implementing comprehensive privacy and data protection requirements. The new law takes effect Jan. 1, 2027.
SB 546 enables consumers to access, correct, delete, and obtain copies of their personal data, as well as opt out of targeted advertising, data sales, and certain types of profiling. It will impose requirements on controllers, including the provision of a privacy notice and the maintenance of contracts governing relationships with third-party processors.
Under the new law, companies will be required to provide clear privacy notices, honor consumer requests, and avoid discriminatory practices against consumers exercising these rights. The measure will also require companies to conduct data protection assessments for high-risk data processing and establish contracts with third parties handling personal information.
Provisions of the new law will apply to businesses operating in the state and handling data for at least 100,000 consumers or at least 25,000 consumers while earning over half of their revenue from selling personal data.
SB 546 doesn’t contemplate a private right of action, granting exclusive enforcement authority to the state attorney general. It does allow for a 30-day cure period for violations and would authorize a fine of up to $7,500 for violations. The cure period does not sunset.
Consumer advocates called the bill “weak.” According to Consumer Reports, although the bill includes some basic consumer rights, such as the right to know the information companies have collected about them and the right to delete certain information, “those rights are undercut by weak definitions of key terms like ‘sale’ and ‘targeted advertising,’ no universal opt out or authorized agent provisions, and insufficient enforcement mechanisms. The bill also allows companies to discriminate against consumers who exercise their right to opt out by denying service or charging extra.”
The new law limits the definition of “sale” to exchanges for monetary consideration only, not other valuable consideration.
“This legislation ignores many of the improvements made by recent privacy laws, and instead opts for an outdated model matching that of some of the weakest laws in the nation. The bill includes definitions rife with loopholes, creates broad carveouts, and lacks universal opt-out controls,” said Matt Schwartz, policy analyst at Consumer Reports.
The bill (S.B. 546, Reg Sess.) was sponsored by Sen. Brent Howard (R.).
News: StateLegislation DataPrivacy