The Governor of Oklahoma signed SB 546 into law (OKDPA), which closely tracks the Virginia Consumer Data Protection Act (“VCDPA”). The law will take effect January 1, 2027.

• Scope and Applicability. OKDPA applies to controllers and processors that conduct business in Oklahoma or target Oklahoma residents and annually either (a) process or control the personal data of at least 100,000 consumers or (b) derive over 50% of their gross revenue from the sale of personal data and process the personal data of at least 25,000 consumers. The law contains several entity-level exemptions, including for “financial institutions or data” subject to the GLBA, covered entities and business associates governed by HIPAA, nonprofits, and institutions of higher education.
• Consumer Rights. OKDPA grants consumers a set of rights that closely resemble those found in the VCDPA and other comprehensive privacy laws, including rights of access, deletion, correction, and portability, and rights to opt-out of targeted advertising, sale, or profiling “in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer.”
• Transparency Requirements. Controllers must provide reasonably clear and accessible privacy notices to consumers that include information about the categories of personal information processed, the purposes of processing that data, the consumer’s rights and how to exercise them, and the categories of data shared with third parties.
• Sensitive Data. Similar to the VCDPA, controllers must obtain consent to process sensitive data. The scope of sensitive data generally follows the approach taken in the VCDPA and includes data such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, genetic or biometric data that is processed for the purpose of uniquely identifying an individual, personal data collected from a known child, or precise geolocation data.
• Data minimization and purpose limitation. The law incorporates a VCDPA‑style data minimization and purpose limitation requirement, obligating controllers to limit data collection to what is “adequate, relevant, and reasonably necessary” for purposes disclosed to the individual and to obtain consent to process personal data for purposes that are “neither reasonably necessary to nor compatible with the disclosed purposes for which the personal data is processed.”  
• Data Protection Assessments. The law requires controllers to conduct data protection assessments for higher‑risk processing activities, including targeted advertising, processing sensitive data, certain profiling activities that present a reasonably foreseeable risk of substantial injury to consumers, and other processing activities involving personal data that present a heightened risk of harm to consumers.
• Enforcement. Enforcement authority rests with the Oklahoma Attorney General. The bill includes a mandatory 30-day cure period, which does not sunset. The law imposes civil penalties of up to $7,500 per violation.