Consumer Data Privacy
Oklahoma Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines
What Oklahoma’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed July 2026.
What You Need to Know
Oklahoma's law is a more business friendly law that is based on the laws in Virginia and Texas. It does not require controllers to recognize universal opt out mechanisms.
Official law text
Who the law applies to
| Threshold | Requirement |
|---|---|
| Annual gross revenue | N/A |
| Consumers whose data is processed | 100,000 or more consumers 2.4% of state’s 4.1 million population |
| Revenue from sale of personal data | Derives more than 50% of gross revenue from sale of personal data and controls or processes the personal data of at least 25,000 consumers. |
Consumer rights under Oklahoma's law15
| Right | Provided? |
|---|---|
| Know | Yes |
| Access | Yes |
| Obtain list of third parties to which personal data was disclosed | No |
Data portabilitynoteRight applies only to data provided by the consumer to the controller. | Partial |
| Delete | Yes |
| Correct inaccuracies | Yes |
| Not be discriminated against for exercising rights | Yes |
| Opt-out of sale | Yes |
| Opt-out of targeted advertising/sharing | Yes |
| Opt-out of certain types of profiling | Yes |
| Opt-out of ADMT | No |
| Recognize opt-out signals | No |
| Revoke consent | No |
| Not process data in discriminatory manner | No |
| Appeal | Yes |
Categories treated as sensitive data8
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Sexual orientation
- Citizenship or immigration status
- Genetic or biometric data for purposes of uniquely identifying an individual
- Personal data of known child
- Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data.
How sensitive data must be treated2
- Obtain Consent to Process
- Conduct Data Protection or Risk Assessment
Requirements for minors' data1
- Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent
Activities that trigger a risk or impact assessment5
- Targeted advertising (“sharing”)
- Sale of personal data
- Processing of sensitive data
- Processing personal data for purposes of profiling where it presents reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers; financial, physical, or reputational injury to consumers; physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; other subject injury to consumers
- Any processing activities involving personal data that present a heightened risk of harm to consumers
Other notable provisions8
- Opt-out Request Can Be Verified
- Data Processing Agreements
- Privacy Policy
- Implement Reasonable Data Security Measures
- Duty to Avoid Secondary Use
- Data Minimization
- Attorney General Enforcement
- Right to Cure
note
30 day right to cure that does not sunset.
Key dates1
| Date | What happens |
|---|---|
| January 1, 2027 | Oklahoma's consumer data privacy law takes effect |
Questions about Oklahoma’s privacy law?
Stauss PLLC advises companies on state privacy, AI, and data broker compliance.
Contact Stauss PLLCThis page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.