WELCOME OKLAHOMA – 20th State to Enact Comprehensive Data Privacy Law

On March 20, 2026, Oklahoma became the 20th state to enact a comprehensive consumer data privacy law. The law is set to take effect in January 2027.

Similar to other state privacy laws, like Virginia and Colorado, Oklahoma’s law establishes a framework of consumer rights, including the ability to access, correct, delete, and opt out of certain uses of personal data.

Key features of the law include:

• Applies to organizations that either:
  1. process personal data of at least 100,000 consumers; or
  2. control or process personal data of at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal data.
• Provides consumers with the right to opt out of the processing of personal data for targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.
• Grants consumers the right to access, correct, and delete personal data, as well as obtain a copy of their personal data.
• Requires controllers to provide a privacy notice that includes: how personal data is processed, how consumers can exercise their rights, the categories of third parties with whom data is shared, and whether personal data is sold, among other disclosures.