Oklahoma Just Became the 21st State to Pass a Comprehensive Privacy Law

Seven Years in the Making

Oklahoma's House of Representatives passed Senate Bill 546 on February 19, 2026, with an overwhelming 84 to 4 vote. The legislation makes Oklahoma the 21st state to enact a comprehensive consumer privacy law, joining a growing patchwork of state level protections that now covers roughly half the country.

The bill's passage caps seven years of legislative negotiations. The Senate had unanimously passed it in March 2025, and a House committee approved it in April, but the measure stalled before the end of last year's session. This time, it cleared with near unanimous support.

As Rep. Josh West put it: "It's a start and you take what you can get." The statement captures both the relief of finally passing a privacy bill and the acknowledgment that the law is a compromise.

What Rights Do Oklahomans Get

SB 546 grants Oklahoma residents a set of data rights that have become standard across state privacy laws:

• The right to confirm whether a business is processing your personal data
• The right to access and obtain a copy of your data in a portable format
• The right to correct inaccurate personal data
• The right to request deletion of your personal data
• The right to opt out of targeted advertising, data sales, and certain types of profiling

The law also requires businesses to conduct data protection assessments for processing activities that present heightened risks, such as targeted advertising, selling personal data, or processing sensitive information.

Who It Applies To

SB 546 applies to businesses operating in Oklahoma that meet one of two thresholds:

• Control or process the personal data of at least 100,000 Oklahoma consumers per year, OR
• Process data from at least 25,000 consumers while deriving more than 50% of gross revenue from selling personal data

These thresholds mirror those in Virginia's Consumer Data Protection Act, which has served as the template for roughly 19 of the 21 enacted state privacy laws. The thresholds are high enough to exempt small businesses while capturing the data brokers, adtech companies, and large platforms that handle the most consumer data.

What Is Missing

For all its progress, SB 546 has notable gaps that consumer advocates have flagged:

• No private right of action: Consumers cannot sue companies directly for privacy violations. Enforcement rests exclusively with the Oklahoma Attorney General
• No universal opt out recognition: Unlike California and Colorado, the law does not require businesses to honor browser based opt out signals like Global Privacy Control
• A permanent 30 day cure period: Before enforcement action, businesses get 30 days to fix violations. Unlike similar provisions in other states, this cure period does not sunset, giving companies a built in grace period indefinitely
• No enhanced children's protections: The law does not include specific provisions for minors beyond what existing federal law requires

Consumer Reports and EPIC (Electronic Privacy Information Center) opposed earlier versions of the bill, arguing it was too deferential to industry interests. The final version retains most of the provisions they objected to.

The State Privacy Patchwork Grows

With Oklahoma joining the club, 21 states now have comprehensive privacy laws on the books. The trend is accelerating: three new laws took effect on January 1, 2026 (Indiana, Kentucky, and one other), and app store privacy bills are now active in 10 states. California's SB 85, which passed the Senate on February 10, would require social media platforms to enable data portability through third party interoperability interfaces.

Yet the growing patchwork also highlights the absence of a federal privacy law. Companies operating nationwide must comply with a mosaic of different requirements, thresholds, and enforcement mechanisms that vary from state to state. For consumers, the protections you have depend entirely on where you live.

When It Takes Effect

The Senate still needs to concur with House amendments, including the change that moved the effective date to January 1, 2027. Assuming that final vote succeeds, Oklahomans will begin exercising their new data rights roughly ten months from now.

For the millions of Americans still living in states without comprehensive privacy laws, Oklahoma's passage is a reminder that the legislative momentum continues to build, even if the resulting protections are not as strong as advocates would like. Half the country now has state privacy law coverage. The question is whether the other half, and Congress, will follow.