Oklahoma Privacy Law

Current Status

Oklahoma has made multiple attempts to enact comprehensive data privacy legislation since 2022. The most recent bills — House Bill 2969 and Senate Bill 1796 — were introduced in the 2023–2024 legislative session and follow the Virginia CDPA model that has been adopted by several other Republican-controlled states. Oklahoma's privacy bills have typically passed their initial committee hearings with bipartisan support but have repeatedly failed to make it to floor votes in the final weeks of session. This pattern — advancing in committee but stalling before a full vote — suggests that while there is genuine legislative interest, the bills have not yet achieved the coalition strength needed to survive the competitive end-of-session legislative calendar. Oklahoma's Republican-led legislature has shown willingness to act on privacy in other contexts — the state has enacted protections for minors' social media use — and advocates believe a comprehensive privacy law is achievable if the right bill text and political moment align.

Legislative Timeline

What the Bill Proposes

Oklahoma's proposed legislation is a standard Virginia-model privacy bill providing consumers with rights to access, correct, delete, and receive copies of their personal data, as well as opt-out rights for sale of personal data and targeted advertising. The bill would apply to businesses processing data of 100,000 or more Oklahoma consumers or 25,000+ consumers where data sales exceed 25% of gross revenue. Sensitive data (health, racial origin, sexual orientation, religion, geolocation, biometrics, children's data) would require explicit opt-in consent. Enforcement would be handled exclusively by the Oklahoma Attorney General with a 30-day cure period and civil penalties up to $7,500 per violation.

Proposed Consumer Rights

If enacted as currently drafted, Oklahoma residents would receive the following privacy rights:

Key Provisions of the Proposed Bill

• Standard Virginia CDPA Framework: Oklahoma's bill closely mirrors the widely adopted Virginia model, making compliance straightforward for businesses already operating in other CDPA states.
• 100K Consumer Threshold: Applies to businesses processing 100,000+ Oklahoma residents' data, or 25,000+ if data sales constitute 25%+ of revenue.
• Sensitive Data Protections: Health data, racial/ethnic origin, religious beliefs, sexual orientation, geolocation, biometrics, and children's data all require opt-in consent.
• 30-Day Cure Period: Businesses receive notice and 30 days to fix violations before penalties apply — providing a compliance runway for first-time violations.
• AG-Only Enforcement: No private right of action; enforcement through Oklahoma AG Consumer Protection Unit only.
• Standard Exemptions: HIPAA entities, GLBA financial institutions, government agencies, nonprofits, and higher education institutions are exempt from coverage.

Why It Hasn't Passed Yet

Oklahoma's repeated near-misses stem from a combination of legislative calendar competition and insufficient urgency. The Oklahoma legislative session is short (typically running February through May), and privacy bills that advance through committee often get crowded out by other priorities in the final weeks. Unlike states where a high-profile breach or scandal created urgent public pressure, Oklahoma has not experienced a triggering event. Additionally, some legislators have expressed concern about the compliance burden on Oklahoma small businesses — a concern that has been addressed in successive bill revisions by raising thresholds and adding cure period provisions, but has not been entirely resolved to the satisfaction of all stakeholders.

How Oklahoma Compares to States With Laws

Feature	Oklahoma (Proposed)	Virginia (Active)	California (Active)
Comprehensive privacy rights	Proposed	✅ Yes	✅ Yes
Right to delete	Proposed	✅ Yes	✅ Yes
Opt out of sale of data	Proposed	✅ Yes	✅ Yes
Sensitive data protections	Proposed	✅ Yes	✅ Yes
Enforcement agency	TBD	VA Attorney General	CA Privacy Protection Agency
Private right of action	TBD	No	Yes (breach only)
Currently enforceable	❌ No	✅ Yes	✅ Yes

What You Can Do Right Now

Even though Oklahoma does not yet have a comprehensive privacy law, you are not without options:

• Contact your state legislators — Tell your state senator and representative you support strong data privacy legislation. Personal constituent messages are more impactful than form letters.
• Use your federal rights — HIPAA protects your medical data, COPPA protects children's data under 13, and FCRA gives you rights over your credit data nationwide.
• Exercise California rights if you travel or have accounts there — Some companies apply CCPA rights to all users regardless of state.
• Opt out of data brokers directly — Even without a state law, you can submit opt-out requests to major data brokers. Many comply voluntarily.
• Enable the Global Privacy Control — States like California and Colorado legally require websites to honor this browser signal, which still protects your data on those sites.

Stay Updated on Oklahoma's Privacy Law Progress

Privacy legislation moves quickly. Subscribe to our newsletter and we'll alert you the moment Oklahoma passes a new privacy bill, a vote is scheduled, or a major amendment changes the bill's scope. You'll also receive our monthly digest of all U.S. privacy law changes — free, always.