Oklahoma has joined the growing list of states passing comprehensive consumer data privacy legislation, creating new compliance considerations for companies that collect, process, or rely on consumer data as part of their operations. The newly enacted law establishes a framework that grants consumers expanded control over their personal data while placing new obligations on businesses that meet certain thresholds.
At a high level, the law applies to companies operating in Oklahoma that either process personal data for at least 100,000 consumers annually or handle data for at least 25,000 consumers while deriving more than 50% of revenue from selling that data. This scope means many fintechs, data-driven service providers, and certain large collection operations could fall within its reach, depending on how they use consumer data.
What the law requires: The legislation introduces a familiar set of consumer rights that mirror other state privacy frameworks:
- Consumers can access, correct, delete, and obtain copies of their personal data
- Consumers can opt out of targeted advertising, data sales, and certain profiling activities
- Businesses must provide clear privacy notices explaining how data is used and shared
- Companies must respond to consumer requests and establish an appeals process for denied requests
Operational and compliance expectations: The law also imposes several operational requirements that companies will need to build into their workflows:
- Data protection assessments are required for high-risk processing activities such as profiling and targeted advertising
- Contracts must be in place governing how third parties process personal data
- Companies must implement reasonable data security practices and avoid discriminatory treatment of consumers exercising their rights
Importantly, enforcement authority rests exclusively with the state Attorney General, with penalties reaching up to $7,500 per violation. The law also includes a 30-day cure period before enforcement action is taken.
Key takeaway for the industry
While the law does not establish a new high benchmark compared to other state privacy regimes, it reinforces a clear trend. States are continuing to expand oversight of how consumer data is collected and used.
