Law / United States / 
Oklahoma
SB 546, Oklahoma Consumer Data Privacy Act
Okla. Stat. tit. 75A, section 300 et seq. (2026 Senate Bill 546, Oklahoma Consumer Data Privacy Act)
An age-appropriate design code rule binding private bodies.
- Private right of action
- No
- Penalties
- Up to $7,500 per violation, with a mandatory 30 day right to cure
- Audit expectation
- none
What it requires
- Applies to controllers subject to the Oklahoma Consumer Data Privacy Act. Treat personal data collected from a known child (an individual younger than 13) as sensitive data, and do not process it without consent.
- Handle a known child's personal data in accordance with COPPA.
- You need not apply a separate targeted advertising or sale restriction to minors 13 and older under this Act.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Oklahoma Attorney General
Settledness
- As of
- Open questions
- What facts make an individual younger than thirteen a "known child" whose personal data is sensitive data under Title 75A of the Oklahoma Statutes, when the Oklahoma Consumer Data Privacy Act defines "child" but not "known"?
What it reaches
Age threshold
13
Covered services
Controllers subject to the Oklahoma Consumer Data Privacy Act processing personal data collected from a known child under 13
How the hook was established
express
What makes it apply
Data subject residence
What it makes you log
Logging duty
The row's duty is consent and COPPA handling for a known child's sensitive data, which names no log, record or proof of age. Section 10 (tit. 75A, section 309) adds a separate data protection assessment duty that this entry does not rest on.
- Kind
- None
- As of
- Provision
- SB 546 (2026) section 7 (Okla. Stat. tit. 75A, section 306)
What this law does
Comprehensive consumer privacy law whose minor specific protection is that personal data collected from a known child, defined as an individual younger than 13, is sensitive data that a controller may not process without consent and, for a known child, must handle in accordance with COPPA. It contains no separate targeted advertising or sale restriction for minors 13 and older.
Passed the House 84 to 4 on and the Senate 38 to 7 on , and signed by Governor Stitt on .
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .