Law / United States / 
Oklahoma
Oklahoma Consumer Data Privacy Act, general applicability and exemptions
Okla. Stat. tit. 75A, Secs. 314-315
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Confirm you conduct business in Oklahoma, or target a product or service to Oklahoma residents, and meet the 100,000-consumer or 25,000-consumer-plus-majority-revenue-from-data-sales threshold before relying on this Act's scope in compliance planning.
- Confirm whether a sector exemption applies before this Act's effective date. It excludes state agencies, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions, Health Insurance Portability and Accountability Act (HIPAA) covered entities, nonprofits, and higher-education institutions.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does the exemption for "a financial institution or data subject to Title V of the Gramm-Leach-Bliley Act" in Okla. Stat. tit. 75A, ยง 314(B)(2) exempt a financial institution as an entity, or only its data that is subject to that title?
What it makes you log
Logging duty
Sec. 314 sets the reach of the Act: a controller or processor that conducts business in this state or produces a product or service targeted to its residents and that meets a volume threshold of 100,000 consumers, or 25,000 consumers with over 50 percent of gross revenue from the sale of personal data, followed by the exempt entities. Sec. 315 lists exempt information. A volume threshold is a test of reach and does not require a count to be kept. Neither section imposes a duty to keep a log or record, names an audit, or gives any party a right to a record. The documented data protection assessment sits in Sec. 309, outside this row.
- Kind
- None
- As of
What this law does
The Oklahoma Consumer Data Privacy Act (SB 546 Secs. 15-16) applies to a controller or processor that conducts business in Oklahoma, or produces a product or service targeted to Oklahoma residents, and that during a calendar year controls or processes the personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data.
The Act exempts state agencies and political subdivisions and their service providers, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions, Health Insurance Portability and Accountability Act (HIPAA) and HITECH covered entities and business associates, nonprofits, institutions of higher education, purely personal or household processing, and Controlled Substances Act listed-chemicals data.
Signed into law in the 2026 Regular Session of the 60th Legislature after passing the House on and the Senate on ; Section 22 of the enrolled act sets the effective date as , not yet reached.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .