Oklahoma

Section 1024.1(A)(3), added by Senate Bill 53 (2025), extends Oklahoma's definition of child sexual abuse material to any visual depiction that appears to be a child engaged in sexually explicit conduct regardless of whether the depiction is of an actual child, a computer-generated image, or an image altered to appear to be a child, so long as the depiction is obscene.

This definition governs Sections 1021, 1021.1 through 1021.4, Sections 1022, 1023, and Sections 1040.8 through 1040.24 of Title 21. The amendment took effect November 1, 2025.

House Bill 1364 amended Section 1040.13b of Title 21 of the Oklahoma Statutes, the offense of nonconsensual dissemination of private sexual images, to cover an artificially generated sexual depiction, defined as a visual depiction that appears to authentically depict an individual in a state of nudity or engaged in sexual conduct that did not occur in reality and whose production was substantially dependent upon technical means, including artificial intelligence or photo editing software.

A person commits the offense by disseminating an artificially generated sexual depiction of another person, with the intent or with reckless disregard to harass, annoy, threaten, alarm, or cause physical, emotional, reputational, or economic harm to the depicted person, and without the depicted person's effective consent.

The section does not apply to a dissemination made for the purpose of a lawful criminal investigation, for or in connection with the reporting of unlawful conduct, or that serves a lawful purpose, or to images or depictions involving voluntary exposure in public or commercial settings.

An interactive computer service, a wireless service provider and a telecommunications network or broadband provider are not made liable under the section solely as a result of content or information provided by another person. A violation is a misdemeanor punishable by up to one year in a county jail, a fine of up to $1,000, or both.

A violation by a person who gains or attempts to gain property or anything of value from the dissemination is a felony punishable by up to five years in the custody of the Department of Corrections. A second or subsequent such violation is a felony punishable by up to ten years, and the offender must register as a sex offender. Disseminating three or more such images or depictions within a six-month period is a felony punishable by up to ten years. The Governor approved the bill on May 5, 2025. The amendment took effect November 1, 2025.

Section 2001 of Title 25 provides that the act may be cited as the Parents' Bill of Rights. All parental rights are reserved to a parent of a minor child without obstruction or interference from this state, any political subdivision, any other governmental entity or any other institution. The reserved rights include the right to consent in writing before a biometric scan of the minor child is made, shared or stored.

The reserved rights include the right to consent in writing before any record of the minor child's blood or DNA is created, stored or shared, except as required by sections 1-516 and 1-524.1 of Title 63 or unless authorized by court order. Section 2002 of Title 25 was added by Laws 2014, c.238, section 2, effective November 1, 2014.

A licensee that learns that a cybersecurity event has or may have occurred must conduct, or have an outside vendor or service provider conduct, a prompt investigation. Where the event occurs in a system a third-party service provider maintains, the licensee must complete the investigation steps or confirm and document that the provider has completed them.

The licensee must maintain records concerning all cybersecurity events for at least five years from the date of the event and must produce those records upon request by the Insurance Commissioner. The act becomes effective on July 1, 2024.

Section 1 of Enrolled Senate Bill 543 provides that the act may be cited as the Insurance Data Security Act. Licensee means any person licensed, authorized to operate, or registered, or required to be licensed, authorized to operate, or registered, pursuant to Title 36 of the Oklahoma Statutes, other than a purchasing group or risk retention group chartered and licensed in another state or a person acting as an assuming insurer domiciled in another state or jurisdiction.

Every licensee must notify the Insurance Commissioner without unreasonable delay, but not later than three business days, from a determination that a cybersecurity event involving nonpublic information in the possession of the licensee has occurred when either of two criteria is met.

The first criterion is that this state is the licensee's state of domicile (for an insurer) or home state (for a producer) and the cybersecurity event has a reasonable likelihood of materially harming any material part of the normal operations of the licensee or any consumer residing in this state.

The second criterion is that the licensee reasonably believes the nonpublic information involved is of 250 or more consumers residing in this state and that the event either requires notice to a government body or supervisory body under state or federal law or has a reasonable likelihood of materially harming a consumer residing in this state or a material part of the licensee's operations.

The notifying licensee must provide as much of the listed information as possible, electronically in the manner and form the Commissioner prescribes, and has a continuing obligation to update and supplement its notifications about material changes. An assuming insurer must notify its affected ceding insurers and the Commissioner of its state of domicile within three business days of making the determination that a cybersecurity event has occurred.

The act is the exclusive state law for licensees subject to the jurisdiction of the Insurance Commissioner for data security, the investigation of a cybersecurity event, and notification to the Commissioner. The act does not create or imply a private cause of action for violations of its provisions.

The Insurance Commissioner may examine and investigate the affairs of any licensee to determine whether it is engaged in conduct in violation of the act, and may take action that is necessary or appropriate to enforce the act when the Commissioner has reason to believe a licensee is engaged in violating conduct. A licensee with less than $5,000,000 in gross annual revenue is exempt from the act. Section 11 of Enrolled Senate Bill 543 provides that the act becomes effective July 1, 2024.

In the case of a violation of the act, a licensee may be penalized in accordance with any applicable sections of the Insurance Code, including section 908 of Title 36, or any other provision providing for penalties that the licensee is subject to under its license or permit. Nothing in the act is to be construed to impose any civil liability for any violation of the act or omission to act by the licensee or employees of the licensee.

An individual or entity, defined to include a government, governmental subdivision, agency, or instrumentality as well as a private organization, that owns or licenses computerized data including personal information must provide notice of a breach of security without unreasonable delay.

Personal information includes a name combined with a Social Security number, a driver's license or government-issued identification number, a financial account number, or unique biometric data such as a fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual, and excludes information lawfully obtained from publicly available sources or government records.

Because this definition is purpose-bound to authentication rather than identification generally, and carries neither an exclusion nor a clawback clause, whether an identifier algorithmically derived from a public recording to identify, rather than authenticate access for, a person falls within it cannot be determined from the text; such an identifier would most likely fail the definition's own authentication threshold rather than being excluded by an express carve-out.

Notice to the Attorney General is required within 60 days of consumer notice for a breach affecting 500 or more residents (1,000 or more for a credit-bureau-maintained breach); smaller breaches are exempt from Attorney General notice entirely.

The Attorney General or a district attorney has exclusive authority to enforce a violation causing injury or loss, in the same manner as an unlawful practice under the Oklahoma Consumer Protection Act, and may recover actual damages and a civil penalty of up to $150,000 per breach; the statute creates no private right of action, and reasonable safeguards plus compliant notice is an affirmative defense against the state's own civil-penalty action, not a private plaintiff's claim.

Originally enacted by Laws 2008, House Bill 2245, effective November 1, 2008, and most recently and substantially amended by Laws 2025, Senate Bill 626, effective January 1, 2026.

A controller must conduct and document a data protection assessment of each processing activity that section 309 lists, which includes targeted advertising, the sale of personal data, certain profiling, the processing of sensitive data and any processing that presents a heightened risk of harm to consumers. A controller must make a data protection assessment available to the Attorney General upon written request pursuant to a civil investigation demand.

A data protection assessment is confidential and exempt from public inspection and copying under the Oklahoma Open Records Act. The assessment duty applies to processing activities that commence on or after the effective date of the act and is not retroactive. The act becomes effective on January 1, 2027.

The Oklahoma Consumer Data Privacy Act (SB 546 Secs. 15-16) applies to a controller or processor that conducts business in Oklahoma, or produces a product or service targeted to Oklahoma residents, and that during a calendar year controls or processes the personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data.

The Act exempts state agencies and political subdivisions and their service providers, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions, Health Insurance Portability and Accountability Act (HIPAA) and HITECH covered entities and business associates, nonprofits, institutions of higher education, purely personal or household processing, and Controlled Substances Act listed-chemicals data.

Signed into law in the 2026 Regular Session of the 60th Legislature after passing the House on February 19, 2026 and the Senate on March 16, 2026; Section 22 of the enrolled act sets the effective date as January 1, 2027, not yet reached.

A person who is or has been a patient of a doctor, hospital or other medical institution is entitled, on request, to obtain access to the information contained in the patient's medical records, including any x-ray or other photograph or image, pathology slide or the patient's medical bills.

Disclosure regarding a deceased patient requires either a court order or a written release of an executor, administrator or personal representative appointed by the court, or if there is no such appointment, of the spouse or, if none, of a responsible member of the family.

A patient must be furnished copies of all medical records, including any x-ray, other photograph or image, pathology slide or medical bills, on request and on tender of the expenses the paragraph lists, and the cost of each copy to the patient is fifty cents for each page.

A physician, hospital or other medical professional or institution, or its business associate, may not charge a person who requests the person's own record a fee for searching, retrieving, reviewing and preparing the medical records.

The access and copy provisions do not apply to psychological, psychiatric, mental health or substance abuse treatment records, for which access is obtained under section 1-109 of Title 43A. Any person refusing to furnish records or information required by section 19 of Title 76 is guilty of a misdemeanor. Section 19 of Title 76 was enacted by Laws 1976, SB 622, c.44, section 3, with an emergency effective date of April 8, 1976. Section 19 of Title 76 was most recently amended by Laws 2021, SB 96, c.231, section 1, effective November 1, 2021.

No person may disclose any nonpublic personal information contrary to the provisions of Title V of the Gramm-Leach-Bliley Act of 1999, Public Law No. 106-102. The Insurance Commissioner may promulgate rules necessary to carry out section 307.2 of Title 36. Section 307.2 of Title 36 is codified in Article 3 (Insurance Department - Insurance Commissioner - State Insurance Board) of Chapter 1, the Insurance Code.

Nothing in section 307.2 of Title 36 is to be construed to create a private cause of action. Section 307.2 of Title 36 was enacted by Laws 2001, HB 1341, c.363, section 1, with an emergency effective date of July 1, 2001.

SB 546 Secs. 2-4 give an Oklahoma consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy in a digital format, and opt out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.

A controller must respond within 45 days of a request, extendable once by 45 more days with notice to the consumer, must fulfill a request free of charge up to twice annually, and may charge a fee for a manifestly unfounded, excessive, or repetitive request only if the controller bears the burden of showing the request is such. A declined request may be appealed through a process the Act requires the controller to establish.

The Oklahoma Attorney General has authority to enforce SB 546. Before suing, the Attorney General must give an alleged violator 30 days' written notice identifying the specific provisions violated (SB 546 Sec. 13); no sunset date for this cure period appears in the sections read.

A controller or processor who violates the Act after that cure period, or who breaches its own written statement of cure, is liable for a civil penalty of up to $7,500 per violation, and the Attorney General may seek to recover it and to restrain or enjoin the violation. The Act expressly forecloses a private right of action for a violation of the Act or any other provision of law.

Section 3614.2 of Title 36 may be cited as the Genetic Nondiscrimination in Employment Act. Employer means employer as defined in section 3(d) of the Fair Labor Standards Act of 1938. Genetic information means information derived from the results of a genetic test.

For purposes of distinguishing between or discriminating against or restricting any right or benefit otherwise due or available to an employee or prospective employee, other than in connection with the determination of insurance coverage or benefits, no employer may seek to obtain or use a genetic test or genetic information of the employee or prospective employee, or require a genetic test of or genetic information from the employee or prospective employee.

An employer violating the section is guilty, on conviction, of a misdemeanor and may be punished by a fine of not more than $25,000, by imprisonment in the county jail for not more than one year, or by both. The section does not apply to an insurer, or to an individual or third party dealing with an insurer in the ordinary course of underwriting, conducting or administering life, disability income or long-term care insurance, including such insurance an employer makes available to its employees. Section 3614.2 was enacted by Laws 1998, HB 3169, c.334, section 2, with an emergency effective date of July 1, 1998.

Section 3614.1 of Title 36 may be cited as the Genetic Nondiscrimination in Insurance Act. An insurer is any entity engaged in the business of insurance that issues accident and health policies or plans, or administers any other type of health insurance policy containing medical provisions, and the term does not include insurers issuing life, disability income or long-term care insurance.

No insurer offering an individual or group accident and health insurance policy may deny or condition the issuance or effectiveness of the policy or certificate on the basis of genetic information, or discriminate in the pricing of the policy or certificate on the basis of genetic information. An insurer may not request or require an individual or a family member of an individual to undergo a genetic test.

An insurer may not request, require or purchase genetic information for underwriting purposes. An insurer may not request, require or purchase genetic information about an individual before the individual's enrollment under the policy in connection with the enrollment.

An insurer may request, but may not require, a genetic test only if each of five conditions is met, the first being that the request is made under research that complies with part 46 of Title 45 of the Code of Federal Regulations or equivalent federal regulations. Section 3614.1 was enacted by Laws 1998, HB 3169, c.334, section 1, with an emergency effective date of July 1, 1998. Section 3614.1 was amended by Laws 2010, SB 2054, c.222, section 27, effective November 1, 2010.

Section 3614.4 of Title 36 may be cited as the Genetic Research Studies Nondisclosure Act. A genetic research study is one approved by an institutional review board as defined in 21 CFR, Section 50, or conducted subject to the federal common rule. All research records of individual subjects in genetic research studies are confidential, meaning the records are not subject to subpoena or discovery in civil suits except where the information in the records is the basis of the suit.

The research records of individual subjects in genetic research studies may not be disclosed to employers or health insurers without the informed consent of the subject. It is permissible to publish or otherwise use the results of genetic research studies for research or educational purposes if no individual subject is identified.

The section does not apply to an insurer, or to an individual or third party dealing with an insurer in the ordinary course of underwriting, conducting or administering life, disability income or long-term care insurance. Section 3614.4 was enacted by Laws 1999, HB 1368, c.82, section 1, effective November 1, 1999.

SB 546 Sec. 1 defines sensitive data as a category of personal data that includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data that is processed for the purpose of uniquely identifying an individual; personal data collected from a known child; and precise geolocation data.

The consumer's prior opt-in consent is required before a controller may process sensitive data.

Biometric data means data from automatic measurement of an individual's biological characteristics, such as a fingerprint, voiceprint, or eye retina or iris, or other unique biological pattern or characteristic, used to identify a specific individual; the definition excludes a physical or digital photograph, a video or audio recording, or data generated from either, unless that data is generated to identify a specific individual, at which point it falls back inside the definition.

A faceprint or voiceprint deliberately extracted from a public photograph or recording for identification purposes is therefore biometric data, and sensitive data, under this Act, the same clawback structure as Kentucky's and New Hampshire's comprehensive acts.

A laboratory, medical facility, hospital or birthing place is prohibited from the unauthorized storage, transferring, use or databasing of DNA from any newborn child without express parental consent. Section 21 of Title 21 provides that where the performance of an act is prohibited by any statute, and no penalty for the violation of the statute is imposed in any statute, the doing of the act is a misdemeanor.

Section 10 of Title 21 provides that, except where a different punishment is prescribed, every offense declared to be a misdemeanor is punishable by imprisonment in the county jail not exceeding one year or by a fine not exceeding five hundred dollars, or both. Section 1175 of Title 21 was enacted by Laws 2010, SB 1250, c.246, section 1, with an emergency effective date of May 10, 2010.

Section 1953 makes it unlawful to willfully and without authorization gain or attempt to gain access to a computer, computer system, or computer network, to willfully exceed the limits of authorization, or to willfully and without authorization use or disrupt computer services, tracking a without-authorization or exceeding-authorization standard rather than California's broader without permission test.

A violation of the access, fraud, disruption, or harassment paragraphs is a Class C2 felony punishable under Section 1955; bare unauthorized access, unauthorized use of computer services, or using a computer to annoy, abuse, threaten, or harass another person is a misdemeanor. The statute expressly exempts a parent, guardian, or foster parent monitoring or denying a child's computer or internet access, and exempts authorized testing evaluating a computer system's own security.

The Oklahoma Consumer Data Privacy Act, which takes effect January 1, 2027, excludes publicly available information from its definition of personal data: information lawfully made available through a government record, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by a consumer, or by a person to whom a consumer disclosed it, unless the consumer restricted the information to a specific audience.

The Act's provisions do not apply to a state agency or political subdivision of Oklahoma, or a service provider processing data on their behalf.

The Oklahoma Deceptive Trade Practices Act lists specific deceptive practices in the course of business, vocation, or occupation, including passing off goods or services as another's and making false representations of source, sponsorship, approval, or affiliation, and gives any person damaged or likely to be damaged by a deceptive trade practice a private right of action for an injunction and, where damages are proved, actual damages. No day on which the Act came into force has been located.

The Commission requires electric utilities to develop, implement, and maintain Homeland Security and Critical Infrastructure Plans in accordance with the industry standards enumerated in the subchapter.

Each electric utility serving Oklahoma jurisdictional ratepayers is required to follow the most current applicable North American Electric Reliability Corporation's (NERC's) Security Guidelines and Standards or equivalent cybersecurity framework as guidelines for protecting its critical infrastructure from extended service interruption.

Each electric utility is required to prepare and make available for inspection a Homeland Security and Critical Infrastructure Plan prepared with reference to those guidelines or an equivalent cybersecurity framework, with a defined cybersecurity strategy. Each utility must submit a Certification Letter to the PUD Director by March 1 of every year, and when a change is made, certifying whether it has a Homeland Security and Critical Infrastructure Plan and whether it is seeking cost recovery.

Each electric utility must submit the Certification Letter required by the subchapter, and the utility is not otherwise required to comply with the provisions of the subchapter.

The Commission requires gas utilities to develop, implement, and maintain Homeland Security and Critical Infrastructure Plans in accordance with the industry standards enumerated in the subchapter.

Each gas utility serving Oklahoma jurisdictional ratepayers is required to follow the most current applicable United States Department of Transportation, Office of Pipeline Safety's "Pipeline Security Information Circular" and "Pipeline Security Contingency Plan Guidance" or equivalent cybersecurity framework as guidelines for protecting its critical infrastructure from extended service interruption.

Each gas utility is required to prepare and make available for inspection a Homeland Security and Critical Infrastructure Plan prepared with reference to those guidelines or an equivalent cybersecurity framework, with a defined cybersecurity strategy. Each utility must submit a Certification Letter to the PUD Director by March 1 of every year, and when a change is made, certifying whether it has a Homeland Security and Critical Infrastructure Plan and whether it is seeking cost recovery.

Each gas utility must submit the Certification Letter required by the subchapter, and the utility is not otherwise required to comply with the provisions of the subchapter.

Section 673 of Title 36 requires each licensee in the state to develop, implement, and maintain a comprehensive written information security program based on its risk assessment that contains administrative, technical, and physical safeguards for the protection of nonpublic information and its information systems.

A licensee is any person licensed, authorized to operate, or registered, or required to be, under Title 36 of the Oklahoma Statutes, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.

A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information.

A licensee must exercise due diligence in selecting its third-party service provider and require the provider to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that the provider holds. Each insurer domiciled in the state must submit to the Insurance Commissioner a written statement by April 15, annually, certifying that the insurer complies with the requirements of section 673.

A licensee with less than five million dollars in gross annual revenue is exempt from the act. In the case of a violation of the act, a licensee may be penalized in accordance with any applicable sections of the Insurance Code. The Insurance Data Security Act became effective on July 1, 2024. Licensees have one year from the effective date to implement section 673 and two years from the effective date to implement its subsection F on third-party service providers. The act does not create or imply a private cause of action for violations of its provisions.

The utility is required to report cybersecurity or infrastructure security events that affect customers immediately to the PUD Director and his or her designee. The electric utility homeland security subchapter states that a utility is not otherwise required to comply with its provisions beyond the Certification Letter and the review provisions.

The utility is required to report cybersecurity or infrastructure security events that affect customers immediately to the PUD Director or designee. The gas utility homeland security subchapter states that a utility is not otherwise required to comply with its provisions beyond the Certification Letter and the review provisions.

The utility is required to report cybersecurity or infrastructure security events that affect customers immediately to the PUD Director or designee.

It is unlawful for a person to initiate an electronic mail message that the sender knows or has reason to know misrepresents or omits its point of origin or transmission path, falsely claims to come from a legitimate online business, or links the recipient to a spoofed business web page to induce the fraudulent disclosure of identifying information; a violator faces a civil penalty of up to $500.00, and the act is also a violation of the Oklahoma Consumer Protection Act.

A person injured by a violation may sue for damages, including lost profits, and, for a fraudulent bulk electronic mail message, an injured recipient other than an email service provider may elect the lesser of $10.00 per message or $25,000.00 per day in place of actual damages, while an injured email service provider may elect the greater of the same two figures, each with attorney's fees and costs.

This prohibition is framed as a rule against falsity or deception in an electronic mail message, whether or not the message is commercial, the kind of state email rule the federal CAN-SPAM Act's own preemption clause leaves in force. Since January 1, 2026, an electronic mail message declared unlawful by subsection A is deemed a Class D1 felony offense punishable by imprisonment as provided in subsections B through F of Section 20N of Title 21.

Subsection E makes selling, giving, distributing, or possessing with intent to distribute software designed or marketed to falsify electronic mail routing information a Class D1 felony offense.

Section 776.6 bars a person sending a commercial electronic mail message from falsifying its routing information, using a false or misleading subject line, or using a third party's internet domain name without consent.

For an unsolicited commercial electronic mail message, one sent without the recipient's consent and without an established business relationship, section 776.6 also requires the first characters of the subject line to read "ADV:", or "ADV-ADULT:" for sexually explicit content, and requires a free, working mechanism for the recipient to opt out of future messages. These labeling and opt-out duties do not reach a message an organization sends only to its own members, employees, or contractors.

A person injured by a violation may sue for damages, or elect the lesser of $10.00 per message or $25,000.00 per day (the greater, for an email service provider), with attorney's fees and costs; a violation is also a violation of the Oklahoma Consumer Protection Act.

The routing-falsification and false-subject-line duties are framed as rules against falsity or deception in a commercial electronic mail message, the kind of state email rule the federal CAN-SPAM Act's own preemption clause leaves in force. The "ADV:" and "ADV-ADULT:" labeling mandate and the opt-out mechanism duty instead expressly regulate the use of electronic mail to send a commercial message, the kind of state regulation that preemption clause displaces.

Since January 1, 2026, a person who violates section 776.6 is, on conviction, guilty of a Class D1 felony offense punished by imprisonment as provided in subsections B through F of Section 20N of Title 21.

Section 177.2 bars any person from installing or using a pen register or a trap and trace device without first obtaining a court order, except for a wire or electronic communication service provider acting to protect its own operations or property, to prevent fraudulent or unlawful use of its service, or with the consent of the service's user. A knowing violation is a misdemeanor punished by a fine not exceeding $1,000.00, imprisonment of not more than one year, or both.

Only a law enforcement officer, prosecutor, or the Attorney General may apply for the court order that section 177.2 requires. The Act does not itself create a civil cause of action for a violation; section 177.5 bars a cause of action against a provider that assists under a court order and gives a good-faith reliance on a court order a complete defense to a civil or criminal action brought under the Act.

Since January 1, 2026, section 176.3 makes it a Class D1 felony offense, punished by a fine of not less than $5,000.00, by imprisonment as provided in subsections B through F of Section 20N of Title 21, or by both, for any person to willfully intercept, disclose, or use the contents of a wire, oral, or electronic communication.

Under section 20N(B) of Title 21, a Class D1 offense is punished by imprisonment for not more than five years, with at least twenty percent of the sentence served before release. Section 20N(C) sets longer terms for a person with prior felony convictions.

Section 176.4 exempts a person who is a party to the communication, or who acts with one party's prior consent, whether or not that person is acting under color of law, so long as a person not acting under color of law does not intercept the communication for the purpose of committing a criminal act. An oral communication is one uttered with an expectation that it is not subject to interception under circumstances justifying that expectation.

Neither this section nor the remainder of the Act states a civil cause of action for a violation; sections 176.5 through 176.14 concern device forfeiture, evidentiary exclusion, and the court-order procedure for law enforcement interception. The sections this entry groups came into force on different days.

A caller may not knowingly insert false information into a caller identification system with the intent to mislead, defraud, or deceive the recipient of a telephone call; information is not false where a person making an authorized call on another's behalf inserts that other person's own name or number. The Act does not apply to blocking caller identification information or to a law enforcement, intelligence, or security agency.

A knowing violation is a misdemeanor punished by imprisonment in the county jail for not more than one year, a fine not more than $10,000.00 per incident, or both, and is also a violation of the Oklahoma Consumer Protection Act.

A commercial telephone seller, a person who causes or attempts to cause a commercial telephone solicitation to be made, may not conduct business in Oklahoma without registering with the Attorney General at least ten days beforehand and filing a $10,000.00 surety bond.

Section 775A.2 exempts a long list of callers and transactions from that registration duty, including a person soliciting business solely from a business purchaser who has previously bought identical or similar goods or services from the caller, and sellers of securities, insurance, and real estate already regulated by their own licensing bodies.

Section 775A.4 makes it an unlawful telemarketing practice, among other things, to use equipment or techniques meant to block or avoid caller identification, or to use automatic dialing equipment resulting in more than five percent abandoned calls a day in a campaign, and requires a purchaser be allowed to cancel a telephone sales transaction within three business days of receiving the goods or services with a refund within thirty days.

A 2011 amendment, Laws 2011 chapter 369, extended the Act's definitions of a commercial telephone seller and a commercial telephone solicitation to reach a cellular telephone text message, not only a voice call.

Every violation of the registration or unlawful-practices provisions is also a violation of the Oklahoma Consumer Protection Act, which gives an aggrieved consumer a private right of action for actual damages, costs, and attorney's fees, an individual civil penalty of up to $2,000.00 per violation found unconscionable, and, for the Attorney General or a district attorney, a civil penalty of up to $10,000.00 per violation.

The Telemarketer Restriction Act requires the Attorney General to maintain a statewide registry of consumers who do not want to receive unsolicited telemarketing sales calls or messages, and bars a telemarketer from calling or messaging a consumer more than thirty days after that consumer's number first appears on the registry, unless the caller has an established business relationship with the consumer or the number has since been removed.

An established business relationship is a relationship formed within the preceding twenty-four months, or an existing relationship formed by the consumer's own inquiry, application, purchase, or transaction, that neither party has ended. The Act's commercial-purposes trigger does not reach a call soliciting funds or support for a charitable, religious, or political cause.

As amended in 2011 by Laws 2011 chapter 369, the Act's telemarketing-call duty also reaches a cellular telephone text message. A willful violation is an unlawful telemarketing practice and a violation of the Oklahoma Consumer Protection Act, giving the consumer the Act's private right of action; alternatively, the Attorney General may assess an administrative fine under a schedule set by rule where the telemarketer shows the violation occurred despite an integral training policy.

The Telephone Solicitation Act of 2022, enacted as HB 3168 and effective November 1, 2022, bars a person from making, or knowingly allowing to be made, a commercial telephonic sales call that involves an automated system for the selection or dialing of telephone numbers or the playing of a recorded message when a connection is completed, without the called party's prior express written consent.

That consent is a written agreement bearing the called party's signature, which may be an electronic or digital signature recognized under federal law or state contract law, that authorizes such calls by telephone call, text message or voicemail to a stated telephone number and discloses clearly and conspicuously that the called party is not required to sign it as a condition of purchasing any property, goods or services.

A caller must transmit its originating telephone number, and its name when its carrier makes the name available, to the recipient's caller identification service, and may not alter a caller's voice to disguise the caller's identity in order to defraud, confuse or injure the recipient or to obtain personal information for fraudulent or unlawful use.

A commercial telephone seller or salesperson may not make a commercial telephone solicitation call before 8 a.m. or after 8 p.m. in the called person's time zone, or more than three such calls to one person in 24 hours on the same subject matter, and may not block its name or number or display a different caller identification number to conceal its identity. A call to any area code in Oklahoma is presumed, subject to rebuttal, to be made to an Oklahoma resident or to a person in the state.

The Act exempts 26 classes of caller and call, among them a person soliciting consumers who have an existing business relationship with, or have previously purchased from, the business the caller represents, a person soliciting for religious, charitable, political or educational purposes, an isolated transaction, licensed securities, insurance and real estate professionals acting within their licenses, supervised financial institutions, and a commercial telephone seller.

A called party aggrieved by a violation may sue to enjoin it and to recover actual damages or $500, whichever is greater, and the court may increase the award to not more than three times that amount for a willful or knowing violation.

Makes a commercial entity that knowingly publishes or distributes material harmful to minors, where more than a third of the site's content meets that definition, civilly liable to a minor's parent or guardian unless it performs reasonable age verification to confirm a visitor is 18 or older, defined as a digitized identification card, an independent third party verification service checking commercial databases, or a commercially reasonable method relying on transactional data.

It also requires the entity to let internet and cellular subscribers request that access to the site be blocked, and bars retaining a user's identifying information after access is granted.

Comprehensive consumer privacy law whose minor specific protection is that personal data collected from a known child, defined as an individual younger than 13, is sensitive data that a controller may not process without consent and, for a known child, must handle in accordance with COPPA. It contains no separate targeted advertising or sale restriction for minors 13 and older.

Passed the House 84 to 4 on February 19, 2026 and the Senate 38 to 7 on March 16, 2026, and signed by Governor Stitt on March 20, 2026.