HB 1012 Summary: Oklahoma Computer Data Privacy Act

• Enacts the Oklahoma Computer Data Privacy Act to regulate how businesses collect, use, and sell consumers' personal information, applying to for-profit entities doing business in Oklahoma that meet revenue or data volume thresholds ($15M+ annual revenue, process 50,000+ consumers' data, or derive 25%+ revenue from selling personal data).

• Grants consumers the right to request disclosure of collected personal information, request deletion of their data, request disclosure of information sold or disclosed to third parties, and opt out of the sale of their personal information; requires businesses to obtain affirmative consent before collection or sale.

• Requires businesses to provide privacy policies, designate methods for submitting consumer requests, respond within 45 days, and verify consumer identity; prohibits discrimination against consumers exercising these rights and allows financial incentives only with prior opt-in consent.

• Establishes civil penalties of $2,500 per violation or $7,500 for intentional violations, enforceable by the Oklahoma Attorney General; includes exemptions for health information, financial institutions regulated under federal law, and de-identified information with specific restrictions on re-identification.

• Becomes effective one year after enactment; preempts local ordinances and harmonizes with more protective state privacy laws while deferring to federal law if conflict arises.