OK SB546

Establishes consumer data privacy rights for Oklahoma residents, including the right to access, correct, delete, and obtain copies of personal data, as well as opt out of targeted advertising, data sales, and certain profiling activities

Applies to businesses that conduct business in Oklahoma and either process personal data of at least 100,000 consumers annually, or process data of at least 25,000 consumers while deriving over 50% of gross revenue from personal data sales

Requires controllers to provide clear privacy notices, obtain consent before processing sensitive data (including biometric data, precise geolocation, health diagnoses, and children's data), and conduct data protection assessments for high-risk processing activities

Grants exclusive enforcement authority to the Oklahoma Attorney General, with civil penalties up to $7,500 per violation after a 30-day cure period; explicitly prohibits private right of action

Exempts state agencies, nonprofits, higher education institutions, financial institutions subject to Gramm-Leach-Bliley Act, and HIPAA-covered entities; effective date of January 1, 2027 (House amendment) or July 1, 2026 (Senate version)