Oklahoma Becomes the 21st State With a Privacy Law. Here's What It Means for Your Consent Stack.

On February 19, 2026, the Oklahoma House passed SB 546 by a vote of 84-4. The bill, known as the Oklahoma Computer Data Privacy Act, is now awaiting Senate concurrence and the Governor's signature. If signed (which is expected given the near-unanimous support), it takes effect July 1, 2026.

Oklahoma becomes the 21st US state to enact a comprehensive consumer privacy law. The bill follows the Virginia model that most states have adopted, but the pace of adoption tells a bigger story.

Who does SB 546 apply to?

The law applies to businesses that operate in Oklahoma or target Oklahoma residents, and meet one of two thresholds:

• Process the personal data of 100,000 or more Oklahoma consumers in a calendar year, OR
• Process the data of 25,000 or more consumers AND derive 50% or more of gross revenue from selling personal data

These thresholds are identical to Virginia's VCDPA. If you already comply with Virginia, Colorado, or Connecticut, Oklahoma adds minimal new work.

What rights does it give consumers?

Oklahoma's law grants the same five core rights that are now standard across the Virginia-model states:

• Right to confirm and access their personal data
• Right to correct inaccuracies
• Right to delete their data
• Right to data portability (machine-readable format)
• Right to opt out of targeted advertising, sale of personal data, and profiling with legal or significant effects

Sensitive data requires opt-in

Like most state privacy laws, Oklahoma requires opt-in consent before processing sensitive personal data. This includes:

• Racial or ethnic origin
• Biometric data used for identification
• Health information
• Precise geolocation data
• Children's data

If your site collects any of these categories, your consent flow needs to capture explicit opt-in before that data is processed.

Dark patterns are explicitly banned

SB 546 defines consent as a "clear affirmative act" that is freely given, specific, informed, and unambiguous. The law explicitly states that the following do not constitute consent:

• Acceptance of general terms of use or similar broad agreements
• Hovering over, muting, pausing, or closing content
• Any agreement obtained through dark patterns

Enforcement: AG-only with a permanent cure period

Oklahoma's enforcement model is business-friendly compared to states like California:

• Attorney General has exclusive enforcement authority (no private right of action)
• 30-day cure period to fix violations before penalties apply
• The cure period is permanent and does not sunset (unlike some states where it expires after 1-2 years)
• Maximum civil penalty of $7,500 per violation

The permanent cure period is notable. States like Colorado and Connecticut had cure periods that expired, meaning the AG can now penalize without giving businesses a chance to fix issues first. Oklahoma's approach is more forgiving.

What this means for your consent management

If you already have a compliant consent stack for Virginia-model states, Oklahoma is mostly covered. Here's the checklist:

Already covered if you comply with VA/CO/CT:

• Opt-out mechanism for targeted advertising and data sales
• Sensitive data opt-in consent
• Consumer rights request handling (access, delete, correct, port)
• Updated privacy policy with required disclosures

Worth double-checking:

• Your consent banner doesn't use dark patterns (review button sizing, color contrast, and option ordering)
• Profiling opt-out is available (Oklahoma requires it for profiling with legal/significant effects)
• Your geo-detection includes Oklahoma for state-specific compliance scoring

The bigger picture: 21 states and counting

Oklahoma is the 21st state. The pattern is clear: 4-6 new states per year, all following similar frameworks, with no federal law in sight. The states that haven't passed privacy laws yet are increasingly the exception, not the rule.

For businesses, the math is simple. You can either:

• React to each new state law individually (expensive, error-prone, always behind)
• Build a geo-aware consent system once and add new states as they come (what AutoCMP does)

Oklahoma's SB 546 doesn't change the game. It confirms the direction the game has been moving for three years. The question isn't whether your state will pass a privacy law. It's whether you'll be ready when it does.