Oklahoma Enacts First Post-VCDPA Data Privacy Law
Oklahoma enacts its first data privacy law after Virginia's VCDPA.
Why it matters: This law influences compliance strategies nationwide; non-adaptation could risk sanctions.
- OKDPA signed March 23, 2026, effective January 1, 2027.
- Affects businesses with data on 100,000+ consumers or 25,000 with large data sales.
- Modeled after VCDPA, offering consumer rights like access and opt-out.
- Critics point to weak enforcement and sales loopholes, urging stronger measures.
Oklahoma has enacted the Oklahoma Data Privacy Act (OKDPA), the first state-level data privacy law post-Virginia Consumer Data Protection Act (VCDPA). Signed on March 23, 2026, and effective January 1, 2027, it parallels the VCDPA by advancing safeguards such as the rights to access, correct, and opt out of personal data sales and targeted advertisement.
"Opt-out" under OKDPA allows consumers to reject the sale of their data, a crucial aspect in data privacy. The law targets businesses processing personal data of over 100,000 consumers or those with significant revenue from data trading involving over 25,000 consumers. This strict criterion means greater operational shifts for impacted enterprises.
Consumer Reports criticizes the act for weak enforcement and potential loopholes in the definition of a "sale." Without robust mechanisms, the effectiveness of this law could be compromised, leaving consumers vulnerable.
Representative Josh West, referring to Senate Bill 546, emphasized the necessity, stating, "In the age of the internet, personal data is valuable currency." However, voices like Matt Schwartz of Consumer Reports call for tighter enforcement to ensure genuine business compliance.
With OKDPA setting a new precedent, businesses must scrutinize data handling practices now to avoid future compliance breaches as other states may follow suit, aiming for cohesive data protection strategies nationwide.
By the numbers:
- 100,000+ — consumer threshold triggering OKDPA compliance.
- 25,000+ — consumers impacting businesses with major data sale revenues.
- January 1, 2027 — date when OKDPA takes effect.
What's next: Monitoring OKDPA's implementation may guide future state-level privacy laws.