OKCDPA

Oklahoma enacted its comprehensive privacy law on March 20, 2026, effective January 1, 2027. It follows the Virginia model, applying to controllers handling data on 100,000 Oklahoma consumers, or 25,000 where more than half of revenue comes from selling personal data, with opt-outs of targeted advertising and sale, opt-in consent for sensitive data, and data protection assessments. The Attorney General enforces, with a 30-day cure period and penalties of up to $7,500 per violation. Oklahoma was the twentieth state with a comprehensive privacy law; Alabama, Louisiana, and Vermont followed within three months, and with them came the practical end of state-by-state consent logic. The simpler operating model treats the strictest requirement as the national baseline and uses continuous scanning to confirm the tags comply everywhere, so a new state coming online is a date on a calendar rather than a project.