Oklahoma's Privacy Law (2027): Can You Make Data Brokers Delete You?

Oklahoma's first comprehensive privacy law, SB 546, takes effect January 1, 2027. It gives Oklahomans a right to delete personal data held by covered businesses. We read the enrolled text with one question in mind: will it get you off data broker and people-search sites? Partly. Two clauses limit it.

The Short Version

• Effective January 1, 2027. Approved by the Governor March 20, 2026.
• Right to delete: yes, including data "obtained about the consumer" from other sources.
• Catch 1: a business that got your data from someone else can comply by opting you out instead of erasing it.
• Catch 2: "publicly available information," including government records, is not personal data under the act.
• No broker registry and no fees. Enforcement is by the Attorney General only.

Who Has to Comply

The act applies to businesses that operate in Oklahoma or target Oklahoma residents and, in a calendar year, either process the personal data of at least 100,000 Oklahoma consumers, or process the data of at least 25,000 and get over 50% of gross revenue from selling personal data. Most states that use the second test set it at 25% of revenue. Oklahoma's 50% bar is higher, though a business that lives on selling data will usually clear it.

Your Rights From 2027

1. Confirm whether a business processes your data, and access it.
2. Correct inaccurate data.
3. Delete personal data "provided by or obtained about the consumer."
4. Get a portable copy of data you provided.
5. Opt out of targeted advertising, the sale of your data, and certain profiling.

Businesses must answer within 45 days, with one 45-day extension when reasonably necessary. They must offer at least two secure ways to submit a request and may not make you create a new account to do it. If they refuse, you can appeal. They have 60 days to answer the appeal in writing, and a denial must point you to the Attorney General's complaint mechanism.

Catch 1: An Opt-Out Can Count as a Deletion

Section 3(F) is written for exactly the kind of company that collects your data without dealing with you. A business that "obtained personal data about a consumer from a source other than the consumer" is treated as complying with a deletion request if it either:

• keeps a record of the request and the minimum data needed to make sure your data stays deleted, or
• opts you out of processing that data for any purpose that is not exempt.

The second option means a broker can stop using your record without erasing it. When a broker replies to an Oklahoma deletion request, read which of the two it says it did.

Catch 2: Public Records Are Excluded

The act defines personal data so that it "does not include de-identified data or publicly available information." Publicly available information includes information "lawfully made available through government records," and information a business reasonably believes is lawfully available to the general public through widely distributed media.

People-search sites build their profiles largely from property records, court files and voter rolls. Those underlying records are outside the act. What a broker adds on top, such as a phone number from a marketing list or data bought from another company, may still be covered. In practice, expect some brokers to refuse Oklahoma requests on public-records grounds.

Enforcement

• The Attorney General has exclusive authority. There is no private right of action, so you cannot sue a business under the act yourself.
• A permanent cure period. The Attorney General must give 30 days' written notice before suing, and cannot sue if the business fixes the problem and says so in writing. Unlike some states, this cure right does not expire.
• Penalties: up to $7,500 per violation.

What Oklahomans Can Do Now

1. Start with people-search sites. Most offer an opt-out to anyone, law or no law. Steps for each are in our free opt-out guides.
2. From January 1, 2027, cite the act. Name it in your request: the deletion right under Oklahoma SB 546, codified at Title 75A of the Oklahoma Statutes. The free deletion letter generator drafts the letter.
3. Ask what they did. Because an opt-out can count as compliance, ask the broker to say whether it deleted your data or only opted you out.
4. Keep every reply. If a business ignores you or denies your appeal, that record is what you send to the Attorney General.

Frequently Asked Questions

Does the law let someone else send requests for me?

The act names a parent or legal guardian acting for a known child. We did not find a section on authorized agents for adults. Some businesses accept agent requests anyway, and some will ask you to confirm the request yourself.

Does Oklahoma require businesses to honor Global Privacy Control?

We did not find a universal opt-out signal requirement in the enrolled text. You can still opt out with each business directly.

Where can I read the law?

The bill history is on the Oklahoma Legislature's SB 546 page, and the enrolled text is here.