SB 546: Data privacy; establishing consumer rights; appeal process; privacy notice; data protection assessments; penalties; liability. Effective date. - Oklahoma

Floor (House) → Floor (Senate) · 1 edit

MINOR

The bill text was reformatted from the House version to the Senate version, which includes a more detailed summary of the bill's contents and updated page headers. The substantive legal definitions and provisions regarding data privacy remain identical in both versions.

TECHNICAL

The document structure was updated to reflect the Senate floor version, including a comprehensive summary of the bill's purpose and updated page numbering/headers.

SB546 (3-17-25) (HOWARD) FS FA2.PDF → Floor (House) · 4 edits

MODERATE

The bill was amended during the House floor session to transition from a Senate substitute version to an engrossed version, incorporating committee amendments. The most significant substantive change is the addition of new definitions for 'Decision that produces a legal or similarly significant effect' and 'De-identified data', which expand the scope of consumer protections and clarify data handling standards. The text also includes formatting updates to reflect the final House version, such as adding co-sponsor information and adjusting the header.

Scope change

The bill's scope was expanded by adding specific definitions for 'De-identified data' and 'Decision that produces a legal or similarly significant effect', which clarifies how data must be handled and what types of automated decisions are covered under consumer rights.

DEFINITION

Added a new definition for 'De-identified data' to specify that data cannot reasonably be linked to an individual or device.

Expanded the definition of 'Decision that produces a legal or similarly significant effect' to include access to basic necessities like food and water.

TECHNICAL

Changed the document header from 'Floor Substitute' to 'Engrossed Senate Bill' and added co-sponsor information.

Inserted bracketed text summarizing the bill's key topics (data privacy, consumer rights, penalties, etc.) for reference.

SB546 (3-04-25) (HOWARD) WDFA1.PDF → SB546 (3-17-25) (HOWARD) FS FA2.PDF · 5 edits

MODERATE

The bill was completely rewritten from a floor amendment into a full floor substitute, replacing the previous version's specific edits with a comprehensive data privacy framework. This new version establishes a robust legal structure defining consumer rights, controller duties, and processor responsibilities, while introducing critical new definitions for terms like 'consent' and 'biometric data' to ensure clarity and enforceability.

Scope change

The bill's scope expanded from a set of targeted amendments to a complete statutory framework covering data privacy, consumer rights, and enforcement mechanisms across the state.

DEFINITION

Added extensive new definitions for key terms including 'Affiliate', 'Biometric data', 'Consent', 'Controller', 'Consumer', and 'Dark pattern' to establish a clear legal foundation.

REQUIREMENT

Introduced new requirements for how personal data must be processed, including specific rules for obtaining valid consumer consent and handling biometric information.

Added specific prohibitions against using 'dark patterns' to obtain consent and clarified that simple actions like hovering or pausing content do not constitute valid consent.

ENFORCEMENT

Established enforcement authority for the Attorney General, including penalties for violations and procedures for data protection assessments.

ELIGIBILITY

Redefined 'Consumer' to strictly limit protections to individuals acting in a personal or household context, excluding commercial or employment activities.

SB546 (3-04-25) (HOWARD) FA1.PDF → SB546 (3-04-25) (HOWARD) WDFA1.PDF · 1 edit

MINOR

The bill's filing date was updated from March 4, 2025, to March 17, 2025, reflecting a revision to the document. No substantive policy changes, scope adjustments, funding modifications, or new requirements were identified in this update.

TECHNICAL

The document's timestamp was changed from March 4, 2025, to March 17, 2025, indicating a revision to the filing record.

Enrolled (final version) → SB546 (3-04-25) (HOWARD) FA1.PDF · 4 edits

MODERATE

The amendment modifies the data privacy bill by refining the definition of 'personally identifiable information' to explicitly list specific data points like home addresses and social security numbers. It also restricts how consumer data can be used, prohibiting processing for undisclosed purposes, and changes the criteria for when a business is considered to be 'selling' personal data.

Scope change

The bill's scope regarding data definitions and usage restrictions has been narrowed and clarified to ensure specific types of sensitive information are covered and to prevent undisclosed data usage.

DEFINITION

The definition of 'personally identifiable information' was updated to explicitly include specific items such as home addresses, email addresses, phone numbers, and social security numbers.

REQUIREMENT

A new requirement was added prohibiting the processing of consumer personal data for any purpose that was not disclosed in the privacy notice.

The language defining when a business 'controls or processes' data was changed to specifically refer to when a business 'engages in the sale of' data.

The specific list of examples regarding what constitutes a 'decision that produces a legal or similarly significant effect' was removed from the text.

Engrossed → Enrolled (final version) · 7 edits · Mar 20, 2026

MODERATE

The bill transitioned from a draft version to its final enrolled form, incorporating additional sponsors and expanding the summary of contents to explicitly include provisions for data protection assessments and Attorney General oversight. While the core definitions and structure remain consistent, the final version clarifies the scope of enforcement and adds specific procedural requirements for handling consumer data requests.

Scope change

The bill's scope was clarified in the summary of contents to explicitly include data protection assessments and specific duties for the Attorney General, though the substantive definitions of terms like 'consumer' and 'controller' remained largely unchanged.

ELIGIBILITY

The list of bill sponsors was updated to include additional representatives (Archer, Pae, Provenzano, Waldron, and Alonso-Sandoval) who joined the original authors.

REQUIREMENT

The summary of contents was expanded to explicitly mention requirements for data protection assessments and the Attorney General's role in reviewing them, adding clarity to the bill's procedural obligations.

DEFINITION

The definition of 'Biometric data' was streamlined to remove repetitive phrasing regarding unique biological patterns while retaining the exclusion of standard photos and videos.

The definition of 'Health record' was simplified by removing the detailed list of inclusions (such as confidential communications) that were present in the draft but not necessary for the final statutory text.

The definition of 'Institution of higher education' was removed entirely from the final version, suggesting it was either incorporated elsewhere or deemed unnecessary for this specific bill.

The definition of 'Nonprofit organization' was truncated in the final version, cutting off the specific references to Oklahoma corporate titles.

TECHNICAL

Formatting inconsistencies were corrected, including the removal of bracketed summary text that appeared in the draft but was replaced with a formal 'An Act' header in the enrolled version.

Amended And Engrossed → Engrossed · 3 edits · Mar 16, 2026

MINOR

The bill's title and authorship section were reorganized to reflect Senate amendments, and a comprehensive list of legislative topics was added to the header to clarify the bill's content. The most significant substantive change is the complete replacement of the definitions section, which now includes new definitions for 'Affiliate,' 'Biometric data,' 'Dark pattern,' and 'Decision that produces a legal or similarly significant effect,' while updating existing definitions to align with the final Senate version.

Scope change

The scope of the bill remains focused on data privacy and consumer rights, but the updated definitions will alter how specific terms like 'Affiliate' and 'Biometric data' are legally interpreted and applied.

DEFINITION

The definitions section was completely rewritten to replace the House version with the Senate version, introducing new definitions for 'Affiliate,' 'Dark pattern,' and 'Decision that produces a legal or similarly significant effect,' and refining the definition of 'Biometric data.'

TECHNICAL

The document header was restructured to remove the 'House Amendments' label and replace it with 'Engrossed Senate Bill,' indicating the bill has been amended by the Senate and is in its final form before becoming law.

A detailed list of topics covered by the bill (e.g., appeal process, penalties, data protection assessments) was inserted into the header to provide a summary of the legislation's contents.

Introduced → Amended And Engrossed · 4 edits · Mar 16, 2026

MODERATE

The bill was amended to replace the original title and enacting clause with a new version that includes a comprehensive list of all provisions, ensuring the final text accurately reflects the full scope of the data privacy law. Additionally, new coauthors were added to the bill, and the definition of 'Biometric data' was clarified to explicitly include specific biological patterns like fingerprints and iris scans while maintaining exclusions for standard photos and videos.

Scope change

The scope of the bill's description was expanded in the title to list every section, clarifying that the law covers data privacy, consumer rights, appeal processes, and specific enforcement mechanisms.

DEFINITION

The definition of 'Biometric data' was updated to explicitly list examples like fingerprints and eye retinas, clarifying exactly what biological data is covered by the law.

A new definition for 'Children's Online Privacy Protection Act of 1998' was added to clarify how federal child privacy laws interact with this state bill.

TECHNICAL

The bill's title and enacting clause were completely rewritten to include a detailed summary of all sections, providing a clearer overview of the law's contents.

ELIGIBILITY

New coauthors were added to the bill, indicating expanded legislative support or sponsorship.

Data privacy; establishing consumer rights; appeal process; privacy notice; data protection assessments; penalties; liability. Effective date.

What changed between versions

How they voted

Actions timeline

Sponsors