Government Modernization and Technology

Oklahoma's SB 1521 prohibits AI chatbots designed to simulate emotional relationships (called "companion" chatbots) if they risk encouraging minors to engage in sexual content, self-harm, or violence. It requires all AI chatbot providers to implement verified age checks using state-issued ID (not just birth dates) before allowing access, and bans minors from using companion chatbots. The bill also mandates that chatbots clearly disclose they are AI at the start of each conversation and every 30 minutes, while restricting data collection and prohibiting the sharing of age verification information. These rules apply to any AI chatbot service operating in Oklahoma, with enforcement by the Attorney General.

SB 546 establishes data privacy rights for Oklahoma residents by requiring businesses that process personal data (referred to as "controllers") to honor consumer requests about their information. It mandates clear privacy notices, prohibits deceptive "dark patterns" for consent, and gives consumers rights to access, correct, or delete their data. The law excludes health data covered by HIPAA, certain nonprofit organizations, and educational institutions. Businesses must respond to requests within specific timeframes and implement data protection measures, with enforcement by the Attorney General.

HB 4194, the Data Center Decommissioning Act, requires owners of large data centers (100+ MW facilities) in Oklahoma to cover all costs for safely shutting down and restoring sites when operations end. Owners must provide financial assurance (like bonds or escrow funds) before construction to cover decommissioning, environmental cleanup, and site restoration, which must be completed within 12 months of closure. The law mandates removal of all infrastructure (buildings, equipment, hazardous materials) and land restoration to pre-construction conditions, with the Oklahoma Corporation Commission enforcing compliance. The bill takes effect November 1, 2026.

HB 3523 requires large social media platforms (with over 100 million global users accessible in Oklahoma) to provide users with detailed written notice before taking adverse actions like suspensions or deletions. This notice must specify the violated rule, content in question, evidence, and proposed action, followed by a 7-day response period and human review. Platforms may temporarily restrict accounts to prevent imminent harm only if they provide 24-hour notice and hold a full hearing within 7 days, restoring accounts if the action isn't justified. Affected users gain a right to sue for $10,000 per violation or seek injunctive relief, while Oklahoma's Attorney General can enforce the law with civil penalties up to $25,000 per violation. The law takes effect November 1, 2026.

SB 68 amends Oklahoma's Information Technology Consolidation and Coordination Act to require state agencies to obtain a Memorandum of Understanding (MOU) with the Chief Information Officer (CIO) before hiring IT staff. The MOU must detail specific job roles, qualifications, and the agency's commitment to follow CIO-established security and data integrity standards. Agencies cannot hire IT personnel until the CIO and the agency fully execute the MOU, and the CIO may audit compliance with the agreement. This emergency law became effective immediately without the Governor's signature on May 26, 2025.