Central Intelligence
Central IntelligencePERSPECTIVE IS EVERYTHING
Last Update: 08/01/2026 at 4:34 PM EST

State Consumer Privacy Law Wave

Coverage from Future of Privacy Forum, Hunton Andrews Kurth LLP, and others

Articles

15

Active Days

118

The Topic

State Consumer Privacy Law Wave topic image

Multiple U.S. states are enacting or advancing comprehensive consumer privacy laws with similar core rights: access, deletion, correction, portability, and opt-outs for targeted advertising and data sale. Oklahoma and Alabama are the main current examples, both using attorney general enforcement, cure periods, and broad exemptions that limit how disruptive the laws may be in practice. The cluster also shows ongoing debate over how strong these laws really are, especially around universal opt-out signals, private rights of action, and narrow sale definitions. A federal privacy bill has also been introduced, but the signal remains dominated by state-level lawmaking rather than national standard-setting.

First Article: 02/19/26

Latest Article: 06/16/26

Summary

  • Oklahoma and Alabama are the clearest current focal points, each enacting comprehensive consumer privacy laws in 2026.
  • The laws share a common rights package: access, correction, deletion, portability, and opt-outs for targeted advertising, data sale, and some profiling.
  • Enforcement is mostly centralized in state attorneys general, with cure periods and no private right of action in the leading state laws.
  • Business-side carve-outs remain significant, including exemptions for HIPAA, GLBA, FERPA, employment contexts, and some analytics or marketing uses.
  • Definitions of 'sale,' targeted advertising, and biometric or sensitive data vary by state, shaping how broad the practical obligations really are.
  • Some coverage frames the laws as meaningful consumer protections, while other coverage emphasizes loopholes, narrow enforcement, and limited universal opt-out recognition.
  • A federal SECURE Data Act proposal appears in the background, but the current momentum is still state-driven.

History

This topic is new, but as new articles are added to it this area will summarize shifts, changes and expansions of the issues.

Featured

03-23-2026
Future of Privacy Forum / Aaron Bolton
Privacy Protections Coming Sooner Rather Than Later to the Sooner State
Oklahoma SB 546 creates consumer privacy rights and controller compliance duties, effective January 1, 2027, with Oklahoma attorney general enforcement and a 30-day cure period.
03-20-2026
Hunton Andrews Kurth LLP
Oklahoma Enacts Comprehensive Consumer Privacy Law
Oklahoma Governor Kevin Stitt signed SB 546 into law on March 20, 2026, establishing the Oklahoma Consumer Data Privacy Act effective January 1, 2027.
02-19-2026
IAPP.org / Joe Duball
A Long, Winding Road
Oklahoma lawmakers approved Senate Bill 546 on Feb. 19, 2026 in Oklahoma City, forwarding a Virginia-style comprehensive privacy law to the Senate and governor.

Timeline: 118 Days

Feb 19Mar 12Apr 2Apr 30May 21Jun 11

Additional Articles

⭐⭐⭐⭐⭐

National Law Review03-16-2026
Seven Years In The Making
Oklahoma House approves SB 546 on February 19 2026 in Oklahoma City, enacting a state privacy law.
BiometricUpdate.com / Anthony Kimery03-19-2026
Oklahoma Privacy Bill Heads to Governor’s Desk for Signature
Oklahoma legislature sent Senate Bill 546 to Gov. Kevin Stitt in 2025 to establish statewide consumer data privacy rights, with exclusive attorney general enforcement and an effective date of July 1.
Hunton Andrews Kurth LLP04-17-2026
Alabama Becomes 21st State With Comprehensive Consumer Privacy Law
Alabama Governor Kay Ivey signed HB 351 on April 17, 2026, creating a consumer privacy law effective May 1, 2027 with AG-only enforcement.
JD Supra05-11-2026
Oklahoma and Alabama Headline a Busy Spring for Privacy Legislation
Oklahoma and Alabama enacted comprehensive consumer privacy laws in 2026, creating new consumer rights and AG-only enforcement before a proposed SECURE Data Act nationwide framework.
Today's General Counsel06-16-2026
New State-Based Data Privacy Legislation Reshapes Compliance Obligations
Oklahoma and Alabama privacy laws effective in 2027 narrow data sale definitions and use cure periods, while Utah, Kentucky, and Virginia expand controls on vehicle, smart TV, and precise geolocation data.
Perkins on Privacy05-08-2026
Oklahoma and Alabama Headline a Busy Spring for Privacy Legislation
Oklahoma and Alabama enacted comprehensive consumer privacy laws in 2026, with FTC and state attorney general enforcement proposed under the SECURE Data Act in Congress.
DWT05-12-2026
What Businesses Need to Know About the Alabama Personal Data Protection Act
In April 2026, Alabama enacted the APDPA, limiting enforcement to the Alabama Attorney General and setting a May 1, 2027 effective date.

⭐⭐⭐

National Law Review03-20-2026
Oklahoma's New Privacy Law Sweeps In
Oklahoma Governor Stitt signed the Act relating to data privacy on March 20, 2026, with enforcement starting January 1, 2027.
Termageddon / Donata Stroink-Skillrud03-24-2026
SB546 -- Compliance Guide for Oklahoma's Privacy Law
Oklahoma SB546 grants Oklahoma residents privacy rights covering personal data access, portability, profiling opt-out, and non-discrimination, with 45-day controller response timelines.
Hoodline03-23-2026
Sooner State Tells Data Brokers To Back Off, Hands Oklahomans New Privacy Power
Oklahoma lawmakers signed SB546 privacy legislation, creating 2027 consumer access, deletion, and targeted-ad opt-out rights enforced by the state attorney general.
KOCO / Dacoda Wahpekeche03-23-2026
Oklahoma's New Data Privacy Law Aims to Give Consumers More Control
Oklahoma, after Gov. Kevin Stitt signed a new data privacy law, requires covered companies to support data access, deletion, and targeted-ad opt-out requests enforced by the state attorney general.

⭐️⭐️

CR Advocacy03-16-2026
Consumer Reports Urges Veto Of Comprehensive Privacy Bill In Oklahoma
Consumer Reports urges Governor Stitt to veto SB 546 after passage by Oklahoma Legislature in Oklahoma City.