What Are the Oklahoma CDPA Cookie Consent Requirements?
Everything you need to know about Oklahoma CDPA cookie consent compliance in 2026. Complete guide covering opt-out requirements, cookie banner elements, consent records, and technical implementation for United States - Oklahoma.
Summary
This guide provides comprehensive technical implementation requirements for Oklahoma (OCDPA). Opt-out rights for targeted advertising, sale, and profiling in furtherance of decisions that produce legal or similarly significant effects, from January 1, 2027. No mandatory universal opt-out (GPC) recognition. Applies to businesses processing data of 100,000+ Oklahoma consumers, or 25,000+ while deriving over 50% of gross revenue from selling personal data.
This jurisdiction follows an opt-out consent model, meaning websites can place certain cookies initially but must provide clear mechanisms for users to opt-out of non-essential tracking. Users must be informed about cookies and given easy options to refuse them.
Additional requirements for this jurisdiction include: special protections and consent mechanisms for children's personal data.
Website owners and operators subject to these regulations must implement compliant cookie consent banners, maintain proper consent records, and ensure their tracking technologies respect user privacy choices. This guide outlines all technical requirements needed to achieve compliance.
Key Requirements Overview
Technical Requirements
Required Banner Elements
First Layer (Cookie Banner)
- Link Privacy Policy
- Manage Preferences Button
Second Layer (Preferences Modal)
- Category Level Disclosures
Implementation Guidance
Oklahoma's Consumer Data Privacy Act (SB 546, signed March 20, 2026) takes effect January 1, 2027. It follows the opt-out (Virginia-style) model and does NOT require honoring universal opt-out mechanisms such as GPC. Controllers that sell personal data or use it for targeted advertising must clearly and conspicuously disclose how consumers can opt out, so provide that opt-out via your privacy page or preference center. 'Sale' is limited to exchanges for monetary consideration. The Attorney General has exclusive enforcement authority with a permanent 30-day cure period and civil penalties of up to $7,500 per violation; there is no private right of action. Honoring GPC remains a recommended best practice.
Special Protections
Children's Privacy
Personal data collected from a known child is sensitive data and must be processed in accordance with COPPA; COPPA-compliant verifiable parental consent satisfies the Act's parental consent requirements.
Sensitive Data
Opt-in consent required for sensitive data processing.
Record Keeping Requirements
Required Consent Record Fields
For each consent action, you must maintain records containing:
- Timestamp ISO
- Opt Out Status
- Policy Version
CookieChimp handles all of this automatically. Our platform maintains comprehensive consent records including all required fields, timestamps, consent strings, IP addresses, user agents, and more. Records are securely stored and easily exportable for compliance audits. Learn more about our consent management
Legal References & Resources
Official legal documents and regulatory guidance for this jurisdiction:
Frequently Asked Questions About Oklahoma CDPA Cookie Consent
Oklahoma (OCDPA) is a privacy regulation applicable in United States - Oklahoma. Opt-out rights for targeted advertising, sale, and profiling in furtherance of decisions that produce legal or similarly significant effects, from January 1, 2027. No mandatory universal opt-out (GPC) recognition. Applies to businesses processing data of 100,000+ Oklahoma consumers, or 25,000+ while deriving over 50% of gross revenue from selling personal data. It requires websites to provide clear mechanisms for users to refuse non-essential cookies (opt-out model).
Yes. Under Oklahoma CDPA, websites must display a cookie consent banner that includes: link privacy policy, manage preferences button. The banner must be shown to inform users about cookie usage and provide opt-out options.
Oklahoma CDPA follows an opt-out consent model. This means websites may place certain cookies but must provide clear and easy ways for users to opt out of non-essential tracking.
Personal data collected from a known child is sensitive data and must be processed in accordance with COPPA; COPPA-compliant verifiable parental consent satisfies the Act's parental consent requirements.
Oklahoma CDPA requires maintaining consent records that include: timestamp iso, opt out status, policy version.
Legal Disclaimer
For engineering implementation guidance only. Not legal advice. This guide provides technical implementation guidance only and should not be considered legal advice. Privacy laws are complex and frequently updated. We recommend consulting with qualified legal counsel to ensure full compliance with applicable regulations.
Found an issue or have feedback on this page?
Explore Other Jurisdictions
View All
California (CPRA/CCPA Regs)
United States - California
Covers 'sharing' for cross-context behavioral advertising.
Colorado (CPA)
United States - Colorado
Targeted advertising and sale require easy opt-out.
Virginia (CDPA)
United States - Virginia
Opt-out rights for targeted ads and sale; no mandatory GPC recognition.
Connecticut (CTDPA)
United States - Connecticut
Opt-out for targeted ads and sales; GPC recognition required from Jan 2025.
Utah (UCPA)
United States - Utah
Opt-out for sale and targeted advertising; no GPC requirement.
Texas (TDPSA)
United States - Texas
Opt-out for sale and targeted ads; must honor UOOMs like GPC.