HB 3545 restricts how Oklahoma state agencies can use artificial intelligence, directly affecting all state departments, commissions, and offices. It prohibits AI from manipulating behavior, enabling discriminatory classification, conducting general public surveillance via facial recognition (except for locating missing persons), or creating malicious deepfakes. The bill requires human review and approval for high-risk AI decisions (like benefits or legal rights), mandates disclosure when AI generates content, and requires agencies to inform users they're interacting with AI. Agencies must remove prohibited systems by September 2027, report compliance to the Office of Management and Enterprise Services (OMES), and submit annual reports detailing AI use starting December 2026.
HB 4132 creates liability protection for Oklahoma counties and municipalities if they adopt specific cybersecurity frameworks (NIST, CIS, or ISO standards) and meet compliance requirements. To qualify, local governments must annually certify compliance, maintain detailed security documentation, and undergo independent cybersecurity reviews every three years. This bill directly affects county and municipal operations by reducing legal risk from data breaches when these steps are followed. It does not change existing cybersecurity practices but provides a legal shield for entities that implement recognized standards. The law takes effect November 1, 2026.
SB 546 establishes data privacy rights for Oklahoma residents by requiring businesses that process personal data (referred to as "controllers") to honor consumer requests about their information. It mandates clear privacy notices, prohibits deceptive "dark patterns" for consent, and gives consumers rights to access, correct, or delete their data. The law excludes health data covered by HIPAA, certain nonprofit organizations, and educational institutions. Businesses must respond to requests within specific timeframes and implement data protection measures, with enforcement by the Attorney General.
HB 3299 prohibits creating and sharing synthetic media (such as deepfakes) that falsely depict a person's name, image, voice, or likeness without their written consent, unless used for news, commentary, satire, or parody. It requires political advertisements using such media during election periods (45 days before elections) to clearly disclose that the content is synthetic, with violations punishable as misdemeanors. For non-political use, creating synthetic media without consent is a misdemeanor, but becomes a felony if it causes over $25,000 in financial harm or is used for extortion. Victims can also seek civil damages, including legal fees, for violations.
Oklahoma Senate Bill 224 creates the Oklahoma Education and Workforce Efficiency Data System (EDS), a secure platform for state agencies to share de-identified student and workforce data across education and employment systems. It directly affects state agencies like the Oklahoma Department of Education, Workforce Commission, and higher education bodies by enabling data integration for improving educational outcomes and taxpayer return on investment. Key provisions include requiring strict privacy compliance (under FERPA and similar laws), prohibiting collection of sensitive data (religion, medical information), and establishing a Governance Council to oversee data access and vendor selection. The system aims to support evidence-based decisions while ensuring data privacy through formal agreements and anonymization for approved users like researchers.
SB 1083 requires digital asset kiosks (physical terminals for exchanging cryptocurrencies or digital assets for cash) to operate under a money transmitter license in Oklahoma. It mandates kiosk operators to report locations to the Banking Department quarterly, disclose clear warnings about irreversible transactions and scams (including specific fraud alerts), and display risk information like "losses are not recoverable." The law prohibits unlicensed operation, with fines up to $2,000 per violation or jail time, and allows customers harmed by unlicensed kiosks to sue for losses. It directly affects kiosk businesses and users engaging in digital asset transactions at these terminals.
SB 687 creates a rebate program for businesses purchasing equipment to expand broadband services in underserved or unserved areas of Oklahoma. It directs the Oklahoma Broadband Office and Tax Commission to administer the program, requiring equipment to directly enable broadband expansion (not operational costs) and limiting rebates to $42 million total - $31.5 million reserved for low-population-density counties. The Oklahoma Broadband Rebate Revolving Fund will pay approved claims, with payments calculated based on total eligible claims versus available funds. Providers must file claims by specified deadlines, and annual reports will track broadband project impacts without disclosing individual company names.
SB 146 expands mental wellness services provided by Oklahoma's Department of Public Safety to include retirees of public safety personnel (such as police and firefighters), in addition to current employees. It creates a dedicated revolving fund (Section 9102) to finance these services and strengthens privacy protections by prohibiting the sharing of individual mental health data without consent, while allowing aggregate data use for policy improvements (Section 9101). The bill also mandates that all Mental Wellness Division resources operate separately from other department divisions. These changes took effect November 1, 2025, after becoming law without the Governor's signature on May 29, 2025.
HB 2289 creates the Oklahoma Elected Official and Judicial Security and Privacy Act of 2025, requiring state agencies to remove specific personal details - including home addresses, phone numbers, school locations, and children's information - from public records for elected officials, judges, and their immediate families. Agencies must delete such "covered information" within 72 hours of a request and cannot publicly display it. The law also mandates annual reports to the legislature on security spending and data collection methods related to protecting these individuals. It became law without the Governor’s signature on May 28, 2025.
SB 626, the Security Breach Notification Act, requires businesses to notify Oklahomans when specific personal data used to verify identity (like Social Security numbers or account credentials) is compromised in a security breach. This law directly affects businesses and organizations that collect or store such identifying information, including credit bureaus, healthcare providers, and financial institutions. The key provision clarifies that notifications are mandated only when data enabling authentication of an individual is breached, not for all types of data. The law became effective on May 28, 2025, without the Governor's signature.
