---------------------------
Title: Oklahoma Consumer Data Privacy Act (OCDPA) Checklist
URL: https://usercentrics.com/us/resources/ocdpa-checklist/
---------------------------

# Oklahoma Consumer Data Privacy Act (OCDPA) Checklist

### At a Glance

- Applies to businesses processing data on 100,000+ Oklahoma consumers annually, or 25,000+ where data sales exceed 50 percent of gross revenue
- Uses an opt-out model for targeted advertising, data sales, and qualifying profiling
- Requires affirmative consent for sensitive data, including biometric data and children's data under 13
- Enforced solely by the Oklahoma Attorney General, with no private right of action
- Does not require honoring Global Privacy Control (GPC) or other universal opt-out signals

The Oklahoma Consumer Data Privacy Act (OCDPA) follows the [Virginia VCDPA](https://usercentrics.com/us/knowledge-hub/virginia-consumer-data-protection-act-vcdpa/) and [Texas TDPSA](https://usercentrics.com/knowledge-hub/texas-data-privacy-and-security-act-tdpsa/) model: an opt-out framework for most processing, affirmative consent for sensitive data, and enforcement handled solely by the Oklahoma Attorney General.

If your business already meets VCDPA or TDPSA requirements, the OCDPA shouldn't require a full compliance overhaul. But its narrower “sale” definition and lack of [GPC recognition](https://usercentrics.com/knowledge-hub/what-is-global-privacy-control/) are worth being aware of for your configuration.

- **2.4M** — websites and apps in 195 countries
- **8.8B** — monthly consents
- **99%+** — customer retention rate
- **4.3/5** — rating on G2

Partners: Canon, Lufthansa Technik, Mitsubishi Electric, Pinterest, PIRELLI TYRE S.p.A., Porsche Financial Services GmbH, Save the Children, Siemens, z – Hello Fresh, z – Ubisoft, zynga

## The Checklist

### 1: Determine If Your Company Must Comply

**The OCDPA applies if you meet either threshold below during a calendar year.**

- Control or process the personal data of at least 100,000 Oklahoma consumers, or
- Control or process the personal data of at least 25,000 Oklahoma consumers and derive more than 50 percent of gross revenue from the sale of personal data

### 2: Update Your Privacy Notice

**Your privacy notice needs to disclose data categories, processing purposes, third-party sharing, and how consumers can exercise their rights.**

### 3: Inform Consumers of Their Rights

**Oklahoma consumers can request access, correction, deletion, portability, and opt-out. They cannot be discriminated against for exercising any of them.**

**Note:** The OCDPA does not include a right to revoke consent or a right to limit use of sensitive data.

### 4: Set Up Opt-Out Mechanisms for Sale and Targeted Advertising

**Give consumers a clear way to opt out of targeted advertising, data sales, and qualifying profiling.**

- Oklahoma defines “sale” as monetary consideration only, which is narrower than states that count other forms of value
- GPC recognition is not required, though it's worth maintaining if you operate in the 12+ states that do require it

## Managing privacy compliance across U.S. states?

Usercentrics CMP supports opt-out signals and workflows, consent documentation, and geotargeted configurations across U.S. state privacy laws. Try it free for 14 days.

### 5: Obtain Affirmative Consent for Sensitive Data

**Get affirmative, active consent before processing racial/ethnic origin, health data, biometric data, precise geolocation, and children's data if they’re under 13.**

### 6: Build Consumer Rights Request Workflows

**Provide two secure request methods, respond within 45 days (one 45-day extension available), and support a 60-day appeal process.**

### 7: Review Processor Contracts

**Put written contracts in place with third-party processors covering processing instructions, data types, duration, and subprocessor obligations.**

### 8: Conduct Data Protection Assessments

**Assess high-risk processing, including targeted advertising, data sales, profiling, and sensitive data, for activity beginning on or after January 1, 2027.**

### 9: Audit Consent Interfaces for Dark Patterns

**Review consent banners and opt-out flows for manipulative design. The OCDPA explicitly prohibits** [**dark patterns**](https://usercentrics.com/knowledge-hub/dark-patterns-and-how-they-affect-consent/)**.**

Get the full picture in the [Oklahoma Consumer Data Privacy Act](https://usercentrics.com/us/knowledge-hub/oklahoma-consumer-data-privacy-act/) overview.

## Download your free PDF version of this checklist.

---

## Footer

### Products
- [Usercentrics Web CMP](https://usercentrics.com/us/website-consent-management/)
- [Usercentrics App CMP](https://usercentrics.com/us/in-app-sdk/)
- [Usercentrics CTV CMP](https://usercentrics.com/us/usercentrics-ctv-cmp/)
- [Usercentrics Privacy Policy Generator](https://usercentrics.com/us/privacy-policy-generator/)
- [Server-side Tagging Solution](https://usercentrics.com/us/server-side-tracking-solution/)
- [Usercentrics Preference Manager](https://usercentrics.com/us/preference-management/)
- [Audience Unlocker](https://usercentrics.com/us/audience-unlocker/)
- [Integrations](https://usercentrics.com/us/integrations/)
- [Web compliance scan](https://usercentrics.com/us/privacy-compliance-scanner/)
- [App compliance scan](https://usercentrics.com/us/app-data-privacy-audit/)
- [ROAS calculator](https://usercentrics.com/roas-calculator/)

### Solutions
- [Data Privacy Regulatory Compliance](https://usercentrics.com/us/data-privacy-regulatory-compliance/)
- [Marketing Performance Optimization](https://usercentrics.com/us/marketing-performance-optimization/)
- [Migration](https://usercentrics.com/us/migration/)
- [Media & Publishing](https://usercentrics.com/us/media-publishing/)
- [Retail & Ecommerce](https://usercentrics.com/us/retail-ecommerce/)
- [Banking, Finance & Insurance](https://usercentrics.com/us/banking-finance-insurance/)
- [Healthcare & Pharmaceuticals](https://usercentrics.com/us/healthcare-pharmaceuticals/)
- [Gaming](https://usercentrics.com/us/gaming/)
- [Education](https://usercentrics.com/us/education/)
- [Automotive](https://usercentrics.com/us/automotive/)
- [Travel & Hospitality](https://usercentrics.com/us/travel/)

### Regulations
- [CCPA (California)](https://usercentrics.com/us/ccpa/)
- [GDPR (EU)](https://usercentrics.com/us/gdpr/)
- [CPRA (California)](https://usercentrics.com/us/cpra)
- [CPA (Colorado)](https://usercentrics.com/us/cpa/)
- [DMA (EU)](https://usercentrics.com/us/digital-markets-act-dma/)
- [FADP (Switzerland)](https://usercentrics.com/us/fadp/)
- [PIPEDA (Canada)](https://usercentrics.com/us/pipeda/)
- [TCF v2.3 (IAB)](https://usercentrics.com/us/cmp-for-publishers/)
- [Google Consent Mode (EU)](https://usercentrics.com/us/usercentrics-cmp-and-google-consent-mode-v2/)
- [Microsoft UET Consent Mode (EU)](https://usercentrics.com/us/usercentrics-cmp-and-microsoft-consent-mode/)
- [View all regulations](https://usercentrics.com/us/regulations-and-frameworks/)

### Resources
- [Blog](https://usercentrics.com/us/knowledge-hub/)
- [Whitepapers](https://usercentrics.com/us/whitepapers/)
- [Checklists](https://usercentrics.com/us/checklists/)
- [Courses](https://courses.usercentrics.com)
- [Customer stories](https://usercentrics.com/us/customer-stories/)
- [Privacy-Led Marketing](https://usercentrics.com/us/privacy-led-marketing/)
- [Events](https://usercentrics.com/us/webinar/)
- [CONSENTED podcast](https://usercentrics.com/us/consented/)
- [Guides](https://usercentrics.com/us/guides/)
- [Release notes](https://releases.usercentrics.com/en)
- [Developer documentation](https://usercentrics.com/docs/)
- [RFI template](https://usercentrics.com/us/resources/usercentrics-rfi-template/)
- [Customer directory](https://usercentrics.com/us/usercentrics-customer-directory/)

### Company
- [About us](https://usercentrics.com/us/about-us/)
- [Press](https://usercentrics.com/us/press/)
- [Our offices](https://usercentrics.com/us/contact/)
- [Trust center](https://trust.usercentrics.com/)
- [Careers](https://usercentrics.com/us/career/)
- [Open positions](https://apply.workable.com/usercentrics/)
- [Diversity and inclusion](https://usercentrics.com/us/dei/)

### Support
- [General support](https://support.usercentrics.com/hc/en-us)
- [Contact sales](https://usercentrics.com/us/book-a-consultation/)
- [Technical support](https://support.usercentrics.com/hc/en-us/requests/new)
- [Billing and account](https://support.usercentrics.com/hc/en-us/categories/12253804608156-Account-and-billing)
- [Suggest a feature](https://support.usercentrics.com/hc/en-us/requests/new?ticket_form_id=10610312381340)
- [Partner login](https://partnerportal.usercentrics.com/)
- [Partner program](https://usercentrics.com/us/partner-program-overview/)
- [Affiliate program](https://usercentrics.com/us/affiliates/)