Bill

Bill > HB1762


OK HB1762

OK HB1762
Children; covered entities; data protection impact assessment; personal data of children; Attorney General; effective date.


summary

Introduced
02/03/2025
In Committee
02/10/2025
Crossed Over
Passed
Dead

Introduced Session

2025 Regular Session

Bill Summary

An Act relating to children; providing definitions; directing covered entities to complete and review impact assessments; requiring covered entities to provide impact assessments to Attorney General; requiring certain default privacy settings; directing covered entities to publicly provide certain information in clear language suited to age of children accessing product; requiring entity provide certain tools; providing information required for data protection impact assessment; requiring covered entity act in best interest of children; clarifying data protection impact assessments are confidential and not subject to public disclosure; clarifying certain information disclosed does not waive privilege or protection; permitting assessments that complies with other law; permitting single data protection impact assessment for similar processing operations; requiring first impact assessment by certain date; prohibiting covered entities from processing personal data of a child in way that is inconsistent with best interest of child; prohibiting covered entities from profiling a child unless listed exception applies; prohibiting covered entities from processing personal data of child that is not necessary to provide online product; prohibiting processing certain personal data for purposes other than reason collected; prohibiting the processing of certain geolocation information of children; prohibiting covered entities from using dark patterns for certain purpose; requiring covered entity signal a child when being monitored or tracked; providing penalties for a covered entity that violates this act; permitting only Attorney General to initiate enforcement actions; directing Attorney General provide notice to covered entities in substantial compliance; directing covered entities notify Attorney General when certain violations are cured; clarifying Act does not serve as basis for private right of action; providing list of entities this act does not apply to; clarifying Act does not impose certain liability; clarifying Act does not prevent or preclude a child from deliberately searching for content; clarifying Act does not require covered entity to restrict access to online products based solely on age; clarifying Act applies to certain covered entities; clarifying that Act does not apply to online products, services, or features not accessible by public after certain date; providing for codification; and providing an effective date.

AI Summary

This bill introduces comprehensive data protection regulations for online products, services, and features that are likely to be accessed by children in Oklahoma. The legislation requires covered entities (for-profit organizations offering online services) to complete detailed data protection impact assessments that evaluate how their platforms might affect children, including potential risks like harmful contacts, inappropriate content, exploitative algorithms, and targeted advertising. Covered entities must configure default privacy settings to high levels of protection, provide clear age-appropriate language about privacy policies, and offer tools for children or parents to manage privacy rights. The bill prohibits entities from processing children's personal data in ways that could harm them, including restrictions on profiling, geolocation tracking, and using manipulative design techniques called "dark patterns." Enforcement is exclusively through the Attorney General, with potential civil penalties of $2,500 per child for negligent violations and $7,500 per child for intentional violations. The law applies to entities processing personal data of at least 100,000 consumers or 25,000 consumers with over 25% of revenue from data sales, and will become effective on November 1, 2025. Importantly, the bill does not create a private right of action, meaning individuals cannot sue directly under this law, and it includes exemptions for certain types of organizations like healthcare providers and telecommunications services.

Committee Categories

Health and Social Services

Sponsors (1)

Last Action

Referred to Rules (on 02/10/2025)

bill text


bill summary

Loading...

bill summary

Loading...
Loading...