• by Wendy Davis  @wendyndavis, February 11, 2021

Oklahoma lawmakers have advanced a broad privacy bill that would require companies to obtain consumers' explicit consent before using their data for a variety of purposes, including ad targeting.

The Oklahoma House Committee on Technology voted 6-0 on Wednesday to approve the bill, which can now move to the House floor.

The Oklahoma Computer Data Privacy Act (HB 1602), proposed last month by Reps. Josh West (R) and Rep. Collin Walke (D), provides for damages starting at $7,500 per violation, and would enable state residents to sue violators.

The bill specifically covers data used in programmatic advertising, including device identifiers, IP addresses and cookies.

Walke argued at a hearing Wednesday morning that an opt-in standard is necessary to protect privacy.

“Why is opt in so important? Because it is the gold standard in data privacy -- which is why, with the next Apple iPhone update, every single app in the app store will have to be opt-in before they can track your data,” Walke said.

The ad industry is opposing the bill, claiming it reflects an “extreme approach to privacy regulation taken” that “would severely restrict Oklahomans’ ability to access vital products and services and force companies to forego doing business in the state.”

“If the Oklahoma legislature enacts the [proposed law] in its current form, the state would be adopting the most onerous privacy law in the United States,” the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, Network Advertising Initiative and American Advertising Federation said in a letter sent to Oklahoma lawmakers on Tuesday. “The bill would make Oklahoma an unfriendly state for consumers and businesses alike.”

Among other criticisms of the proposal, the groups object to the bill's opt-in approach, arguing it would “subject consumers to incessant consent requests.”

They add: “Opt-in consent requirements for sales of personal information would stifle competition and harm consumers by limiting their access to crucial online resources.”

The ad organizations also take issue with the bill's provisions enabling individuals to sue over violations.

“Including a private right of action ... would create a complex and flawed compliance system, likely flooding the state’s courts with frivolous lawsuits driven by opportunistic trial lawyers searching for technical violations rather than focusing on actual consumer harm or providing tangible privacy benefits for consumers,” the groups argue.

Oklahoma isn't the only state considering new privacy laws.

Virginia is also poised to enact a law that would require companies to allow consumers to access, correct and delete personal data.

That measure would give consumers the right to opt out of the use of non-sensitive data for targeted advertising, and require companies to obtain consumers' affirmative consent before processing “sensitive” data -- including information about race, religious beliefs, health, sexual orientation or immigration status, as well as precise geolocation information and some biometric data.