Oklahoma and Louisiana Privacy Laws 2027: Health Marketing

Oklahoma's and Louisiana's new consumer privacy laws both take effect January 1, 2027, and both bar a business from processing sensitive data, which includes data revealing a "mental or physical health diagnosis," without the consumer's consent (SB 546; Act 502). Both exempt HIPAA covered entities, business associates and protected health information, so they matter most for health brands that HIPAA does not cover. Curve Compliance pairs consent management with server-side conversions that strip PHI before data reaches an ad platform, under the BAA it signs on every plan.

Book a call. See which tags fire on your site, and how Curve Compliance holds them back for Oklahoma and Louisiana visitors until each visitor's choice allows them. Book a call with Curve.

Key dates and thresholds

Each cell quotes or summarizes the enacted text, linked in the same row.

	Oklahoma SB 546	Louisiana Act 502 (SB 386)
Signed	"Approved by Governor 03/20/2026" (status)	"Signed by the Governor. Becomes Act No. 502." on May 29, 2026 (status)
Effective	"This act shall become effective January 1, 2027." (SB 546)	"This Act shall become effective on January 1, 2027." (Act 502)
Who it covers	A business in Oklahoma, or targeting its residents, that "controls or processes personal data of at least one hundred thousand (100,000) consumers," or 25,000 consumers plus over half of gross revenue from selling personal data (SB 546)	A business in Louisiana with "annual gross revenues in excess of twenty-five million dollars," or that buys, receives, sells or shares the personal information of 75,000 or more consumers, households or devices a year, or earns half or more of its revenue from selling consumers' personal information (Act 502)
HIPAA	Exempts "A covered entity or business associate" under the HIPAA rules, plus PHI and "Health records" (SB 546)	Exempts "A covered entity or business associate" under the HIPAA rules, plus PHI and "Health records" (Act 502)
Enforcement	Attorney General only; 30 days' written notice and a chance to cure before any action (SB 546)	Attorney General; no private right of action; notice and a 30-day cure before an investigation from January 1 to July 31, 2027 (Act 502)

What counts as sensitive data

The two definitions match closely. Oklahoma's covers "personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status," plus genetic or biometric data used to identify someone, "personal data collected from a known child," and "precise geolocation data" (SB 546). Louisiana's list is the same, with "sexuality" in place of "sexual orientation" (Act 502).

For a clinic, med spa or wellness site, the clearest cases are form fields and intake answers that name a condition, and event or page data that carries one into an ad platform. Neither definition gives examples for web browsing, so map where a diagnosis could surface in your data before January. For how health data hides in URLs and event names, see PHI vs PII in healthcare marketing and the 18 HIPAA identifiers in website data.

Consent for sensitive data

Both laws say a controller may not "Process the sensitive data of a consumer without obtaining the consumer's consent" (SB 546; Act 502). Both define consent the same way: "a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer." Neither counts "hovering over, muting, pausing, or closing a given piece of content," or agreement "obtained through the use of dark patterns" (SB 546).

In practice, a visitor who closes your banner has not consented. Tags that could carry a diagnosis should stay off until the visitor opts in, which is how Curve's opt-in regions work.

Targeted advertising and opt-outs

Oklahoma defines targeted advertising as "displaying to a consumer an advertisement that is selected based on personal data obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict the consumer's preferences or interests" (SB 546). Louisiana adds "or inferred" (Act 502). Both exclude ads "based on activities within a controller's own websites or online applications" and "the processing of personal data solely for measuring or reporting advertising performance, reach, or frequency."

Consumers in both states may opt out of processing for targeted advertising, the sale of personal data, and certain profiling. In Oklahoma, a controller that does either "shall clearly and conspicuously disclose" it in its privacy notice, with how to opt out (SB 546). Louisiana goes further on signals. A consumer may name an authorized agent to opt out for them "using a technology, including a link to a website, an internet browser setting or extension, or a global setting on an electronic device." That technology "May not make use of a default setting," and a controller must comply if it can verify, "with commercially reasonable effort," the consumer's identity and the agent's authority. The Act lists exceptions, such as when the controller cannot verify that the consumer lives in Louisiana (Act 502). For how browser signals work, see Global Privacy Control for clinic sites.

HIPAA exemptions compared

The exemptions are built the same way in both states. At the entity level, neither law applies to "A covered entity or business associate governed by the privacy, security, and breach notification rules" issued by HHS (SB 546; Act 502). At the data level, both exempt "Protected health information under the Health Insurance Portability and Accountability Act of 1996" and "Health records." Both also exempt "A nonprofit organization" (SB 546; Act 502).

So a HIPAA-covered practice stays under HIPAA, which has its own limits on ad tracking: see when ad tracking needs a HIPAA marketing authorization. A med spa, supplement brand or cash-pay wellness company outside HIPAA can be covered if it meets a threshold. Whether your business is a covered entity is a question to settle before January, so talk to your counsel.

Data protection assessments

Both laws require a written data protection assessment for "The processing of personal data for purposes of targeted advertising" and for "The processing of sensitive data" (SB 546; Act 502). Neither reaches back: in Oklahoma an assessment applies "to processing activities that commence on or after the effective date of this act and shall not be retroactive" (SB 546), and in Louisiana "Data protection assessments are required for processing activities as of January 1, 2027, and are not retroactive" (Act 502).

Cure periods and enforcement

Each state's attorney general enforces its law, and neither gives consumers a private right of action. In Oklahoma, the attorney general must give written notice "no later than thirty (30) days before bringing the action" and may not sue if the business cures and says so in writing. After the cure period, a violation brings a civil penalty "not to exceed Seven Thousand Five Hundred Dollars" for each violation, and the act provides no private right of action (SB 546).

In Louisiana, a violation is "an unfair and deceptive trade practice" under the state's consumer protection law, "excluding private rights of action." The notice-and-cure step is temporary: "Beginning January 1, 2027, and ending July 31, 2027," the attorney general must notify a business at least 30 days before investigating, and may not investigate one that cures and documents the fix (Act 502).

What to change in your tracking

• List what fires. Curve's free website scan shows the pixels and trackers on a page.
• Find where a diagnosis could leak. Intake forms, quiz answers, condition page names and custom event names are the usual places.
• Ask before tags that touch sensitive data run. A closed banner is not consent under either law.
• Offer and honor opt-outs. Describe targeted advertising in your privacy notice, give an opt-out, and honor browser signals for Louisiana visitors.
• Keep health details out of ad platforms. Send conversions server-side with neutral event names. See how to remove the Meta pixel and Meta pixel alternatives.
• Write the assessment. Document targeted advertising and any sensitive data processing that starts on or after January 1, 2027.

For other states, see the state health privacy laws reference table and multi-state compliance when privacy laws overlap.

How Curve Compliance helps

Curve Compliance's consent management has a row for every US state, and you can switch any state between opt-in and opt-out. It holds back tracking and ad forwarding until each visitor's choice allows it, honors Global Privacy Control in every region, and records every accept, decline, change and withdrawal in an append-only audit log you can export as CSV.

Conversions go to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn server-side. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve signs a BAA on every plan, is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. See also server-side tracking tools.

Sources, checked October 26, 2026: Oklahoma SB 546, enrolled; Oklahoma SB 546 status; Louisiana Act 502 (SB 386); Louisiana SB 386 status.

Frequently Asked Questions

When do the Oklahoma and Louisiana privacy laws take effect?

Both take effect January 1, 2027: Oklahoma's SB 546 (SB 546) and Louisiana's Act 502 (Act 502).

Does Louisiana's privacy law apply to HIPAA-covered clinics?

No. Act 502 does not apply to a HIPAA covered entity or business associate, and it exempts PHI and health records (Act 502). A health business outside HIPAA can be covered if it meets one of the thresholds.

Is health data sensitive data in Oklahoma?

Yes, when it reveals a "mental or physical health diagnosis," and a controller needs the consumer's consent before processing it (SB 546).

Do I need consent for the Meta pixel in Oklahoma or Louisiana?

For a business either law covers, if the pixel processes sensitive data, such as data revealing a diagnosis, both laws require consent first (SB 546; Act 502). For other targeted advertising, both give consumers the right to opt out. See removing the Meta pixel from a healthcare website.

Who enforces the Oklahoma and Louisiana privacy laws?

Each state's attorney general. Neither text gives consumers a private right of action, and both give businesses a 30-day chance to cure, in Louisiana only from January 1 to July 31, 2027 (SB 546; Act 502).

Does Louisiana's law require honoring Global Privacy Control?

Act 502 does not name Global Privacy Control. It lets a consumer name an authorized agent, including through a browser setting or extension that does not use a default setting, to opt out of targeted advertising or sale; a controller must comply when it can verify the consumer's identity and the agent's authority, with listed exceptions (Act 502). See Global Privacy Control for clinic sites.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week.

Talk to Curve Compliance

Book a call. Get consent rules for Oklahoma and Louisiana visitors and server-side conversions with PHI removed before anything is sent to an ad platform, under the BAA Curve Compliance signs on every plan. Book a call with Curve.