Oklahoma Senate Bill 1959

Regulation Summary

Timeline

March 5, 2024 – Passed by the Oklahoma Senate.
April 23, 2024 – Passed by the House of Representatives.
April 26, 2024 – Signed into law by Governor Kevin Stitt.
November 1, 2024 – The law took effect, requiring all applicable websites to comply with age verification mandates.

What Businesses Are Affected

Commercial entities that knowingly and intentionally publish or distribute material harmful to minors on the Internet from a website that contains a substantial portion of such material.
Third-party age verification providers ensuring compliance with the Act.

Exemptions

Bona fide news organizations and public interest broadcasts are exempt unless their website contains a substantial portion of material harmful to minors.
Internet service providers (ISPs), search engines, and cloud service providers are exempt as long as they do not create or publish restricted content.

Responsibilities for Businesses

Implement reasonable age verification methods, such as:
- Use of a digitized identification card – A data file available on a mobile device through a state-approved application that allows downloading from a state agency or authorized agent.
- Verification through an independent, third-party age verification service that compares personal information entered by the individual seeking access to commercially available databases regularly used for age and identity verification.
- Any commercially reasonable method that relies on public or private transactional data to verify the age of the person attempting to access the material.
Ensure secure data handling by not retaining any identifying information of the individual after access has been granted.
Restrict access to minors by blocking entry to age-restricted content.
Provide internet and cellular service subscribers the ability to block access to material harmful to minors, with blocking requests required to be honored at no charge.

Specific Responsibilities for Website Owners

Verify user age before granting access to restricted content.
Prevent minors from accessing harmful material through secure verification methods.
Ensure compliance with data privacy laws by not storing personally identifiable verification data.
Use commercially reasonable security measures to protect user information.

Additional Requirements

Age verification providers must comply with security and data protection standards by not retaining identifying information after access is granted.
Businesses must implement systems that prevent circumvention of age verification methods.

Individual Rights

Right to Data Protection: Individuals' personal information used for age verification must be protected and not retained beyond verification.
Right to Seek Damages: Individuals may seek damages if their verification data is improperly stored or mishandled.
Parental Legal Action: Parents or guardians have the right to take legal action if a minor accesses restricted content due to non-compliance with age verification requirements.

Enforcement

Enforced by the Oklahoma Attorney General.
The Attorney General may develop and publish compliance guidance and regulations.
Private Right of Action: Individuals, including minors through their parents or legal guardians, may seek damages resulting from a minor's accessing the material due to non-compliance, including nominal damages, actual damages, court costs, and reasonable attorney fees.
The Attorney General may seek injunctive and other equitable relief against a commercial entity that fails to comply with the provisions of this section.