Oregon Consumer Information Protection Act: security freeze

OCIPA security freeze

Credit reporting · Financial

Lets Oregon consumers, and representatives of children 16 and under or incapacitated adults, freeze their credit reports for free. Agencies must place a freeze within five business days and create a frozen protective record for a protected consumer who has no file.

Where: Oregon
Citation: ORS 646A.606 to 646A.618
Status: In force
In force since: 2007-10-01
Enforced by: Director of the Department of Consumer and Business Services (ORS 646A.624) and Oregon Attorney General (ORS 646.607(9))
People can sue: No
Penalties: DCBS penalties up to $1,000 per violation, capped at $500,000 per occurrence (ORS 646A.624(4)); unlawful trade practice enforceable by the AG.
Applies to: Consumer reporting agencies that compile and maintain consumer reports on Oregon residents (ORS 646A.602(4))
Excludes resellers, check-services and deposit-account-information companies (ORS 646A.618)

Rights it gives people

Consumers may place a security freeze by written or secure electronic request with proper identification; representatives may freeze a protected consumer's report or protective record with proof of authority.ORS 646A.606(1)-(3)

Practices it requires

Place the freeze within five business days of the request, and create and freeze a protective record for a protected consumer without a file.ORS 646A.608(1)
No fees for placing, lifting or removing a freeze, creating or deleting a protective record, or replacing a lost PIN.ORS 646A.610
While frozen, do not release the report without the consumer's express authorization, except as ORS 646A.614 allows.ORS 646A.606(4)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: last_amended not pinned: latest source notes show 2013 c.415 and 2018 c.10 amendments; exact 2018 effective date not fetched.

Research reference, not legal advice.