Privacy Law Library

Oregon Consumer Privacy Act

OCPA

Comprehensive privacy · Children · Biometric · Genetic · Location · Data security

Oregon's comprehensive consumer privacy law gives residents rights to confirm processing, get a list of specific third parties that received their data, access, correct, delete, and port their data, and opt out of targeted advertising, sale, and significant-decision profiling. Controllers must give a privacy notice, minimize data, secure it, get opt-in consent for sensitive data, run data protection assessments, and (since 2026-01-01) honor universal opt-out signals. 2025 amendments bar selling precise geolocation data and data of known under-16 consumers and extend coverage to all vehicle makers.

Where
Oregon
Citation
ORS 646A.570 to 646A.589 (2023 Or. Laws ch. 369, SB 619)
Status
In force
In force since
2024-07-01
Last amended
2026-01-01
Enforced by
Oregon Attorney General (Department of Justice), exclusive (ORS 646A.589(7))
People can sue
No
Penalties
Civil penalty of up to $7,500 per violation, plus injunction, and attorney fees and investigative costs to a prevailing AG; 5-year limitations period (ORS 646A.589(4)-(5)). The 30-day cure period ended for most controllers on 2026-01-01 and its remaining carve-out for certain public broadcasters was repealed 2026-07-01 (2025 Or. Laws ch. 417, secs. 5-6).
Applies to
  • Persons that conduct business in Oregon or provide products or services to Oregon residents and, in a calendar year, control or process personal data of 100,000+ consumers (excluding data processed solely to complete a payment transaction), or of 25,000+ consumers while deriving 25%+ of annual gross revenue from selling personal data (ORS 646A.572(1)(a))
  • Since 2025-09-26: motor vehicle manufacturers and their affiliates that control or process any personal data from a consumer's use of a vehicle or vehicle component, regardless of thresholds (ORS 646A.572(1)(b), added by HB 3875, 2025 c.163)
  • Nonprofits are covered; 501(c)(3) organizations were exempt only until 2025-07-01 (2023 Or. Laws ch. 369, sec. 13)
  • Exempt: public bodies, OHSU and the Oregon State Bar; HIPAA PHI and related health/research data; FCRA activity; data handled under GLBA, DPPA, FERPA; Oregon financial institutions and insurers/producers (entity-level); employment-context data; noncommercial news media (ORS 646A.572(2))
  • 'Consumer' means an Oregon resident acting other than in a commercial or employment context (ORS 646A.570(7))

What a privacy notice must say

  • Privacy notice must list categories of personal and sensitive data processed and shared, purposes, categories of third parties, how to exercise and appeal rights, a monitored contact email, and the controller's registered business names.ORS 646A.578(4)

Rights it gives people

  • Consumers may designate an authorized agent to opt out, including through a browser setting, extension, or global device setting.ORS 646A.576(4)
  • Consumers may confirm processing, get a list of specific third parties (other than natural persons) to which the controller disclosed their or any personal data, obtain a copy, correct, delete (including derived data), and opt out of targeted advertising, sale, and legal-effect profiling.ORS 646A.574(1)

Practices it requires

  • Obtain consent before processing sensitive data (including precise geolocation within 1,750 feet, genetic, biometric, transgender or nonbinary status, crime-victim status); process known children's (under 13) data per COPPA.ORS 646A.578(2)(b); 646A.570(18)
  • No targeted advertising or legal-effect profiling of consumers the controller knows, or willfully disregards, are under 16 (without consent).ORS 646A.578(2)(c)
  • Do not sell personal data of consumers known (or willfully disregarded) to be under 16, or precise geolocation data (within 1,750 feet), under any circumstances.ORS 646A.578(2)(d) · From 2026-01-01
  • Allow revocation of consent at least as easily as it was given, and stop processing within 15 days.ORS 646A.578(1)(d)
  • Deidentified data holders must take reasonable measures against reidentification, publicly commit not to reidentify, and bind recipients by contract.ORS 646A.583(1)
  • Respond to consumer requests within 45 days (one 45-day extension with notice); no account creation required; one free request per 12 months; provide an appeal process decided within 45 days that points to an AG complaint if denied.ORS 646A.576(2), (5)-(6)
  • Honor a universal opt-out preference signal for sale and targeted advertising, and provide a clear and conspicuous opt-out link.ORS 646A.578(5)(b)-(c) · From 2026-01-01

Security duties

  • Maintain the same safeguards required by ORS 646A.622 for personal information, scaled to the volume and nature of the data; limit collection to what is adequate, relevant and reasonably necessary.ORS 646A.578(1)(b)-(c)

Other duties

  • Conduct, document, and retain for 5 years a data protection assessment for targeted advertising, sensitive-data processing, sale, and risky profiling; provide to the AG on request.ORS 646A.586
  • Processors must follow a binding contract with required terms (confidentiality, deletion or return, audits, subcontractor flow-down).ORS 646A.581(2)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Research reference, not legal advice.