79%
of Oregon's 19 requirements are already met by California (CA). Here is what OCPA adds, biggest gaps first.
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
OCPA adds3 Appeal decided within 45 days; denial notice must explain how to complain to the Attorney General.
ORS 646A.576 · source ↗
Sensitive dataSensitive data and minorsBig gap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
OCPA adds2 Opt-in consent; categories include transgender/nonbinary and crime-victim status; from 2026, sale of precise geolocation is banned.
ORS 646A.570, 646A.578(2)(b); HB 2008 (2025) · source ↗
ThresholdsWho it coversGap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
OCPA adds1 100,000+ consumers a year, or 25,000+ consumers while deriving 25%+ of gross revenue from data sales; vehicle manufacturers covered regardless.
ORS 646A.572(1) · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
OCPA adds3 Deidentified data needs public commitment and contracts; pseudonymous data exempt from certain rights if kept separate.
ORS 646A.583 · source ↗
Already covered by CA: Exemptions, Children and teens, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.
A gap means OCPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
