Regulations › US states › Oregon
OCPA
Oregon Consumer Privacy Act
WhenIn effect since 1 July 2024
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
Thresholds100,000+ consumers a year, or 25,000+ consumers while deriving 25%+ of gross revenue from data…
Universal opt-outMust honor universal opt-out preference signals from January 1, 2026
Cure period30-day cure period expired January 1, 2026
Request deadline45 days, extendable once by 45 days
Maximum penaltyUp to $7,500 per violation
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
1
100,000+ consumers a year, or 25,000+ consumers while deriving 25%+ of gross revenue from data sales; vehicle manufacturers covered regardless.ORS 646A.572(1) · secondary source · source ↗
Read on oregon.public.law, a mirror of ORS; may not show 2025 amendments. HB 3875 (2025) covers vehicle makers per Oregon DOJ.
Exemptions
2
HIPAA and GLBA exemptions mostly data-level, with an entity carve-out for Oregon-defined financial institutions; nonprofits covered since July 1, 2025.ORS 646A.572(2)(b), (2)(k) · secondary source · source ↗
Read on oregon.public.law, a mirror of ORS; may not show 2025 amendments.
Sensitive data and minors
Sensitive data
2
Opt-in consent; categories include transgender/nonbinary and crime-victim status; from 2026, sale of precise geolocation is banned.ORS 646A.570, 646A.578(2)(b); HB 2008 (2025) · source ↗
HB 2008 effective Jan. 1, 2026; codified section not confirmed.
Children and teens
2
Ages 13 to 15 needed consent for ads, sale and profiling; from 2026, sale of any under-16 data is banned.ORS 646A.578(2)(c); HB 2008 (2025) · source ↗
Stoel reports under-16 targeted ads and profiling also barred from Jan. 1, 2026.
Data minimization
1
Collection limited to what is adequate, relevant and reasonably necessary for specified purposes.ORS 646A.578(1)(b) · secondary source · source ↗
Read on oregon.public.law, a mirror of ORS; may not show 2025 amendments.
Consumers' rights
Rights
2
Access, list of specific third parties, copy, correct, delete, and opt out of targeted advertising, sale and significant profiling.ORS 646A.574(1) · secondary source · source ↗
Read on oregon.public.law, a mirror of ORS; may not show 2025 amendments.
Request deadline
2
45 days, extendable once by 45 days.ORS 646A.576 · secondary source · source ↗
Read on oregon.public.law, a mirror of ORS; may not show 2025 amendments.
Appeals
3
Appeal decided within 45 days; denial notice must explain how to complain to the Attorney General.ORS 646A.576 · secondary source · source ↗
Read on oregon.public.law, a mirror of ORS; may not show 2025 amendments.
Universal opt-out
2
Must honor universal opt-out preference signals from January 1, 2026.ORS 646A.574 / 646A.576 · source ↗
Exact subsection not confirmed; mirror showed only the authorized-agent provision.
Business duties
Assessments
2
Assessments for targeted ads, sale, risky profiling and sensitive data; AG may request them in an investigation.ORS 646A.586 · secondary source · source ↗
Section number from statute knowledge; not read this session.
Processor contracts
3
Contract with instructions, confidentiality, deletion, compliance info, assessments, and subcontractor flow-down after notice and chance to object.ORS 646A.581 · secondary source · source ↗
Section number and terms from statute knowledge; not read this session.
Privacy notice
2
Notice must list data and sensitive data categories, purposes, third-party sharing, contacts and opt-out methods, supporting the third-party list right.ORS 646A.578(4) · secondary source · source ↗
Read on oregon.public.law, a mirror of ORS; may not show 2025 amendments.
Loyalty programs
1
Different prices allowed for voluntary participation in bona fide loyalty or rewards programs.ORS 646A.578(3)(b) · secondary source · source ↗
Read on oregon.public.law, a mirror of ORS; may not show 2025 amendments.
De-identified data
3
Deidentified data needs public commitment and contracts; pseudonymous data exempt from certain rights if kept separate.ORS 646A.583 · secondary source · source ↗
Section listed in ORS index; text not read this session.
Enforcement
Who enforces
1
Attorney General has exclusive enforcement authority, including civil investigative demands.ORS 646A.589 · secondary source · source ↗
Read on oregon.public.law, a mirror of ORS; may not show 2025 amendments.
Maximum penalty
2
Up to $7,500 per violation.ORS 646A.589 · secondary source · source ↗
Read on oregon.public.law, a mirror of ORS; may not show 2025 amendments.
Private action
0
No private right of action.ORS 646A.589 · secondary source · source ↗
Read on oregon.public.law, a mirror of ORS; may not show 2025 amendments.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws