Oregon Consumer Privacy Act
Published 19 min read
Oregon’s act reaches nonprofits as well as businesses, lets a consumer demand the names of the third parties that received their data, and since 1 January 2026 requires opt-out signals such as Global Privacy Control to be honoured, with no cure notice first.
The OCPA arrived in four steps
Oregon did not switch its law on in one go. Businesses came first, nonprofits a year later, carmakers by name after that, and the hardest duties waited for 1 January 2026. A firm that read the act in 2024 and filed it away is now working from an old copy.
- 01Jun 2023The Legislature passes Senate Bill 619, the Oregon Consumer Privacy Act. DOJ, Consumer Privacy
- 021 Jul 2024In force for businesses over the threshold. Every Attorney General action first needs a notice and a chance to cure. DOJ business FAQ
- 031 Jul 2025In force for nonprofits, on the same thresholds and the same duties. DOJ nonprofit FAQ
- 04Sep 2025Every motor vehicle manufacturer, and affiliates holding data from the use of a vehicle, is covered whatever its count. DOJ business FAQ
- 051 Jan 2026Opt-out signals such as GPC must be honoured; no sale of an under-16's data; no sale of precise geolocation; the cure notice ends. DOJ business FAQ
- now22 Oct 2026Every row above is in force. There is no cure notice left to wait for.
The 2026 row is the one most privacy programmes still miss. If your site was built for Virginia’s act, which has no signal duty at all, read the Virginia guide beside this one: Oregon asks for more on the same kind of site.
Oregon on one card
- Full name
- Oregon Consumer Privacy Act (OCPA), ORS 646A.570–646A.589
- In force
- 1 Jul 2024; nonprofits from 1 Jul 2025
- Who it binds
- ≥100,000 consumers; or ≥25,000 consumers + over 25% of annual gross revenue from selling personal data; every motor vehicle manufacturer regardless of count
- Who it protects
- Oregon residents acting in an individual or household role
- Rights
- List of specific third parties, opt out, copy, know, edit, delete
- Request clock
- 45 days + 45; first request in twelve months free
- Sensitive data
- Consent first; includes transgender or nonbinary status and crime-victim status
- Opt-out signal
- Yes, 1 Jan 2026 (GPC named as an example)
- Assessments
- Before heightened-risk processing; kept five years
- Enforced by
- Attorney General (sole); no private right of action
- Cure period
- Ended 1 Jan 2026 (no notice required)
- Penalty
- Civil penalty up to $7,500 per violation
Oregon Department of Justice FAQs, handouts and guidelines, read 22 Oct 2026. Information, not legal advice.
Who the act reaches
The test is the familiar two-door one. An individual or entity that does business in Oregon, or provides products or services to Oregon residents, is a controller if in a calendar year it controls or processes the personal data of: ≥100,000 consumers; or ≥25,000 consumers + over 25% of annual gross revenue from selling personal data.
Three details change the count in practice. A consumer is an Oregon resident acting in an individual or household role, so a pure business-to-business list is mostly outside. Oregon makes no distinction between data you collected and data you bought or were given. And the DOJ says the counts of related entities, a parent and its subsidiaries for example, may be added together where they share data or decisions; if you claim to be under the line, it may ask you for the documents that show it.
Processors are bound too
Vendors that handle personal data on a controller’s behalf are processors under the act. They act only on the controller’s instructions, under a contract, and must help it meet its duties. A processor for an exempt bank can still be covered by the work it does for anyone else.
| Outside | Kind | How far it goes |
|---|---|---|
| State, local and tribal governments | Entity | Excluded even over the threshold |
| Financial institutions (ORS 706.008) | Entity | Excluded even over the threshold |
| Certain insurers, insurance producers and consultants | Entity | Excluded as defined in Oregon insurance law |
| Certain data kept in compliance with HIPAA, GLBA or FCRA | Data | A data-level exclusion, not a firm-level one (full list: ORS 646A.572(2)) |
| Employment records | Data | Staff and job applicants are not consumers |
| Publicly available and deidentified data | Data | Not personal data at all, until it is combined into a profile |
Oregon DOJ business FAQ, read 22 Oct 2026 | ||
A “sale” in Oregon is an exchange for money or other valuable consideration. The DOJ’s own example is two firms swapping customer lists. Exceptions sit in ORS 646A.570(17)(b). Count list swaps when you work out the 25% revenue share, and read the business FAQ before deciding a transfer is not a sale.
Scope on a date. Load an example or answer for your organisation. Nothing leaves your browser.
People in a personal or household role. Staff and job applicants are not counted.
A sale includes swapping a customer or donor list for something of value.
Outdoor retailer, 140,000 Oregon customers, Oregon, as of 2026-10-22
Inside the act
Meets: 100,000 or more consumers a year.
Counts come from the same table as the which-laws checker. A reading of the DOJ’s FAQs, not legal advice.
Count every Oregon consumer you hold, bought lists and back-end records included, and add any sister company you share data with. The which-laws checker runs the same numbers against every other state on file at once.
Nonprofits: inside since 1 July 2025
Some state privacy laws leave charities out: Connecticut’s still exempts nonprofit organisations (§ 42-517(a)(3)), though not from its consumer health data rules (§ 42-526). Oregon brought them in a year after businesses, on the same thresholds. A nonprofit with 100,000 Oregon supporters, donors, volunteers or newsletter readers in a year is a controller.
“The requirements for businesses and nonprofits are the same under the OCPA.”
The DOJ wrote a separate FAQ for the sector, and its examples are the useful part. They show where a donor database, a mailing house and a website tag meet the act.
| Situation | How the DOJ reads it |
|---|---|
| Swapping donor lists with another nonprofit | A sale: valuable consideration need not be money |
| A prospect list built from property records | Public data, so not personal data, until you merge it with your own records on race, gender or health |
| Newsletter sign-ups reused for donor appeals | A secondary purpose: needs consent, and the notice must change |
| Ethnicity or religion counts in a grant report | Fine as deidentified statistics; tied to a named person they need express consent |
| Passive mailings | Mostly fine; the DOJ suggests offering an opt-out or unsubscribe |
| A tracking cookie one team added to the website | Likely a collection of personal data the rest of the organisation has to account for |
| A branch of a national charity | Count what flows to and from the central office when testing the threshold |
| Records collected before 1 Jul 2025 | Not retroactive: consent is owed going forward if you only store them; assessments cover processing from 1 Jul 2025 |
Oregon DOJ nonprofit FAQ and assessment guidelines, read 22 Oct 2026 | |
The rights request intake has one nonprofit-shaped trap: a shared inbox nobody reads. The DOJ says whatever channel you choose, email address or web form, must work and be monitored, meaning someone checks it regularly, and a deletion request still has to be done within 45 days.
Map where supporter data comes in, team by team, before you count it; the data mapping guide shows how. Then check every list exchange and reuse against the purposes your privacy notice states.
Six rights, spelled L.O.C.K.E.D.
The Oregon DOJ teaches the rights with an acronym, and it is a fair checklist for a request form. Opt-out, copy, access, correction and deletion are the familiar set you will meet across the state law map. The first letter is the one that set Oregon apart.
L
List
The specific third parties that received this consumer's data, or any personal data, from you.
O
Opt out
Of sale, targeted advertising and profiling.
C
Copy
Of the personal and sensitive data you hold about them.
K
Know
What personal data you have collected about them.
E
Edit
Correct inaccuracies.
D
Delete
Personal and sensitive data you hold about them.
Every right reaches all the data you hold on the person, not just what sits in their account. The DOJ says a self-serve download of the profile is not enough when marketing profiles, purchase history or other “back-end” records exist; its first-year report repeats the point as a lesson for businesses.
One request, start to finish: 45 days + 45
- Day 0The request arrives through a method your privacy notice names.
- By day 45Respond. If you need longer, tell the consumer the reply will be late and why.
- By day 90The single 45-day extension runs out.
The rules around the reply
- The first request in any twelve months is free. A later one can carry a reasonable fee for the cost, except a request to confirm that an earlier correction or deletion was done.
- Authenticate in proportion: the DOJ says a deletion can be easy to verify, while a copy of personal or sensitive data deserves more checks. Never put an unreasonable burden on the consumer.
- An authorised agent can opt a consumer out, through the methods your notice names, once you can verify both the person and the agent’s authority. A parent or guardian can use every right for a child under 13.
- A consumer who asks to be deleted and not contacted again: keep the minimum you need to honour the no-contact request, and delete the rest unless an exemption applies.
The clock runs from receipt. The DSAR deadline calculator works out the same 45 days and the single 45-day extension.
Add a “list of third parties” option to your request form, and make sure deletion and copy jobs reach your marketing and analytics stores, not only the account table.
The list of specific third parties
A privacy notice works in categories: it says you share data with “third-party advertisers” and stops there. Oregon also lets a consumer ask for the names. Under the DOJ’s reading, a controller must be able to produce a list of the specific third parties that received that person’s personal data, or a list of the specific third parties that received any personal data from it.
| Privacy notice | List on request | |
|---|---|---|
| Who sees it | Everyone, before they share anything | The one consumer who asks |
| Level of detail | Categories of third parties, e.g. "analytics companies", "data brokers", "payment processors" | The specific third parties, by name |
| What it covers | Every category of personal data shared, sensitive categories included | Entities that received this consumer's data, or any personal data from you |
| Where the rule sits | ORS 646A.578(4), per the DOJ | The consumer rights, per the DOJ |
Oregon DOJ business FAQ, read 22 Oct 2026 | ||
The categories line keeps your notice readable; the named list is what one consumer can demand. The DOJ’s first-year report put this right first among its lessons for business: offer consumers the third-party entities their data was disclosed to, including through a sale.
Connecticut added a similar right on 1 July 2026, worded around the third parties a controller sold data to (see the Connecticut guide). Oregon’s, as the DOJ puts it, covers every third party that received the data. A list built for Oregon covers both.
Keep one register, print two things from it
The practical answer is a recipient register: one row per third party, with its legal name, its category and the data it receives. The notice’s categories line and the named list for a request both come out of it, so they never disagree. Try it with your own vendors.
Edit any row. Pre-filled with a small online shop. Nothing leaves your browser.
For the privacy notice (categories)
We share personal data with these categories of third parties: analytics companies, third-party advertisers, payment processors, other merchants.
For a consumer’s list request (specific names)
- 1. Example Analytics Co. (analytics companies): device ID, pages viewed
- 2. Sample Ad Network LLC (third-party advertisers): hashed email, purchase history
- 3. Demo Payments Inc. (payment processors): name, billing address, card token
- 4. Partner Outfitters LLC (other merchants): name, email (list swap)
Build the register from your data map and your contracts, not from memory; the data map template records recipients for each activity. Update the notice’s categories line whenever a new kind of recipient is added. Source for the first-year lesson: Oregon DOJ release.
The opt-out link, and the signal since 2026
Oregon consumers can opt out of the sale of their data, targeted advertising and profiling. Until the end of 2025 a business could ask them to do it site by site. From 1 January 2026 a browser can say it for them.
“As of January 1, 2026, businesses have to honor opt-out signals that meet certain technical requirements. One example of such an opt-out signal is the Global Privacy Control.”
| Route | When | What the DOJ says |
|---|---|---|
| Clear and conspicuous website link | Since 1 Jul 2024 | A link that lets the consumer exercise opt-out rights; a cookie banner may do for some sites, not for all |
| Opt-out preference signal (e.g. GPC) | Required from 1 Jan 2026 | Treated as a valid opt-out; before 2026 it was optional |
| Authorised agent | Since 1 Jul 2024 | Through the methods in your notice, once the person and the agent's authority are verified |
Oregon DOJ business FAQ and Consumer Privacy page, read 22 Oct 2026 | ||
The signal is not a replacement for the link. The DOJ is explicit that businesses and nonprofits over the threshold must keep a clear and conspicuous website link where consumers can opt out, and honour the signal as well. The state table records it as Yes, 1 Jan 2026 (GPC named as an example).
What the signal changes on your site
- A visitor whose browser sends it is opted out of sale and targeted advertising. The DOJ notes the business may still collect and keep the data for itself.
- They will still see ads, just not targeted ones; the DOJ tells consumers so, so opting a visitor out does not mean switching ads off.
- The DOJ says there is not yet a fully reliable signal for mobile apps. A web check does not cover an app; plan its opt-out separately.
“Signals that meet certain technical requirements” is the DOJ’s phrase; GPC is its one named example, and it also points consumers to browser extensions that send a signal. Colorado, by contrast, recognises GPC as its only valid signal. Test that your site reads GPC with the GPC checker, and read the DOJ’s opt-out handout to see what consumers are told.
Keep the opt-out link, wire GPC to the same opt-out state the link sets, and log both. The opt-out link guide covers the link’s wording and placement under California’s rules, a useful model for the Oregon link.
Sensitive data, teens and location
Oregon’s list of sensitive data has two items worth noticing: status as transgender or nonbinary, and status as a crime victim. Processing any item on it needs the consumer’s consent first.
- racial or ethnic background
- national origin
- religious beliefs
- mental or physical health conditions or diagnoses
- sexual orientation
- citizenship or immigration status
- status as transgender or nonbinary
- status as a crime victim
- genetic data
- biometric data that could identify a person
- personal data of a child under 13
- specific past or present location
Four lines you cannot cross without consent, or at all
- Any sensitive dataConsent before you collect, store or otherwise process itfrom 1 Jul 2024
- A child under 13Consent (a parent or guardian's) before processing; all of it is sensitivefrom 1 Jul 2024
- A consumer under 16No sale; no processing for targeted advertising or profilingfrom 1 Jan 2026
- Precise geolocation, any ageNo sale of location within a radius of 1,750 feet, past or presentfrom 1 Jan 2026
The location ban came through a separate bill, HB 2008, and it is not about children: no Oregon consumer’s precise geolocation may be sold. The radius, 1,750 feet, is the same one Texas uses; California draws its line at 1,850 feet.
Consent for a new purpose, too
Consent is also owed for any secondary purpose, one that is not reasonably necessary for, and compatible with, the purposes your notice states. The DOJ’s example is a restaurant whose site says it collects data to take online orders: it cannot sell that data to brokers or advertisers without consent. And because the act’s definition of consent rules out dark patterns, a yes obtained through a dark pattern is not consent.
A location feature, a health quiz or a sign-up form that asks about gender identity can each bring sensitive data in. Review each before launch, because sensitive data also triggers an assessment (next section).
Find every field that can hold an item on the list, put a consent step in front of it, and stop any sale or ad use of data from consumers under 16.
Data protection assessments
An assessment is an internal document, not a filing. It is owed before processing that carries a heightened risk of harm, which the DOJ breaks down as four activities:
- Targeted advertising
- Selling personal data
- Profiling that may lead to unfair treatment, intrusion or harm
- Any processing of sensitive data
It stays confidential, but the Attorney General can ask for it, for example after a complaint (ORS 646A.586(7)), and it must be kept for five years. One assessment can cover a set of similar operations, and one written for another state’s law will do if it is reasonably similar. The act is not retroactive: assessments cover processing on or after 1 July 2024, or 1 July 2025 for a nonprofit.
The DOJ’s seven points
- 1NeedWhat the processing is for and why it needs an assessment; attach the project or marketing proposal. 646A.586(1)
- 2BenefitWho gains, directly or indirectly: you, stakeholders, consumers, the public. 646A.586(2)
- 3NatureWhat data, how it is collected, used, stored and deleted, roughly how many people and where, and who receives it. A flow diagram helps. 646A.572(6)
- 4RiskHow it could hurt consumers, and the safeguards that reduce that. 646A.578(1)(c)
- 5ProportionalityCould less data, or deidentified data, reach the same goal? If so, change it and record the change. 646A.578(1)(b)
- 6ContextWhat consumers would reasonably expect, how the data was gathered, and the relationship and any power gap. 646A.574(3)
- 7RecordsWho wrote it, when it was updated, who signed off each version, and whether action items were done. DOJ guidance
There is no set form; the DOJ says depth should match the risk, the size of the organisation and the possible effect on consumers. Its assessment guidelines are three pages and worth reading whole.
The impact assessment template covers the same ground; add a sign-off log for point 7 and a five-year retention date to whatever you produce.
Enforcement, and what year one showed
The Attorney General has sole enforcement power, and the act gives consumers no private right of action. Civil penalties run up to $7,500 per violation, and the Attorney General can also seek an injunction, restitution or disgorgement.
214
complaints to the DOJ's Privacy Unit in the first year (1 Jul 2024 to 30 Jun 2025)
38
matters opened and closed after cure notices and information requests
$7,500
maximum civil penalty per violation
0
days of cure the Attorney General must give since 1 Jan 2026
The cure period is over
In the first eighteen months a controller got a notice of violation and, as the DOJ’s August 2025 release put it, 30 days to fix the problem before formal action. Most fixed their privacy notices or request tools quickly. That stage has ended:
“As of January 1, 2026, the Attorney General is no longer required to give controllers notice and opportunity to cure regardless of the nature of the OCPA violation.” The DOJ can go straight to a civil investigative demand or a lawsuit (DOJ business FAQ).
What consumers complained about
Most of the first year’s complaints were about online data brokers, including sites that sell background reports. The right Oregonians most often asked for and were refused was deletion. The DOJ drew three lessons for businesses from it:
- Offer consumers the third-party entities their personal data was disclosed to, including through a sale.
- Include back-end data, such as marketing profiles and shopping patterns, in copy and delete requests.
- Keep the rights request form accessible, working and complete.
Sources: DOJ release on the first-year report; DOJ Consumer Privacy page, which links each quarterly report.
Test your own request form the way a complainant would: submit a deletion and a list request, time the replies against the 45 days, and check what comes back.
Questions
When did the Oregon Consumer Privacy Act take effect?
On 1 Jul 2024 for businesses and on 1 Jul 2025 for nonprofits. The opt-out signal duty, the under-16 sale ban, the ban on selling precise geolocation and the end of the cure notice all date from 1 Jan 2026.
Does the OCPA apply to nonprofits?
Yes, since 1 Jul 2025, on the same thresholds and with the same duties as a business. The DOJ publishes a separate FAQ for nonprofits.
What is the OCPA threshold?
Doing business in Oregon or serving Oregon residents, and in a calendar year controlling or processing the personal data of at least 100,000 consumers, or of 25,000 or more while deriving over 25% of annual gross revenue from selling personal data. Motor vehicle manufacturers are covered whatever their count.
Is a small business exempt?
There is no separate small-business exemption; the count test does the work. A firm under both lines is outside, unless it is a carmaker. Remember to count bought lists and related entities that share data.
Must a website honour Global Privacy Control in Oregon?
Yes, from 1 Jan 2026. Controllers must honour opt-out signals that meet certain technical requirements, and the DOJ names GPC as an example. The website opt-out link is still required as well.
What is the right to a list of specific third parties?
A consumer can ask for the names of the third parties that received their personal data, or that received any personal data from the controller. The privacy notice itself only needs categories of third parties.
How long does a controller have to answer a request?
45 days from receipt, extendable once by 45 more if you tell the consumer the reply will be late and why. The first request in twelve months is free.
Can consumers sue under the OCPA?
No. The act has no private right of action; only the Attorney General enforces it, with civil penalties up to $7,500 per violation.
Is employee data covered?
No. Data kept for employment records is outside the act, and a consumer means someone acting in an individual or household role, not as an employee or job applicant.