Oregon

    •  

Code/Regulations

Effective Date:  July 1, 2024

Details

Threshold

A person who conducts business in Oregon or who provides products or services to Oregon residents and that during a calendar year:

(1) Controls or processes the personal data of 100,000 or more Oregon residents (other than personal data controlled or processed solely for the purpose of completing a payment transaction); or

(2) Controls or processes the personal data of 25,000 or more consumers while deriving 25 percent or more of the person's annual gross revenue from selling personal data

Definition of "Sensitive Data"

As with all state general privacy laws, includes the following Personal Data:

  • Race or ethnic background;
  • Religious beliefs;
  • Citizenship or immigration status;
  • Genetic data;
  • Biometric data;
  • Mental or physical health condition or diagnosis; and
  • Sexual orientation.

In addition, Oregon's definition also includes:

  • Status as transgender or nonbinary;
  • Status as a victim of a crime
  • Precise geolocation data
  • National origin; and
  • Personal data of a child.

Definition of "Personal Data"

Data, derived data or any unique identifier that is linked to or is reasonably linkable to a consumer or to a device that identifies, is linked to or is reasonably linkable to one or more consumers in a household. Personal data does not include data from people acting in an employment or commercial context.

Definition of "Sale"

Exchange by the controller with a third party of personal data for monetary or other valuable consideration

Data-Protection Assessments

Required for targeted advertising, sale, sensitive data, certain profiling

Opt-In Consent Required for Processing Sensitive Data 

Yes

Consumer Rights to Confirm Processing, Request Access, Correction, Deletion & Portability

Yes

Consumer Right to Opt Out of Sale

Yes

Consumer Right to Opt Out of Targeted Ads

Yes

Consumer Right to Opt Out of Profiling

Yes

Pseudonymous Data Exempt from Consumer Requests

No

Appeal Rights

Yes

Universal Opt-Out Mechanism Required Recognition/Date

Yes, January 1, 2026

Data of Minors

Requires children between the ages of 13 and 15 to consent to targeted advertising and the sale of personal data. Also requires such individuals to consent to profiling

GLBA Exemption

Yes (data-specific)

HIPAA Exemption

Yes (data-specific)

Applies/Does Not Apply to Personal Information in a Commercial or Employment Context

Does not apply to commercial or employment context; applies in an individual or household context

Nonprofit Exemption

No, other than limited, specific exemptions

Private Right of Action

No

Cure Period

30 Days

Cure Period Expiration

December 31, 2026

Enforcement Authority/Damages

Oregon Dept. of Justice (Attorney General)/not more than $7,500 per violation

Disclaimer: States may periodically amend their laws and regulations and such amendments may affect or modify certain legal requirements or compliance obligations. There is no guarantee that this research is up to date as laws and regulations in the state consumer data privacy space continue to evolve. You should consult an attorney to assess the applicability of any existing, new, or proposed state consumer data privacy laws. By accessing this site, you acknowledge your understanding that the underlying content is not a replacement for legal counsel and does not constitute legal advice.