Code/Regulations
- Oregon Consumer Privacy Act (OCPA)
- Code: OR SB 619
Effective Date: July 1, 2024
Details
Threshold
A person who conducts business in Oregon or who provides products or services to Oregon residents and that during a calendar year:
(1) Controls or processes the personal data of 100,000 or more Oregon residents (other than personal data controlled or processed solely for the purpose of completing a payment transaction); or
(2) Controls or processes the personal data of 25,000 or more consumers while deriving 25 percent or more of the person's annual gross revenue from selling personal data
Definition of "Personal Data"
Data, derived data or any unique identifier that is linked to or is reasonably linkable to a consumer or to a device that identifies, is linked to or is reasonably linkable to one or more consumers in a household. Personal data does not include data from people acting in an employment or commercial context.
Definition of "Sale"
Exchange by the controller with a third party of personal data for monetary or other valuable consideration
Data-Protection Assessments
Required for targeted advertising, sale, sensitive data, certain profiling
Opt-In Consent Required for Processing Sensitive Data
Consumer Rights to Confirm Processing, Request Access, Correction, Deletion & Portability
Yes
Consumer Right to Opt Out of Sale
Yes
Consumer Right to Opt Out of Targeted Ads
Yes
Consumer Right to Opt Out of Profiling
Yes
Pseudonymous Data Exempt from Consumer Requests
No
Appeal Rights
Yes
Universal Opt-Out Mechanism Required Recognition/Date
Yes, January 1, 2026
Data of Minors
Requires children between the ages of 13 and 15 to consent to targeted advertising and the sale of personal data. Also requires such individuals to consent to profiling
GLBA Exemption
Yes (data-specific)
HIPAA Exemption
Yes (data-specific)
Applies/Does Not Apply to Personal Information in a Commercial or Employment Context
Does not apply to commercial or employment context; applies in an individual or household context
Nonprofit Exemption
No, other than limited, specific exemptions
Private Right of Action
No
Cure Period
30 Days
Cure Period Expiration
December 31, 2026
Enforcement Authority/Damages
Oregon Dept. of Justice (Attorney General)/not more than $7,500 per violation
Disclaimer: States may periodically amend their laws and regulations and such amendments may affect or modify certain legal requirements or compliance obligations. There is no guarantee that this research is up to date as laws and regulations in the state consumer data privacy space continue to evolve. You should consult an attorney to assess the applicability of any existing, new, or proposed state consumer data privacy laws. By accessing this site, you acknowledge your understanding that the underlying content is not a replacement for legal counsel and does not constitute legal advice.