Oregon OCPA
Amended Oregon · In force Jul 1, 2024 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Comprehensive consumer privacy law with access (including a list of specific third parties data was shared with), correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, universal opt-out signals and data protection assessments. Unusually, it covers nonprofits. 2025 amendments ban selling precise geolocation data and data of consumers under 16, and bring all motor vehicle manufacturers into scope.
- Who it applies to
- Persons conducting business in Oregon or providing products/services to Oregon residents that in a calendar year control or process personal data of 100,000+ consumers (excluding payment-only data), or 25,000+ consumers while deriving 25%+ of annual gross revenue from selling personal data (ORS 646A.572). Nonprofits covered from July 1, 2025. Motor vehicle manufacturers and certain affiliates are covered regardless of thresholds (HB 3875).
- Penalties
- Civil penalty up to $7,500 per violation, plus injunctions and AG fees/costs (ORS 646A.589(4)). 30-day cure notice required, where a cure is possible, only until Jan 1, 2026. No private right of action.
- Enforced by
- Oregon Attorney General (Oregon DOJ Privacy Unit)
- Official name
- Oregon Consumer Privacy Act (SB 619, 2023)
- Citation
- ORS 646A.570 to 646A.589 (Or. Laws 2023, ch. 369); amended by HB 2008 (2025) and HB 3875 (2025)
- Topics
- privacy, children
Research notes
HB 3875 (signed May 27, 2025) extends OCPA to all motor vehicle manufacturers regardless of thresholds; its exact effective date was not verified, so it has no deadline row. HB 2008 was signed June 3, 2025. Oregon DOJ has released quarterly and annual enforcement reports.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)Questions about Oregon OCPA
- What are the Oregon OCPA compliance deadlines?
- Jul 1, 2024: OCPA takes effect for most controllers. Jul 1, 2025: OCPA applies to nonprofits. Jan 1, 2026: Cure period sunsets. Jan 1, 2026: Universal opt-out signals must be honored. Jan 1, 2026: Sale ban on precise geolocation and under-16 data (HB 2008).
- When does Oregon OCPA take effect?
- Oregon OCPA took effect on Jul 1, 2024.
- Who does Oregon OCPA apply to?
- Persons conducting business in Oregon or providing products/services to Oregon residents that in a calendar year control or process personal data of 100,000+ consumers (excluding payment-only data), or 25,000+ consumers while deriving 25%+ of annual gross revenue from selling personal data (ORS 646A.572). Nonprofits covered from July 1, 2025. Motor vehicle manufacturers and certain affiliates are covered regardless of thresholds (HB 3875).
- What are the penalties under Oregon OCPA?
- Civil penalty up to $7,500 per violation, plus injunctions and AG fees/costs (ORS 646A.589(4)). 30-day cure notice required, where a cure is possible, only until Jan 1, 2026. No private right of action.