U.S. Oregon Consumer Privacy Act (OCPA)

Why does it matter?

Oregon wrote its own act rather than copying a neighbor's. ORS 646A.574(1)(a)(B) gives consumers a right no other state act grants in the same form: a list of the specific third parties to which the controller has disclosed personal data. ORS 646A.570(18) counts status as transgender or nonbinary, status as a victim of crime, and location within 1,750 feet as sensitive data, which needs consent before processing. Nonprofits are covered, the Attorney General can serve investigative demands, and since January 1, 2026 an action for up to $7,500 per violation no longer waits for a cure notice. The Department of Justice publishes enforcement reports, so the questions it asks are public.

Key benefits include:

• The third-party list

A consumer may obtain a list of the specific third parties, other than natural persons, that received the consumer's personal data or any personal data (ORS 646A.574(1)(a)(B)); the controller chooses which of the two lists it gives.

• Nonprofits included

SB 619 section 13 delayed the act for 501(c)(3) organizations only until July 1, 2025; the Department of Justice publishes separate FAQs for nonprofits.

• A wide sensitive-data definition

Racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, transgender or nonbinary status, crime-victim status, citizenship or immigration status, a child's data, precise location and genetic or biometric data (ORS 646A.570(18)).

• Teen and location data

No targeted advertising or significant profiling of a consumer known or willfully disregarded to be under 16, and since HB 2008 no sale of that consumer's data or of 1,750-foot location data (ORS 646A.578(2)(c) and (d)).

• Enforcement without a cure period

The 30-day cure notice in SB 619 section 9(5) was repealed by section 11 on January 1, 2026; a 2025 act kept it only for certain noncommercial educational broadcasters and expired on July 1, 2026.

How does it work?

A consumer exercises rights by the method the controller names in its privacy notice; the controller may not demand a new account (ORS 646A.576(1) and (2)). It must respond without undue delay and within 45 days, extendable once by 45 days with notice and a reason, give the first response in any 12-month period free, and explain a refusal with appeal instructions. The appeal must be decided within 45 days, and a denial must tell the consumer how to complain to the Attorney General (ORS 646A.576(5) and (6)). Opt-out requests are honored without authentication, and a parent, guardian or authorized agent, including a browser setting or extension, may act for the consumer (ORS 646A.576(3) and (4)).

ORS 646A.578 sets the controller's duties: state the express purposes in the notice, collect only data adequate, relevant and reasonably necessary for them, keep the safeguards ORS 646A.622 requires for personal information, and give consumers a way to revoke consent at least as easy as giving it, with processing stopped within 15 days. The controller may not process for incompatible purposes or process sensitive data without consent (COPPA governs a known child), discriminate against a consumer who exercises a right, or run the targeted advertising, profiling and sale activities barred for under-16s. Loyalty and rewards programs may still offer different prices or features (subsection (3)).

Processors follow the controller's instructions, help with requests, keep administrative, technical and physical safeguards, supply what the controller needs for assessments, and work under a contract with the eight terms in ORS 646A.581(2), including deletion or return at the end of service, subcontractor flow-down and an assessment right. A data protection assessment under ORS 646A.586 weighs benefits against risks for targeted advertising, sensitive data, sales and risky profiling, applies to processing from July 1, 2024, and is confidential but producible to the Attorney General. Enforcement under ORS 646A.589 uses investigative demands, a civil penalty of up to $7,500 per violation, injunctions and a five-year limitation period, with proceeds to the Department of Justice Protection and Education Revolving Account.

Key Elements

• Consumer rights (ORS 646A.574)

Confirmation and the categories processed, the third-party list, a portable copy, correction, deletion of data from any source including derived data, and opt-out of targeted advertising, sale and profiling for decisions with legal or similarly significant effects.

• Requests and appeals (ORS 646A.576)

Notice-specified methods, 45 days plus one 45-day extension, one free response a year, authentication rules, agents for opt-outs and a 45-day appeal decision with a route to the Attorney General.

• Privacy notice (ORS 646A.578(4))

Categories processed including sensitive data, purposes, how to exercise rights and appeal, categories shared, categories of third parties, a monitored email or online contact, the controller's registered and assumed names, targeted advertising and profiling disclosures with an opt-out, and request methods.

• Opt-out link and preference signals (ORS 646A.578(5))

A clear and conspicuous link to an opt-out page, and from January 1, 2026 a working response to a signal that uses no default setting and reflects the consumer's affirmative choice.

• Processor contracts (ORS 646A.581)

Instructions, nature, purpose, data types and duration; confidentiality; deletion or return; information for compliance verification; subcontractor terms; and audits by the controller or a qualified independent assessor.

• Data protection assessments (ORS 646A.586)

Required for each heightened-risk activity, one assessment may cover comparable operations, an assessment made for another law counts if similar in scope, records kept five years, exempt from public records disclosure.

What does it cover?

ORS 646A.572 applies the act to any person doing business in Oregon or serving Oregon residents that meets the 100,000-consumer threshold (payment transactions excluded) or the 25,000-consumer and 25-percent-of-revenue threshold, plus motor vehicle manufacturers and affiliates processing vehicle-use data. A consumer is an Oregon resident acting outside a commercial or employment context (ORS 646A.570(7)). Subsection (2) exempts public bodies, protected health information handled under HIPAA, human-subjects research data, consumer reporting under the Fair Credit Reporting Act, data under the Gramm-Leach-Bliley Act, the Driver's Privacy Protection Act and FERPA, financial institutions under ORS 706.008, insurers, producers and consultants, employment and benefits data, and the noncommercial activity of journalists and broadcasters.

What are its objectives?

The act's own sections state what it requires of a covered controller.

Give consumers the six rights in ORS 646A.574 and answer requests within the ORS 646A.576 timelines.

Publish a privacy notice with the content ORS 646A.578(4) lists and honor opt-out links and preference signals.

Limit collection to stated purposes, protect the data with the ORS 646A.622 safeguards and obtain consent for sensitive data.

Bind processors by contract (ORS 646A.581) and assess heightened-risk processing (ORS 646A.586).

Accept enforcement by the Attorney General alone, with penalties of up to $7,500 per violation (ORS 646A.589).

Framework in Context

The OCPA sits beside Oregon's older consumer information laws: ORS 646A.578(1)(c) borrows its security duty from the safeguards section of the Oregon Consumer Information Protection Act (ORS 646A.600 to 646A.628), which also carries the state's breach notification rule, and ORS 646A.593 registers data brokers. The controller, processor, sensitive-data and assessment vocabulary follows the model used by Virginia, Colorado and Connecticut, which lets one request workflow serve several states, but the third-party list, the 25-percent revenue test, nonprofit coverage and the 1,750-foot location sale ban are Oregon's own. The Department of Justice's six-month, first-year and quarterly reports show which complaints it pursues.

Common Framework Mappings

The OCPA is mapped to the frameworks below so that a single data inventory, request workflow and assessment record covers Oregon and the regimes beside it.

Mapped frameworks include:

SOC 2

CIS Controls v8.1

GDPR

ISO 27001:2022

ISO 27701

NIST CSF 2.0

NIST Privacy Framework v1.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

CCPA/CPRA

Oregon ORS 646A