Privacy Map

Oregon. Comprehensive data protection. Act

OCPAOregon Consumer Privacy Act (ORS 646A.570 et seq.)

In force
Partly verifiedMedium confidence. HB 2008 details from established knowledge.

§1Summary

Synopsis

Virginia-style law that also covers non-profits and gives consumers the right to obtain a list of the specific third parties to which their data was disclosed.

Key themes
  • consumer rights (access, deletion, correction, portability)
  • opt-out of sale, targeted advertising and profiling
  • sensitive data consent
  • data protection assessments
  • processor contracts
  • list of specific third parties
  • universal opt-out
Unique features

Right to a list of specific third-party recipients; outright sale bans for precise geolocation and under-16 data.

SaaS relevance

Applies at 100,000 Oregon consumers, or 25,000 with 25%+ revenue from sales.

§2Obligations

Extraterritorial
Yes
Breach notification
See ORS 646A.604 (separate statute)
DPO
No
Cross-border transfers
None
Maximum penalty
$7,500 per violation

§3Dates

Key dates
  • Adopted
  • In force
  • Non-profits covered from 2025-07-01; cure period expired 2026-01-01; HB 2008 (2025) bans sale of precise geolocation and data of under-16s; auto-maker amendment 2025.

§4Text and authority

Text
Authority
Oregon Department of Justice (Attorney General)

§5Where it applies

Domestic law of
Oregon

§6Sources and verification

Verification

Medium confidence.

Partly verifiedMedium confidence. HB 2008 details from established knowledge.