Oregon
Oregon Consumer Privacy Act
Oregon’s consumer privacy law. It gives Oregon residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- In effect since July 1, 2024
- Citation
- Or. Rev. Stat. § 646A.570 et seq.
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses that handle data of 100,000+ Oregon residents a year, or 25,000+ if they earn revenue from selling data.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
- Honor Global Privacy Control as an opt-out (from Jan 1, 2026).
- Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
- Offer an appeal when you turn down a privacy request.
- Don’t sell precise location data, or data of consumers you know are under 16 (from Jan 1, 2026).
- Give people a list of the specific third parties you disclosed their data to, on request.
Who has to comply
The Oregon Consumer Privacy Act applies to businesses that, in a calendar year, handle the personal data of 100,000 or more Oregon consumers (not counting data used only to complete payments), or 25,000 or more while making 25% or more of gross revenue from selling personal data. It took effect on July 1, 2024, and has covered nonprofits since July 1, 2025.
Governments, financial institutions and certain public corporations are exempt, as are HIPAA-protected health information, Gramm-Leach-Bliley data and employment data.
A right most states don’t have: the list of third parties
Besides access, correction, deletion, a portable copy and opt-outs of targeted advertising, sale and profiling, Oregonians can ask for a list of the specific third parties (other than individuals) you have disclosed personal data to, either their own data or any personal data, at your choice. Oregon’s Department of Justice has reported that many companies fail to offer this list.
- Respond within 45 days, extendable by 45 more.
- Appeals: approve or deny within 45 days, and if you deny, tell the person how to complain to the Attorney General.
Global Privacy Control from January 1, 2026
Since January 1, 2026, businesses must accept opt-out requests sent through universal opt-out mechanisms such as Global Privacy Control, as an opt-out of sale and targeted advertising. The signal must reflect the consumer’s own choice, not a default setting.
Sensitive data, teens and location
Consent is required to process any sensitive data. Oregon’s list is broad: it includes race or ethnicity, religion, health, sexual orientation, status as transgender or nonbinary, status as a crime victim, citizenship or immigration status, children’s data, genetic and biometric data, and precise location (within 1,750 feet).
A 2025 amendment added two outright bans from January 1, 2026: you may not sell precise geolocation data, and you may not sell the data of a consumer you know, or willfully disregard, is under 16.
Enforcement
The Attorney General has sole enforcement power; there’s no private right of action. Penalties are up to $7,500 per violation. Since January 1, 2026 the Attorney General no longer has to give businesses notice and 30 days to cure before acting.
The Department of Justice publishes enforcement reports. Its one-year report (August 2025) counted 214 consumer complaints and 38 cure-letter matters, and found common problems: no list of third parties, privacy request inboxes nobody checks, and request forms that leave Oregon out.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Global Privacy Control
On by default. Honored as an opt-out, shown to the visitor, and logged with the consent record.
Children’s Privacy Policy (Pro)
A children’s privacy notice page for sites that may collect information from children under 13.
A plain-English summary, last reviewed October 25, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Does Oregon’s privacy law apply to nonprofits?
Yes. Nonprofits that meet the thresholds have been covered since July 1, 2025.
Do I have to honor Global Privacy Control in Oregon?
Yes, since January 1, 2026, as an opt-out of sale and targeted advertising.
Can someone ask which companies I shared their data with?
Yes. Oregon gives consumers the right to a list of the specific third parties you disclosed personal data to.
Is there still a cure period?
No. It ended on January 1, 2026.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
