What Is the Oregon Consumer Privacy Act?
OCPA generally covers controllers processing personal data of 100,000+ Oregonians or 25,000+ while deriving at least 25% of annual gross revenue from selling personal data, subject to the statute and exceptions. Motor vehicle manufacturers and affiliates can be covered for covered vehicle-use data without the ordinary consumer-number thresholds, and nonprofit entities became subject to the law on July 1, 2025, subject to exemptions. The law grants deletion, access, correction, portability, and opt-out rights; from January 1, 2026, covered controllers must recognize qualifying universal opt-out mechanisms for applicable sale and targeted-advertising opt-outs. Enforcement is exclusive to the AG without a general private right of action.
At a glance
- Full name
- Oregon Consumer Privacy Act
- Short code
- OCPA
- Effective date
- July 1, 2024
- Response reference
- 45 days in this snapshot
- Cure period
- None recorded in this snapshot
- Private right of action
- No
- Enforcement
- Oregon Department of Justice. Consumer Protection
- Penalty reference
- Up to $7,500 per violation under the Oregon Unlawful Trade Practices Act
- Statutory citation
- Or. Rev. Stat. §§ 646A.570–646A.589
Who OCPA applies to
A business is covered if it meets the applicability thresholds set out in Or. Rev. Stat. §§ 646A.570–646A.589. The thresholds listed below are the research record for this law. Whether one or more applies depends on the current statute, its exceptions, and the business's facts; do not assume a universal threshold structure.
- Conducts business in Oregon or provides products or services to Oregon residents, AND controls or processes personal data of 100,000+ Oregon consumers in a calendar year
- Conducts business in Oregon or provides products or services to Oregon residents, AND controls or processes personal data of 25,000+ Oregon consumers while deriving at least 25% of annual gross revenue from selling personal data
- Motor vehicle manufacturers and their affiliates that control or process personal data obtained from a consumer's use of a motor vehicle or a component of a motor vehicle, subject to statutory exemptions
Consumer rights under OCPA
Deletion, access, correction, portability, opt-out
Coverage for certain nonprofit controllers, subject to exceptions
Universal opt-out recognition for applicable sale and targeted-advertising opt-outs (from January 1, 2026)
AG exclusive enforcement
Notable features (vs. CCPA)
Nonprofit entities became subject to the OCPA on July 1, 2025, subject to statutory exemptions. Motor vehicle manufacturers and their affiliates can be covered for personal data obtained from a consumer's use of a motor vehicle without the ordinary consumer-number thresholds. Beginning January 1, 2026, covered controllers must accept qualifying universal opt-out mechanisms for applicable sale and targeted-advertising opt-outs. Oregon also prohibits selling precise geolocation data and selling or using the personal data of consumers under 16 for targeted advertising or profiling. Authorized agents are required for opt-out requests when the controller can commercially reasonably verify the consumer and agent; the OCPA does not require acceptance of an agent for every other rights request.
Enforcement and penalty reference
Enforcing agency: Oregon Department of Justice. Consumer Protection
Penalty reference: Up to $7,500 per violation under the Oregon Unlawful Trade Practices Act
Cure period: The general 30-day cure provision sunset on January 1, 2026. A temporary exception for certain noncommercial educational broadcast stations was repealed July 1, 2026; this snapshot does not treat cure as a general current right.
Private right of action: OCPA has no private right of action. Enforcement is exclusive to the Oregon Attorney General, who may treat a violation as an unlawful trade practice.
Where to file a complaint: Oregon Department of Justice. Consumer Protection
How to exercise your OCPA rights
- 1
Identify the business that holds your data. OfflistMe can help you review a provider route across 1,034 US/global workflow profiles in the 1,052-record research universe; it does not decide whether a law applies to a specific request.
- 2
Submit a request to the business's designated contact using the provider's current verification instructions. Include only the information reasonably needed to match your record and check the applicable Oregon residency, scope, exemption, and verification rules before sending.
- 3
This research snapshot records a 45-day reference window for the modeled request. Confirm the current statute, request type, controller scope, extension rule, and verification date before treating it as a deadline.
- 4
If the provider does not respond or disputes the request, preserve the request and response record, review the applicable exceptions, and consider the Oregon Department of Justice. Consumer Protection complaint route at https://justice.oregon.gov/complaints/. A complaint route does not itself guarantee deletion or a particular enforcement result.
Generate requests in under 60 seconds
Generate a OCPA privacy request, $9 one-time
FAQ
Does OCPA cover nonprofit data brokers?+
Certain qualifying nonprofits can fall within OCPA, subject to the statute's definitions and exceptions. Do not assume that every nonprofit or every nonprofit-held record is covered; check the controller, activity, data, and exemption facts.
Official sources & citations
Compare with sibling state laws
OCPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date, useful when tracking how this law influenced or was influenced by neighboring legislation: