What Is the Oregon Consumer Privacy Act?
OCPA covers controllers processing personal data of 100,000+ Oregonians (or 25,000+ with data-sale thresholds). Unusually, OCPA applies to nonprofit organizations, unlike most peer state laws. Consumers have deletion, access, correction, and opt-out rights. The AG enforces exclusively; no private right of action. The law requires recognition of universal opt-out mechanisms starting January 2026.
At a glance
- Full name
- Oregon Consumer Privacy Act
- Short code
- OCPA
- Effective date
- July 1, 2024
- Response deadline
- 45 days
- Cure period
- None (sunset)
- Private right of action
- No
- Enforcement
- Oregon Department of Justice — Consumer Protection
- Maximum penalty
- Up to $7,500 per violation under the Oregon Unlawful Trade Practices Act
- Statutory citation
- Or. Rev. Stat. § 646A.570 — 646A.589
Who OCPA applies to
A business is covered if it meets the applicability thresholds set out in Or. Rev. Stat. § 646A.570 — 646A.589. Most state laws use an “or” framework — any one of the thresholds triggers coverage unless otherwise noted.
- Conducts business in Oregon or produces products/services targeted at Oregon residents, AND
- Controls or processes personal data of 100,000+ Oregon consumers in a calendar year, OR
- Controls or processes personal data of 25,000+ Oregon consumers AND derives over 25% of gross revenue from the sale of personal data
Consumer rights under OCPA
Deletion, access, correction, portability, opt-out
Nonprofit coverage (rare among state laws)
Universal opt-out recognition (effective 2026)
AG exclusive enforcement
Notable features (vs. CCPA)
OCPA is one of the few US state privacy laws that applies to qualifying nonprofit organizations — closing the loophole that lets data-aggregating nonprofits sidestep CCPA-style laws. The Oregon AG is required to recognize a Universal Opt-Out Mechanism (UOOM) such as Global Privacy Control starting January 2026. Authorized agent requests are expressly supported.
Enforcement & penalties
Enforcing agency: Oregon Department of Justice — Consumer Protection
Maximum penalty: Up to $7,500 per violation under the Oregon Unlawful Trade Practices Act
Cure period: The 30-day cure period sunset on January 1, 2026. Violations occurring after that date are directly enforceable without a cure opportunity.
Private right of action: OCPA has no private right of action. Enforcement is exclusive to the Oregon Attorney General, who may treat a violation as an unlawful trade practice.
Where to file a complaint: Oregon Department of Justice — Consumer Protection
How to exercise your OCPA rights
- 1
Identify the business that holds your data (or use OfflistMe, which pre-targets 300+ known brokers and applies OCPA citations automatically).
- 2
Submit a verifiable consumer request to the business's designated contact. Include enough identifying data that the business can verify you as a Oregon resident (e.g., ZIP code, email associated with your record).
- 3
Under OCPA, businesses have 45 days to respond. Extensions are permitted with written notice under most state laws.
- 4
If the business fails to respond or denies the request without legal basis, file a complaint with the Oregon Department of Justice — Consumer Protection at https://justice.oregon.gov/consumercomplaints.
Use your rights
OCPA-compliant deletion emails, $5 one-time
OfflistMe drafts OCPA-compliant deletion emails for 300+ data brokers. Citations included. You send from your own inbox. No account, no ID upload.
Start for $5 →FAQ
Does OCPA cover nonprofit data brokers?+
Yes. Unlike most state privacy laws (CCPA, VCDPA, CPA, CTDPA), OCPA applies to qualifying nonprofits. This closes a loophole where nonprofits aggregating consumer data would otherwise be exempt.
Official sources & citations
Compare with sibling state laws
OCPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date — useful when tracking how this law influenced or was influenced by neighbouring legislation: