What Is the Oregon Consumer Privacy Act?
OCPA covers controllers processing personal data of 100,000+ Oregonians (or 25,000+ with data-sale thresholds). Unusually, OCPA applies to nonprofit organizations, unlike most peer state laws. Consumers have deletion, access, correction, and opt-out rights. The AG enforces exclusively; no private right of action. The law requires recognition of universal opt-out mechanisms starting January 2026.
At a glance
- Full name
- Oregon Consumer Privacy Act
- Short code
- OCPA
- Effective date
- July 1, 2024
- Response deadline
- 45 days
- Cure period
- None (sunset)
- Private right of action
- No
- Enforcement
- Oregon Department of Justice. Consumer Protection
- Maximum penalty
- Up to $7,500 per violation under the Oregon Unlawful Trade Practices Act
- Statutory citation
- Or. Rev. Stat. § 646A.570, 646A.589
Who OCPA applies to
A business is covered if it meets the applicability thresholds set out in Or. Rev. Stat. § 646A.570, 646A.589. Most state laws use an “or” framework — any one of the thresholds triggers coverage unless otherwise noted.
- Conducts business in Oregon or produces products/services targeted at Oregon residents, AND
- Controls or processes personal data of 100,000+ Oregon consumers in a calendar year, OR
- Controls or processes personal data of 25,000+ Oregon consumers AND derives over 25% of gross revenue from the sale of personal data
Consumer rights under OCPA
Deletion, access, correction, portability, opt-out
Nonprofit coverage (rare among state laws)
Universal opt-out recognition (effective 2026)
AG exclusive enforcement
Notable features (vs. CCPA)
OCPA is one of the few US state privacy laws that applies to qualifying nonprofit organizations, closing the loophole that lets data-aggregating nonprofits sidestep CCPA-style laws. The Oregon AG is required to recognize a Universal Opt-Out Mechanism (UOOM) such as Global Privacy Control starting January 2026. Authorized agent requests are expressly supported.
Enforcement & penalties
Enforcing agency: Oregon Department of Justice. Consumer Protection
Maximum penalty: Up to $7,500 per violation under the Oregon Unlawful Trade Practices Act
Cure period: The 30-day cure period sunset on January 1, 2026. Violations occurring after that date are directly enforceable without a cure opportunity.
Private right of action: OCPA has no private right of action. Enforcement is exclusive to the Oregon Attorney General, who may treat a violation as an unlawful trade practice.
Where to file a complaint: Oregon Department of Justice. Consumer Protection
How to exercise your OCPA rights
- 1
Identify the business that holds your data (or use OfflistMe, which pre-targets 500+ known brokers and applies OCPA citations automatically).
- 2
Submit a verifiable consumer request to the business's designated contact. Include enough identifying data that the business can verify you as a Oregon resident (e.g., ZIP code, email associated with your record).
- 3
Under OCPA, businesses have 45 days to respond. Extensions are permitted with written notice under most state laws.
- 4
If the business fails to respond or denies the request without legal basis, file a complaint with the Oregon Department of Justice. Consumer Protection at https://justice.oregon.gov/consumercomplaints.
Use your rights
OCPA-compliant deletion emails, $7 one-time
OfflistMe drafts OCPA-compliant deletion emails for $500+ data brokers. Citations included. You send from your own inbox. No account, no ID upload.
Start for $7 →FAQ
Does OCPA cover nonprofit data brokers?+
Yes. Unlike most state privacy laws (CCPA, VCDPA, CPA, CTDPA), OCPA applies to qualifying nonprofits. This closes a loophole where nonprofits aggregating consumer data would otherwise be exempt.
Official sources & citations
Compare with sibling state laws
OCPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date, useful when tracking how this law influenced or was influenced by neighboring legislation: