Oregon Data Privacy Law (OCPA): What Oregon Residents Need to Know

The Oregon Consumer Privacy Act (OCPA) took effect on July 1, 2024. It covers more ground than most other state privacy laws in one specific way: it applies to nonprofit organizations, which every other comprehensive state privacy law exempts. Here is what Oregon residents need to know.

What Is the Oregon Consumer Privacy Act?

Governor Tina Kotek signed the Oregon Consumer Privacy Act on July 18, 2023. It became effective July 1, 2024 for most covered businesses, with a later deadline of July 1, 2025 for nonprofit organizations. Oregon was the ninth state to pass comprehensive consumer privacy legislation.

The OCPA applies to businesses and persons that conduct business in Oregon or produce products or services targeted to Oregon residents, and during a calendar year either: control or process personal data of 100,000 or more Oregon consumers, or control or process personal data of 25,000 or more Oregon consumers and derive more than 25% of annual gross revenue from the sale of personal data. There is no minimum revenue floor, meaning smaller businesses with large data processing volumes are covered.

The nonprofit coverage is what distinguishes the OCPA. Starting July 1, 2025, Oregon's privacy protections extend to consumers whose data is held by nonprofit organizations — advocacy groups, healthcare nonprofits, foundations — organizations that have operated outside commercial data privacy laws until now.

Your Rights Under the Oregon OCPA

Oregon residents have five enforceable privacy rights under the OCPA:

Oregon's access right goes further than most state laws on one point: businesses must disclose the specific third parties that received your data — not just broad categories. In practice, this means you can find out which other companies may have a copy.

How the OCPA Compares to CCPA

Oregon's maximum penalty of $25,000 per violation is the highest of any state privacy law, above Colorado's $20,000 and California's $7,500. The Oregon AG can investigate violations and seek injunctive relief in addition to civil penalties.

What Data Brokers Must Do Under the OCPA

Covered controllers and processors under Oregon's OCPA have extensive obligations:

• Publish a detailed privacy notice that includes the categories of personal data processed, the purposes of processing, the specific third parties to whom data has been disclosed, and detailed instructions for submitting consumer rights requests. Oregon's notice requirements are among the most detailed of any state law.
• Honor universal opt-out signals. Oregon requires controllers to establish a process to honor opt-out preference signals transmitted via browser or device settings, similar to GPC compliance requirements in California and Colorado.
• Obtain consent before processing sensitive data, including data concerning racial or ethnic origin, religious beliefs, mental health, sexual orientation, transgender or non-binary status, citizenship, biometric data, precise geolocation, and data of children under 13.
• Conduct data protection assessments for processing activities presenting heightened risk, including targeted advertising, data sales, and significant profiling activities.
• Process consumer rights requests within 45 days, with a possible 45-day extension. Deletion requests must be honored for all personal data the controller obtained about the consumer, not just data the consumer provided.
• Provide a meaningful appeals mechanism for denied requests, with a response required within 45 days of the appeal.

Step-by-Step: How to Submit an OCPA Deletion Request

1. 1. Enable Global Privacy Control in your browser. Oregon requires covered businesses to honor opt-out signals. Using GPC in your browser (available natively in Firefox and Brave) will automatically trigger opt-out treatment for targeted advertising and data sales on covered sites.
2. 2. Locate the data broker's privacy notice. Look in the site footer for a link to the privacy policy or "Oregon Privacy Rights." OCPA requires detailed privacy notices that include instructions for submitting rights requests and a list of specific third parties who have received your data.
3. 3. Submit your deletion request. Use the company's designated mechanism. Identify yourself as an Oregon resident and request deletion of all personal data the company holds about you — whether obtained from you directly or from third-party sources. Oregon's deletion right covers all obtained data.
4. 4. Request the list of third parties. As part of your access request, you can ask for the names of specific third parties to whom the controller has disclosed your personal data. This is unique to Oregon and can help you identify additional brokers to contact.
5. 5. Respond to identity verification and track the 45-day window. Provide requested verification information promptly. Document your submission date and monitor for a response. Note any extension notices.
6. 6. Appeal denials and escalate if necessary. If your request is denied, use the controller's appeals process. If the appeal is denied, file a complaint with the Oregon Department of Justice at doj.state.or.us. The Oregon AG can seek penalties up to $25,000 per violation.

Nonprofit coverage, specific third-party disclosure, broad deletion scope, and $25,000 maximum penalties put the Oregon OCPA among the stronger state privacy laws for consumers. For more on how state laws affect data broker removal, see our guide to California's CCPA, or let GhostVault automate your data removal.

Frequently Asked Questions