Law / United States / 
Oregon
Oregon Consumer Privacy Act (OCPA), general applicability and controller duties
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- none
What it requires
- Confirm you conduct business in Oregon, or produce a product or service used by Oregon residents, and process or sell personal data before relying on OCPA's scope in compliance planning.
- Do not sell precise geolocation data or process a known Oregon minor's (under-16) data for targeted advertising, sale, or profiling; both are prohibited outright as of .
- If you manufacture motor vehicles, or are an affiliate of a manufacturer, and you control or process personal data obtained from a consumer's use of a motor vehicle or a component of one, treat OCPA as applying to you whatever the consumer-count thresholds; that has applied since .
These lines are LexLint's reading of the law's text. Also read by: Oregon Department of Justice, Consumer Protection (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Department's FAQs state that the statute controls in the event of any conflicting interpretation.
- As of
- Guidance link
- https://www.doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-for-businesses/
- Guidance body
- Oregon Department of Justice, Consumer Protection
- Open questions
- Are the consumers whose personal data a parent company and its subsidiaries each control or process added together to reach the 100,000-consumer threshold in ORS 646A.572(1)(a)(A)?
What it makes you log
Logging duty
Sections 646A.570 and 646A.578 define the Act's terms and set the controller's duties: a privacy notice stating the purposes of processing, a limit on collection, safeguards for the personal data, a means to revoke consent and limits on processing sensitive, children's and location data. None names a log, a record the controller keeps, a retention period for a record or a reader of one. The privacy notice is a statement to consumers, and the safeguards protect the personal data itself. The Act's record rules sit in sections this row does not cite: ORS 646A.586(1) and (6) (a documented data protection assessment, kept at least five years, which the Attorney General may require under 646A.586(3)), ORS 646A.576(5)(e)(B) (a documented belief before an opt-out request is denied as fraudulent) and ORS 646A.572(7) (the controller's burden of demonstrating an exemption). The territorial reach is taken from ORS 646A.572(1)(a), which the row's applicability requirement restates, and from the definition of consumer in ORS 646A.570(7).
- Kind
- None
- As of
What this law does
OCPA governs private-sector processing of Oregon consumers' personal data. Enacted as S.B. 619 (2023 Regular Session), Or. Laws 2023, ch. 369, effective for most controllers. Organizations described in section 501(c)(3) of the Internal Revenue Code were exempt from it until . Two 2025 amendments are already reflected in the current codified text. House Bill 2008 added a ban on selling precise geolocation data.
House Bill 2008 barred a controller from processing a consumer's personal data for targeted advertising or for profiling toward decisions with legal or similar effects, and from selling a consumer's personal data, if the controller knows or willfully disregards that the consumer is under 16 years of age. House Bill 2008 took effect on .
House Bill 3875 made the Act apply to a motor vehicle manufacturer and its affiliates that control or process personal data obtained from a consumer's use of a motor vehicle or a component of one, whatever the consumer-count thresholds. House Bill 3875 took effect on .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .