Oregon Consumer Privacy Act, consumer rights

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 July 2024.

A data subject rights rule binding private bodies.

As of 27 August 2026.

What it requires

Give an Oregon consumer a means to confirm whether you process their personal data, disclose the categories processed, provide a portable copy, correct it, and delete it.
Offer an Oregon consumer an opt-out of targeted advertising, sale, and profiling for decisions with legal or similarly significant effects.
Respond to a consumer rights request without undue delay and within 45 days of receipt, decide an appeal within 45 days, and honor a consent revocation within 15 days.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

OCPA gives an Oregon consumer the right to confirm processing, obtain a categories disclosure, receive a portable copy, correct, delete, and opt out of targeted advertising, sale, and profiling for decisions with legal or similarly significant effects.

A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available; an appeal of a refusal must be decided within 45 days; and consent revocation must be honored no later than 15 days after receipt.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

official Oregon statute text, ORS 646A.570 to 646A.589, Oregon Revised Statutes

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app