Oregon Consumer Privacy Act, Attorney General enforcement

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 July 2024.

An enforcement supervision rule binding private bodies.

As of 27 August 2026.

What it requires

Expect OCPA violations to be enforced exclusively by the Oregon Attorney General, never by a private plaintiff.
Do not assume a cure opportunity as of right. The Attorney General decides whether a violation is curable before offering notice, and may proceed directly to enforcement without a cure opportunity.

If you get it wrong

Private right of actionNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Oregon Attorney General has exclusive authority to enforce OCPA; no other Oregon law creates a private right of action for a violation. Civil penalties run up to $7,500 per violation, and the statute of limitations is five years from the last violative act.

The cure opportunity was discretionary from the outset: the Attorney General may notify a controller of a violation only if the Attorney General determines the violation can be cured, and, per secondary reporting, that discretionary practice tightened further as of January 1, 2026.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

official Oregon statute text, ORS 646A.570 to 646A.589, Oregon Revised Statutes

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app