Law / United States / 
Oregon
Oregon Consumer Privacy Act, Attorney General enforcement
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect OCPA violations to be enforced exclusively by the Oregon Attorney General, never by a private plaintiff.
- Do not expect notice or an opportunity to cure before the Attorney General acts; since the Attorney General may proceed directly to an enforcement action.
These lines are LexLint's reading of the law's text. Also read by: Oregon Department of Justice, Consumer Protection (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-for-businesses/
- Guidance body
- Oregon Department of Justice, Consumer Protection
- Open questions
- Does 'each violation' in ORS 646A.589(4)(a) count each affected consumer, each unanswered request or each unlawful practice when the Attorney General seeks a civil penalty of not more than $7,500?
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 646A.589 lets the Attorney General serve an investigative demand for testimony, interrogatories, documents and physical evidence, requires the Attorney General to hold what is produced in confidence (data protection assessments among it, subsection (3)(a)), and sets the civil penalty, the limitation period and the exclusive enforcement authority. A regulator's power to demand documents is not a duty on a controller to keep a log or record. The assessment the Attorney General may demand is kept under ORS 646A.586(6), a section this row does not cite. The section states no territorial reach of its own; the Act's reach sits in ORS 646A.570(7) and 646A.572(1).
- Kind
- None
- As of
What this law does
The Oregon Attorney General has exclusive authority to enforce OCPA; no other Oregon law creates a private right of action for a violation. Civil penalties run up to $7,500 per violation, and the statute of limitations is five years from the last violative act. Until the Attorney General had to notify a controller of a violation that the Attorney General determined the controller could cure, and the controller had 30 days to cure it before the Attorney General could sue.
Since the Attorney General is no longer required to give controllers notice and an opportunity to cure. The notice duty that section 5 of chapter 417, Oregon Laws 2025, kept for certain noncommercial educational broadcast stations was repealed on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .