Law / United States / 
Oregon
Oregon Consumer Privacy Act (OCPA), sensitive-data consent and geolocation
Or. Rev. Stat. §§ 646A.570 to 646A.589
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- on_request
- Who audits it
- Regulator, Independent third party
- Where the report goes
- Produced on request
What it requires
- Before processing sensitive data about an Oregon consumer, including a scraped fingerprint, voiceprint, retinal or iris scan, other biometric or genetic data point, or a consumer's precise location accurate within 1,750 feet, obtain the consumer's consent first.NIST AI RMFMAP 1.6
- OCPA's own personal-data definition excludes data lawfully available through government records or widely distributed media, or that a controller reasonably understands the consumer to have made public themselves (ORS 646A.570(13)(b)); this exclusion reaches 'sensitive data' too, since sensitive data is itself defined as personal data. It does not exempt data merely observable online that was not made public by the consumer, a government record, or distributed media, so scraped data of unclear public provenance should still be treated as covered.
- Do not sell a consumer's precise location data, accurate within a radius of 1,750 feet, whether or not the consumer consents (ORS 646A.578(2)(d)(B), added by HB 2008).NIST AI RMFMAP 3.3
These lines are LexLint's reading of the law's text. Also read by: Oregon Department of Justice (guidance, recorded ).
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/privacy-law-faqs-for-consumers/
- Guidance body
- Oregon Department of Justice
- Open questions
- Is a page on a public website "widely distributed media" under ORS 646A.570(13)(b)(A), so that data a scraper collects from it falls outside "personal data"?
- Is data "lawfully available" under ORS 646A.570(13)(b)(A) when the site's terms of use forbid automated collection?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Log retention
Five years at least, for every data protection assessment conducted under the section.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
A controller must conduct and document a written data protection assessment for each processing activity with a heightened risk of harm (targeted advertising, sensitive data, sale of personal data, risky profiling), and must keep each assessment for at least five years. The Attorney General may require production of an assessment relevant to an investigation. A processor's contract must also let the controller or an independent assessor review the processor's measures and report the result to the controller (ORS 646A.581(2)(h)). The consent, notice and consumer-request duties in ORS 646A.574 to 646A.578 state no record.
- Kind
- Explicit
- As of
- Provision
- ORS 646A.586(1)(a) and (6)
- Trigger
- personal_data_processing
What this law does
OCPA applies to a person conducting business in Oregon, or providing products or services to Oregon residents, that during a calendar year controls or processes the personal data of 100,000 or more consumers, other than data processed solely to complete a payment transaction, or of 25,000 or more consumers while deriving 25 percent or more of gross revenue from selling personal data, with no separate dollar-revenue threshold of its own.
Sensitive data is defined to include a consumer's precise present or past location, accurate within a 1,750-foot radius, and genetic or biometric data, and a controller may not process sensitive data about a consumer without first obtaining the consumer's consent.
OCPA's own 'personal data' definition does carry a publicly-available-information exemption, and 'sensitive data' is itself defined as a subset of personal data, so the same exemption applies upstream to it: personal data does not include data that is lawfully available through federal, state, or local government records or through widely distributed media, or that a controller reasonably has understood to have been lawfully made available to the public by the consumer (ORS 646A.570(13)(b)).
This is narrower than a blanket public-availability exemption, since it does not cover data merely observable online that a scraper, rather than the consumer or a distributed-media outlet, is the one making public; scraped sensitive or personal data of unclear provenance should still be treated as covered unless one of those two specific showings applies.
Oregon amended OCPA in 2025 (HB 2008, Oregon Laws 2025, chapter 251, ORS 646A.578(2)(d)) to bar a controller from selling personal data that accurately identifies, within a radius of 1,750 feet, a consumer's present or past location, and the text carries no consent exception; it also bars selling the personal data of a consumer the controller knows, or willfully disregards, is under 16.
Enforcement is by the Attorney General only, with a civil penalty of up to $7,500 per violation; before bringing an action the Attorney General must give a controller 30 days to cure a violation that can be cured, a duty that Oregon Laws 2025, chapter 417, section 5, applies to every controller until and after that only to certain noncommercial educational broadcast stations, and that section 6 repeals on . OCPA carries no private right of action.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .