The Oregon Consumer Privacy Act applies to businesses that control or process personal data of at least 100,000 Oregon consumers, or 25,000 consumers if more than a quarter of revenue comes from selling personal data. A distinctive feature: consumers can request the specific list of third parties to which a business has disclosed personal data, not just categories, which means covered sites need real vendor tracking.
What the Oregon Consumer Privacy Act Requires
Otherwise it follows the familiar pattern: a privacy notice, access, correction, deletion, and portability rights, opt-in consent for sensitive data, and opt-outs for targeted advertising, sale, and significant profiling. Oregon has almost no entity-level exemptions, so nonprofits, covered since July 1, 2025, and many organizations exempt elsewhere are covered. Universal opt-out signals must be honored as of January 1, 2026.
Enforcement and Penalties
The Attorney General enforces with penalties up to $7,500 per violation. The 30-day cure period expired January 1, 2026, so violations can now be pursued without an advance warning.
Source: Oregon Legislature: SB 619, ORS 646A.570-646A.589
Report a violation: If you believe a business is violating this law, you can file a complaint with the Oregon Department of Justice Consumer Protection.
