The Oregon Consumer Privacy Act

December 2025 - Printed in cooperation with the Oregon Department of Justice

The Oregon Consumer Privacy Act, ORS 646A.570-646A.589, went into effect on July 1, 2024, and may apply to your business. The Oregon Attorney General is committed to educating consumers and businesses about the new privacy law and providing information to assist businesses in meeting their compliance obligations. 

The Oregon Consumer Privacy Act (OCPA) is a comprehensive state privacy law protecting Oregon consumers and their personal data. The OCPA was developed over four years by the Attorney General’s Consumer Privacy Task Force, which included business groups such as Oregon Business & Industry and the Technology Association of Oregon. The law was designed to provide meaningful protections to Oregon consumers but also be workable for industry. 

The OCPA applies to a business or entity that conducts business in Oregon or provides products or services to Oregon residents if, during a calendar year, that individual or entity controls or processes the personal data of :

1. At least 100,000 consumers, or
2. 25,000 or more consumers and derives over 25% of annual gross revenue from the sale of personal data.¹  

Personal data is any information that can be linked to an individual or to a device that can be linked to one or more individuals in a household.²   

Businesses/entities that fall within either of the OCPA’s application thresholds may be controllers under the law and have several legal obligations including, but not limited to, creating and making available a privacy notice that meets the OCPA’s requirements.³  Some other requirements include:

• Providing consumers with specific rights over their personal data (including data about the consumer obtained from a third party)⁴
• Obtaining consent before processing sensitive data⁵  
• Conducting data protection assessments before engaging in processing activities that present a heightened risk of harm to consumers.⁶ 

Please assess whether the OCPA applies to your business, and if so, ensure that you are in full compliance with its terms. The requirements listed above may be familiar if you are subject to other states’ consumer privacy laws, such as those in California or Colorado; however, the OCPA includes unique provisions such as giving consumers the right to obtain a list of all third parties to whom a business discloses personal data. To learn more about the OCPA and access resources designed specifically to support businesses, please visit our website at https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/ or review our privacy Law FAQs for businesses, available at https://www.doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-for-businesses/. 

The Oregon Department of Justice thanks you for your help in protecting the data privacy and security of Oregonians. 

¹ ORS 646A.572(1)(a)-(b).
² ORS 646A.570(13)(a).
³ See, e.g., ORS 646A.578.
⁴ ORS 646A.574.
⁵ ORS 646A.578(2)(b).
⁶ ORS 646A.586.