Oregon Consumer Privacy Act
OCPA · Normalized Research Card v2.1
IN FORCELAST VERIFIED · AUG 26 2026At a glance
Who must comply?
Applicability model: Numerical threshold + vehicle-manufacturer exception.
Core threshold: 100,000 consumers; or 25,000 consumers and >25% gross revenue from sale; certain motor-vehicle manufacturers are covered regardless of threshold
Applicability remains subject to statutory entity, data-level and activity-specific exemptions. Employment/B2B treatment and federal-law carve-outs should be read together with the official statute linked below.
Consumer rights
| Right / protection | Status |
|---|---|
| Access | ✓ Included / qualified by statute |
| Specific third-party recipient list | ✓ Included / qualified by statute |
| Correction | ✓ Included / qualified by statute |
| Deletion | ✓ Included / qualified by statute |
| Portability | ✓ Included / qualified by statute |
| Opt-out sale | ✓ Included / qualified by statute |
| Opt-out targeted advertising | ✓ Included / qualified by statute |
| Opt-out profiling | ✓ Included / qualified by statute |
| Appeal | ✓ Included / qualified by statute |
Sensitive data & minors
Sensitive-data standard: Consent required
Under-13 processing requires consent; from 2026 sale of under-16 data and targeted advertising/profiling involving under-16 consumers are prohibited.
Business obligations
Notice, contact mechanism, minimization, reasonable safeguards, consent for sensitive/secondary-purpose processing, assessments and universal opt-out recognition.
Enforcement
Authority: Oregon Attorney General
Private right of action: No
Penalty / remedy baseline: Up to $7,500 per violation
What makes Oregon different?
Oregon stands out for nonprofit coverage, a right to identify specific third-party recipients, active public enforcement reporting, universal opt-out and 2026 bans affecting precise geolocation and under-16 data.
Developments to watch
As of January 1, 2026, the AG no longer has to provide notice and an opportunity to cure. Sale of precise geolocation is prohibited and UOOM requirements are in force.
Editorial rule: future-effective, proposed and pending measures are kept separate from current law.
Primary sources & verification
Last verified: August 26, 2026
Research standard: primary official sources prioritized; official guidance used to explain operational requirements.