Oregon Consumer Privacy Act (OCPA)

· About Oregon Consumer Privacy Act (OCPA)

Key Takeaways

  • The Oregon Consumer Privacy Act (OCPA) applies to controllers that meet Oregon revenue, data-volume, or processing thresholds, and it also reaches certain nonprofits and, from 26 September 2025, motor vehicle manufacturers and dealers that meet the statutory test.[1][3]
  • Covered entities must provide consumer rights to access, correct, delete, portability, and opt out of targeted advertising, sale of personal data, and certain profiling, and must honor universal opt-out signals by 1 January 2026.[1][3]
  • Oregon’s 2025 amendments expand protection by banning the sale of precise geolocation data and prohibiting the sale, targeted advertising use, and certain profiling of children under 16 effective 1 January 2026.[2][4]
  • The Oregon Department of Justice enforces the OCPA, and the Attorney General can seek civil penalties of up to $7,500 per violation after the cure period expires for most entities.[1][5]
  • The law’s original notice-and-cure framework phases out for most covered entities after 1 January 2026, meaning violations may be pursued without a prior cure opportunity.[1][8][13]
  • Organizations subject to the OCPA should map data flows, implement privacy-request workflows, and align their control framework with ISO 27001, NIST CSF 2.0, and ISO 42001 where AI-driven profiling or decision-making is in scope.[1][3]

What It Is

The OCPA is Oregon’s comprehensive consumer privacy law, codified in Oregon law and enforced by the Oregon Department of Justice through the Attorney General’s office.[1] It grants Oregon residents rights over personal data and imposes controller obligations for transparency, data minimization, security, and consumer choice.[1]

The law was enacted in 2023, took effect for most for-profit controllers on 1 July 2024, and for non-profit organizations on 1 July 2025.[9][12] A major amendments package signed in 2025 takes effect on 1 January 2026, including the universal opt-out mandate, geolocation restrictions, and child-data limits.[2][4][13]

Key phase-in milestones now relevant to compliance are:

  • 1 July 2024: core OCPA obligations begin for most for-profit controllers.[9][12]
  • 1 July 2025: OCPA obligations begin for non-profit organizations.[9][12]
  • 26 September 2025: certain motor vehicle manufacturers, dealers, and related entities come into scope regardless of consumer volume.[8]
  • 1 January 2026: universal opt-out, geolocation ban, and under-16 sale/targeted-advertising restrictions take effect.[1][2][13]

Who Must Comply

The OCPA applies to a controller that conducts business in Oregon or produces products or services targeted to Oregon residents and, during a calendar year, either controls or processes personal data of 100,000 or more consumers, or controls or processes personal data of 25,000 or more consumers and derives more than 25% of gross revenue from the sale of personal data.[1][3]

The law also extends to certain nonprofit organizations, which are not universally exempt under Oregon’s framework.[9][13] In addition, the 2025 amendments created specific coverage for some motor vehicle-related entities, making their applicability independent of the usual consumer-volume thresholds from 26 September 2025.[8]

The OCPA has extraterritorial reach: a company outside Oregon must comply if it targets Oregon residents and meets the statutory thresholds.[1][3] Common statutory exemptions remain for entities and data already regulated under federal frameworks, including data subject to HIPAA, GLBA, FCRA, and certain higher-education and employment contexts, although exemption details should be checked against the specific data activity rather than the organization as a whole.[1][3]

Core Requirements

  1. Consumer rights handling — Controllers must provide a mechanism for Oregon consumers to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising, sale of personal data, and certain profiling decisions.[1][3]
  1. Privacy notice and disclosures — Controllers must disclose categories of personal data processed, purposes, categories of third parties, consumer rights, appeal mechanisms, and whether personal data is sold or used for targeted advertising.[1][3]
  1. Data minimization and purpose limitation — Controllers may collect and process only personal data that is adequate, relevant, and reasonably necessary for the disclosed purposes, and they must not use it for materially incompatible purposes without further notice or consent where required.[1]
  1. Security safeguards — Controllers must establish, implement, and maintain reasonable administrative, technical, and physical safeguards appropriate to the volume and nature of personal data processed.[1]
  1. Processor contracts — Controllers must use written contracts that govern processing instructions, confidentiality, subcontracting, deletion or return of data, and cooperation with assessments and consumer requests.[1]
  1. Targeted advertising, sale, and profiling controls — Controllers must honor opt-outs and, from 1 January 2026, must honor universal opt-out signals and comply with the new bans on certain child-data processing and precise geolocation sales.[1][2][13]
  1. Data protection assessments — Controllers must conduct and document assessments for processing that presents heightened risk, including targeted advertising, sale of personal data, profiling, sensitive data processing, and certain automated decisions.[1][3]

Deadlines and Penalties

| Milestone | Date | What applies | |---|---:|---| | Core OCPA effective date for for-profit controllers | 1 July 2024 | General consumer rights, disclosures, contracts, safeguards, and assessments begin.[9][12] | | Core OCPA effective date for non-profits | 1 July 2025 | Non-profit controllers that meet the statute’s scope begin compliance.[9][12] | | Certain motor vehicle entities come into scope | 26 September 2025 | Specific auto-sector entities become covered regardless of consumer count.[8] | | Universal opt-out and 2025 amendments | 1 January 2026 | Universal opt-out, geolocation ban, and under-16 sale/targeted-advertising limits apply.[1][2][13] |

The maximum civil penalty is $7,500 per violation.[5][12] The Attorney General may also seek injunctive relief and investigate through civil investigative demands, and the cure period that previously limited enforcement for many entities no longer applies after the statutory sunset for most covered businesses.[1][8][13]

How to Comply

  1. Build a data inventory — Map personal data, sensitive data, geolocation data, and minors’ data across products, vendors, and internal systems, then tie each use case to a lawful purpose and retention period.
  1. Classify OCPA scope and exemptions — Determine whether the organization meets the 100,000-consumer or 25,000-consumer-plus-revenue threshold, whether nonprofit or sectoral exemptions apply, and whether any business line falls under the 2025 auto-entity expansion.
  1. Update notices and preference signals — Rewrite privacy notices to reflect OCPA disclosures and deploy a universal opt-out workflow that recognizes browser-based or device-based signals from 1 January 2026 onward.[1][13]
  1. Operationalize consumer rights — Create intake, identity verification, appeal, response-time, and audit workflows for access, correction, deletion, portability, and opt-out requests.
  1. Harden contracts and vendor oversight — Use processor agreements that cover instructions, assistance, deletion, confidentiality, and subcontractor controls, and review onward transfer rights for data brokers and adtech vendors.
  1. Apply risk-based security controls — Align baseline security with ISO 27001 for governance and control design, and use NIST CSF 2.0 to structure identify-protect-detect-respond-recover activities around personal-data risk.
  1. Govern AI and profiling use cases — If profiling or automated decision-making is used, document training data, evaluation, human oversight, and appeal pathways; ISO 42001 is a useful management-system reference where AI systems materially affect consumer rights.
  1. Test and evidence compliance — Run periodic privacy-control testing, maintain records of assessments and exceptions, and prepare an enforcement file showing notices, opt-out logic, vendor contracts, and response metrics.

Related Regulations

Washington My Health My Data Act overlaps on consumer health data restrictions and opt-out expectations, but it is narrower in subject matter and more specific to health-related data uses.

California Consumer Privacy Act / CPRA is the closest U.S. peer statute and often sets operational baselines for notices, opt-outs, and processor contracting, though Oregon’s 2026 universal opt-out and child/geolocation rules are distinct.

Colorado Privacy Act shares the controller/processor model and universal opt-out design, making it a useful comparator for governance and technical implementation.

EU GDPR conflicts only indirectly: multinational groups often harmonize OCPA workflows with GDPR rights handling, but Oregon’s thresholds, exemptions, and enforcement mechanics are different.

Children’s Online Privacy Protection Act (COPPA) may overlap for online services aimed at children, but the OCPA’s 2026 under-16 restrictions are broader in some respects and not limited to parental-consent mechanics.

FAQ

Does the OCPA apply to companies outside Oregon?

Yes, if a company conducts business in Oregon or targets Oregon residents and meets the statute’s thresholds.[1][3] Physical presence in Oregon is not required. The practical test is whether the business processes enough Oregon consumer data or derives enough revenue from selling personal data.

Does the OCPA require universal opt-out signals?

Yes. As of 1 January 2026, covered entities must honor universal opt-out mechanisms that meet the law’s technical requirements.[1][13] This affects sale and targeted-advertising preferences, so browser-level or device-level signal handling must be built into the consent stack.

Does the OCPA ban selling precise geolocation data?

Yes, beginning 1 January 2026, the amended law prohibits the sale of precise geolocation data for all Oregon consumers.[2][4][13] The restriction is not limited to minors. Companies using location-based advertising or analytics should separate collection from downstream sale and sharing logic.

Does the OCPA protect children under 16?

Yes. The 2025 amendment prohibits processing the personal data of consumers whom the controller knows or willfully disregards are under 16 when the processing is for targeted advertising, sale of personal data, or certain profiling, effective 1 January 2026.[2][4] That is stricter than the pre-2026 baseline and requires age-risk controls, not just parental-consent workflows.

Is there still a cure period?

For most covered entities, the prior notice-and-cure structure has effectively ended after the statutory sunset tied to 1 January 2026.[1][8][13] Enforcement can now move directly toward investigation and penalties. Organizations that previously relied on cure notices should treat the law as a full-enforcement regime.

Sources

Put it into practice

More compliance guides