Oregon Consumer Privacy Act (OCPA)

The Oregon Consumer Privacy Act (OCPA) grants Oregon residents rights over their personal data, including the ability to access, correct, and delete data, and opt-out of the sale of their information. It also sets data protection standards for businesses.

JurisdictionOregon
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The Oregon Consumer Privacy Act (OCPA) establishes several key requirements for businesses:

  • Consumer Rights: The OCPA grants Oregon residents specific rights over their personal data, including:
  • Right to access their personal data
  • Right to correct inaccuracies
  • Right to delete their personal data
  • Right to opt out of the sale of their personal data, targeted advertising, and certain profiling activities Oregon Department of Justice - Consumer Privacy
  • Privacy Notice: Businesses must provide a clear and accessible privacy notice detailing:
  • Categories of personal data collected
  • Purposes for processing personal data
  • Categories of third parties with whom data is shared
  • How consumers can exercise their rights Usercentrics - OCPA Overview
  • Consent for Sensitive Data: Businesses must obtain explicit consent before processing sensitive personal data, including data related to children under 13. Termly - OCPA Summary

Compliance Challenges

Organizations face several challenges in complying with the OCPA:

  • Data Mapping and Inventory: Identifying and categorizing all personal data collected and processed can be complex, especially for large organizations with multiple data systems. IAPP - Data Mapping Challenges
  • Implementing Consumer Rights: Establishing efficient processes to handle consumer requests for access, correction, and deletion of personal data within the required timeframes. DataGrail - Consumer Rights Automation

Implementation Best Practices

To effectively implement OCPA requirements:

  • Establish Data Subject Request Processes: Implement systems to efficiently handle consumer rights requests, considering solutions like DataGrail's Privacy Platform.
  • Conduct Regular Data Protection Assessments: Use frameworks like the NIST Privacy Framework to assess and mitigate privacy risks.

Recent Updates

As of February 2025, the most recent updates to the OCPA include:

  • Browser Privacy Settings: By 2026, websites must honor browser privacy settings as recognized opt-out requests. Termly - OCPA Summary

Related Regulations

The OCPA shares similarities with other state privacy laws:

  • Virginia Consumer Data Protection Act (VCDPA): Comparable requirements for data protection assessments. Virginia CDPA Full Text
  • General Data Protection Regulation (GDPR): While an EU regulation, it influenced many concepts in the OCPA. GDPR Official Text

Industry Impact

The OCPA will significantly impact various industries:

Sources

Recent developments

  • — OCPA updates ban controllers from selling precise geolocation data or data of children under 16, prohibit using minor data for targeted advertising/profiling, and require honoring universal opt-out mechanisms. (source)
  • — Several new consumer protection laws, including OCPA amendments, take effect January 1, 2026, impacting data privacy for Oregon consumers. (source)
  • — Governor Tina Kotek signed HB 2008, prohibiting sale of precise geolocation data and personal data of children under 16, and HB 3875, expanding OCPA’s scope to cover all motor vehicle manufacturers processing in-vehicle personal data, thereby giving drivers opt-out rights over sale and advertising uses of car data[2]. (source)
  • — Oregon’s HB 2008 amends the Oregon Consumer Privacy Act to prohibit sale of precise geolocation data and to bar targeted advertising, sale, or profiling using personal data of consumers under 16; the amendment takes effect 2026-01-01 and requires businesses to update data practices before year-end[8]. (source)
  • — Oregon’s HB 3875 removes prior exemptions so that motor vehicle manufacturers processing telematics and other in-vehicle personal data are now subject to OCPA, significantly impacting automotive data practices and requiring changes to consent, opt-out, and data governance frameworks[2]. (source)
  • — Oregon DOJ highlights that as of 2026-01-01 businesses must honor universal opt-out signals that meet technical requirements and that OCPA’s 30‑day cure provision for violations ends on that date, increasing enforcement risk and driving industry preparation for automated opt-out compliance[1][4]. (source)
  • — Privacy Rights Clearinghouse characterizes OCPA, in force since 2024-07-01, as one of the broadest state privacy laws, emphasizing unique rights to request lists of specific data recipients, coverage of vehicle-generated information, and bans on precise location data sales, prompting businesses to reassess data mapping and disclosure practices[6]. (source)
  • — An Oregon Real Estate Agency newsroom update explains OCPA’s applicability thresholds (100,000 consumers or 25,000 consumers plus 25% revenue from data sales) and outlines compliance expectations for Oregon businesses, spurring sector-specific guidance and implementation efforts, particularly among real estate and service firms[3]. (source)
  • — White & Case’s alert on the passage of OCPA notes its alignment with other comprehensive U.S. state privacy laws while highlighting Oregon-specific features such as profiling opt-outs and a temporary cure period, informing industry compliance strategies and multi-state privacy program harmonization efforts[4]. (source)
  • — Oregon DOJ’s consumer‑facing materials on OCPA detail individual rights (access, correction, deletion, opt-out, universal opt-out) and special protections for children under 13, leading companies to adapt privacy notices, intake processes, and parental consent mechanisms to meet the law’s requirements[1]. (source)

Read the full guide to Oregon Consumer Privacy Act (OCPA)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates