This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
header image


Oregon Consumer Privacy Act (OCPA)

Passed July 18, 2023
Effective Date July 1, 2024
Who it applies to

Entities that (1) do business in Oregon or provide products/services to Oregon residents; and (2) control/process data of 100,000+ Oregon consumers; or derive 25%+ revenue from selling data of 25,000+ consumers. Exempt entities include government agencies, public corporations, financial institutions as defined under the Bank Holding Company Act (BHCA), and nonprofits connected with insurance activities.

Penalties Up to $7,500 per violation

What’s notable about it:

It has a unique definition of personal data that includes "derived data," which is information or identifiers reasonably linked to a consumer. Make sure you check whether your business is covered under the OCPA’s long and complicated list of exemptions. While Oregon’s law applies relatively broadly, there are some oddly-specific carve-outs—for example, for nonprofits involved in insurance fraud or media programming.

The Strict Spectrum

Less Strict