Oregon
Oregon Consumer Privacy Act (OCPA)
| Passed | July 18, 2023 |
| Effective Date | July 1, 2024 |
| Who it applies to |
Entities that (1) do business in Oregon or provide products/services to Oregon residents; and (2) control/process data of 100,000+ Oregon consumers; or derive 25%+ revenue from selling data of 25,000+ consumers. Exempt entities include government agencies, public corporations, financial institutions as defined under the Bank Holding Company Act (BHCA), and nonprofits connected with insurance activities. |
| Penalties | Up to $7,500 per violation |
What’s notable about it:
It has a unique definition of personal data that includes "derived data," which is information or identifiers reasonably linked to a consumer. Make sure you check whether your business is covered under the OCPA’s long and complicated list of exemptions. While Oregon’s law applies relatively broadly, there are some oddly-specific carve-outs—for example, for nonprofits involved in insurance fraud or media programming.