Oregon (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Oregon Consumer Privacy Act (OCPA) | ORS 646A.570 to 646A.589 | In force | 1 July 2024 |
| Oregon Consumer Information Protection Act | ORS 646A.600 to 646A.628 | In force | 1 October 2007 |
| Data broker registration | ORS 646A.593 | In force | 1 January 2024 |
| Artificial intelligence companions (SB 1546) | Oregon Laws 2026, chapter 85 | Enacted, not yet in force | 1 January 2027 |
- Oregon Consumer Privacy Act (OCPA): Applies to non-profits from 1 July 2025. Car makers are covered from 26 September 2025 (Oregon Laws 2025, ch. 163), and selling precise geolocation data or the data of under-16s is banned from 1 January 2026 (Oregon Laws 2025, ch. 251, approved 3 June 2025).
- Oregon Consumer Information Protection Act: Data security and breach notification. In force from 1 October 2007 under § 18 of Oregon Laws 2007, ch. 759 (SB 583).
- Data broker registration: Operative from 1 January 2024 under § 3 of Oregon Laws 2023, ch. 395.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Applies to businesses that operate in Oregon or serve its residents and, in a year, process data of 100,000 or more consumers (not counting payment-only data), or of 25,000 or more while earning 25% or more of revenue from selling data. Non-profits are covered since 1 July 2025, and car makers that process vehicle data are covered whatever their size. Public bodies, insurers and GLBA and HIPAA data are exempt. Employees and B2B contacts aren’t consumers.
Sources: oregonlegislature.gov/bills_laws/ors/ors646A.html · oregonlegislature.gov/bills_laws/lawsstatutes/2025orLaw0163.pdf · doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-f…
Lawful bases
Section titled “Lawful bases”There are no GDPR-style lawful bases. Controllers give a privacy notice and honour rights to access, get a list of specific third parties that received data, correct, delete (including derived data), port data, and opt out of targeted advertising, sale and significant-decision profiling. Opt-in consent is needed for sensitive data, such as health, national origin, transgender or non-binary status, crime victim status, and precise geolocation. Selling precise geolocation data is banned since 1 January 2026.
Sources: oregonlegislature.gov/bills_laws/ors/ors646A.html · oregonlegislature.gov/bills_laws/lawsstatutes/2025orLaw0251.pdf · doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-f…
Consent age for online services
Section titled “Consent age for online services”A child is under 13, and a known child’s sensitive data must be handled under COPPA, with parental consent. Since 1 January 2026, if a controller knows or wilfully disregards that a consumer is under 16, it can’t sell their data or use it for targeted advertising or significant profiling, even with consent.
Sources: oregonlegislature.gov/bills_laws/ors/ors646A.html · doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-f…
Children
Section titled “Children”Children’s data is sensitive data, and the under-16 bans on sale, targeted advertising and significant profiling apply since 1 January 2026. From 1 January 2027, AI companion operators that know or have reason to believe a user is a minor must stop the companion claiming to be human or simulating romance, remind the user every three hours to take a break, and block sexual content.
Sources: oregonlegislature.gov/bills_laws/ors/ors646A.html · oregonlegislature.gov/bills_laws/lawsstatutes/2026orLaw0085.pdf
Cookies and similar technologies
Section titled “Cookies and similar technologies”There’s no cookie-consent rule. Consumers can opt out of targeted advertising and sale through a clear link, and since 1 January 2026 controllers must honour universal opt-out signals such as Global Privacy Control. Signals can’t be on by default.
Sources: doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-f… · oregonlegislature.gov/bills_laws/ors/ors646A.html
Electronic marketing
Section titled “Electronic marketing”Email marketing relies on federal CAN-SPAM, and calls and texts also follow the federal TCPA. Oregon adds limits for sales calls and texts. Stop when the person asks, call only between 8am and 8pm, make no more than three attempts in 24 hours without an existing business relationship, and never misrepresent who is calling or why. Sales calls to numbers on Oregon’s do-not-call list or the federal registry the Attorney General designates are banned and are an unlawful trade practice.
Sources: oregonlegislature.gov/bills_laws/ors/ors646.html
Breach notification
Section titled “Breach notification”Notify affected consumers in the most expeditious manner possible and no later than 45 days after discovering a breach. If more than 250 Oregon consumers are affected, notify the Department of Justice too, within the same 45 days. If more than 1,000, also tell the nationwide credit bureaus. Vendors must tell the business within 10 days.
Sources: oregonlegislature.gov/bills_laws/ors/ors646A.html · doj.state.or.us/consumer-protection/id-theft-data-breaches/data-breaches · oregonlegislature.gov/bills_laws/lawsstatutes/2007orlaw0759.html
Registration and fees
Section titled “Registration and fees”Data brokers that collect and sell or license brokered personal data about Oregon residents must register with the Department of Consumer and Business Services and pay a fee set by rule. Penalties are $500 per violation or day, up to $10,000 a year. The OCPA itself has no registration or fee.
Sources: oregonlegislature.gov/bills_laws/ors/ors646A.html · oregonlegislature.gov/bills_laws/lawsstatutes/2023orLaw0395.pdf
Data protection officer
Section titled “Data protection officer”There’s no requirement to appoint a data protection officer.
Sources: oregonlegislature.gov/bills_laws/ors/ors646A.html
International transfers
Section titled “International transfers”Oregon law sets no restrictions on transferring personal data abroad; federal rules are in us-federal.
Sources: oregonlegislature.gov/bills_laws/ors/ors646A.html
Impact assessments
Section titled “Impact assessments”Document a data protection assessment for each processing activity with a heightened risk of harm, including targeted advertising, sensitive data, sale and risky profiling. The Attorney General can require assessments relevant to an investigation and must keep them confidential.
Sources: oregonlegislature.gov/bills_laws/ors/ors646A.html
Automated decisions and AI
Section titled “Automated decisions and AI”Consumers can opt out of profiling for decisions with legal or similarly significant effects. From 1 January 2027, AI companion operators must say the user is talking to AI when it could be mistaken for a person, run a suicide and self-harm protocol that refers users to 988, and publish yearly reports. People harmed can sue for $1,000 per violation or actual damages.
Sources: oregonlegislature.gov/bills_laws/ors/ors646A.html · oregonlegislature.gov/bills_laws/lawsstatutes/2026orLaw0085.pdf
Penalties
Section titled “Penalties”The Attorney General enforces alone, with civil penalties up to $7,500 per violation and injunctions, and must sue within five years. The 30-day cure period ended for most controllers on 1 January 2026, and a narrow extension for some public broadcasters was repealed on 1 July 2026, so no controller has a right to cure now. There’s no private right of action.
Sources: oregonlegislature.gov/bills_laws/ors/ors646A.html
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-or.yaml.