Jurisdiction

Oregon privacy and AI laws

Regulations

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Oregon OCPAComprehensive consumer privacy law with access (including a list of specific third parties data was shared with), correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, universal opt-out signals and data protection assessments. Unusually, it covers nonprofits. 2025 amendments ban selling precise geolocation data and data of consumers under 16, and bring all motor vehicle manufacturers into scope.In effect since Jul 1, 2024

Past deadlines

Takes effectJan 1 · 10 months ago · Source

Sale ban on precise geolocation and under-16 data (HB 2008)Selling precise geolocation (1,750-ft radius) and the personal data of consumers the controller knows or willfully disregards are under 16 is prohibited.

ComplianceJan 1 · 10 months ago · Source

Universal opt-out signals must be honoredControllers must honor opt-out preference signals such as Global Privacy Control.

EnforcementJan 1 · 10 months ago · Source

Cure period sunsetsThe AG's 30-day notice-and-cure requirement expires; enforcement can proceed without a cure opportunity.

Takes effectJul 1, 2025 · 16 months ago · Source

OCPA applies to nonprofitsNonprofit organizations meeting the thresholds become subject to OCPA.

Takes effectJul 1, 2024 · 2.3 years ago · Source

OCPA takes effect for most controllersOCPA obligations apply to for-profit controllers meeting the thresholds.