OCPA — The Oregon
Consumer Privacy Act

Oregon built privacy law the right way.

The Oregon Consumer Privacy Act (OCPA) became effective on July 1, 2024, after four years of development by the Oregon Attorney General's Consumer Privacy Task Force. That extended development process shows — OCPA contains several consumer protections that other state laws don't, including a full authorized-agent framework and the unique right to obtain a list of specific third parties that received your personal data.

The law is enforced exclusively by the Oregon Attorney General through the DOJ's Privacy Unit. In its first year (July 2024 - July 2025), the Privacy Unit received 214 consumer complaints and issued 38 cure letters — most concerning data brokers and the right to delete personal information. This is active, not theoretical, enforcement.

Your rights under OCPA

Who has to comply with OCPA

OCPA applies to individuals and entities that conduct business in Oregon or provide products/services to Oregon residents AND meet one of these thresholds:

• Control or process personal data of at least 100,000 consumers in a calendar year, OR
• Control or process personal data of 25,000+ consumers and derive over 25% of annual gross revenue from the sale of personal data

That second threshold is stricter than Virginia's 50% revenue requirement and matches Colorado's "any revenue from sales" broader test. Two additional coverage notes:

• Nonprofit coverage (effective July 1, 2025): Qualifying nonprofits became subject to OCPA a year after for-profits. Most state privacy laws exempt nonprofits entirely.
• Auto manufacturer rule (effective September 26, 2025): Auto manufacturers collecting personal data must comply with OCPA regardless of consumer volume. This closes a loophole exploited by connected-vehicle data collection.

Oregon's authorized-agent framework

OCPA explicitly allows consumers to designate an authorized agent to exercise opt-out rights on their behalf. Controllers must comply once they verify:

• The consumer's identity (with commercially reasonable effort)
• The agent's authority to act on behalf of the consumer

This framework is narrower than California's (which extends to all rights, not just opt-outs) but broader than Texas's (which recognizes only universal opt-out signals, not formal agent appointments). For consumers, it means services like ClickOff Shield can submit opt-out requests on your behalf with statutory backing.

Oregon vs. California: the most consumer-friendly after the original

After California, Oregon is arguably the most consumer-friendly state privacy jurisdiction. It has a full authorized-agent framework (unlike Texas or Virginia), a unique third-party transparency right, and the strongest minor protections. What it lacks is California's DROP centralized registry and dedicated privacy agency.

The most striking contrast: Oregon extended OCPA to nonprofits and auto manufacturers while most state laws exempt them. If you've wondered why some auto manufacturer privacy notices started changing in late 2025, that's the OCPA auto-manufacturer provision taking effect.

The first year of OCPA enforcement

Oregon's DOJ published its first annual enforcement report on August 29, 2025, covering the first year of OCPA enforcement. Key findings:

• 214 consumer complaints received by the Privacy Unit — a high volume for a state of Oregon's size
• 38 enforcement matters closed, each initiated by consumer complaints and resolved through the cure process
• Most complaints about data brokers — particularly "people search" sites that combine public records with purchased data to compile background profiles
• Right to delete was the most-requested and most-denied right, often due to controllers' self-help mechanisms not functioning properly for authorized agents
• Third-party list disclosure emerged as a major enforcement focus — the AG found many controllers weren't providing sufficient detail about specific third parties

The cure period expired January 1, 2026. From that date forward, the AG can pursue enforcement actions directly, without offering businesses a chance to fix violations first. Additional key dates going forward:

• January 1, 2026 — UOOM/GPC recognition required, minor data sale banned (under 16), precise geolocation sale banned entirely
• July 1, 2026 — Privacy notices must include information about universal opt-out signal methods

What OCPA still doesn't give you

Oregon's law is strong, but not perfect. Here's what OCPA does not give Oregon residents:

• No private lawsuits. Enforcement is AG-only. You cannot personally sue a controller for ignoring your OCPA request.
• No centralized delete system. Like every state except California, there's no "delete from all Oregon brokers" infrastructure.
• Authorized agent covers opt-outs, not full deletion rights. Your agent can submit opt-out requests for you. For deletion, access, or correction rights, you (or a verified agent with proper authorization) still need to submit individually.
• No dedicated privacy agency. Enforcement runs through the DOJ Privacy Unit rather than a specialized agency like California's CPPA. That means less rulemaking capacity and more reliance on consumer complaints.
• Self-help mechanism issues. Many controllers' online privacy forms don't work correctly for authorized-agent submissions. The DOJ flagged this as a common enforcement issue. Shield works around these technical issues with direct broker outreach.