Oregon Consumer Privacy Law
As announced on June 23, 2023, the Oregon Legislature passed Senate Bill 619 », a consumer privacy law (the “Oregon Consumer Privacy Act” or “the law”). Senate Bill 619 was developed by the Attorney General’s Consumer Privacy Task Force working with 150 consumer privacy experts and stakeholders to answer the call for comprehensive consumer privacy legislation. The Oregon Consumer Privacy Act (OCPA), ORS 646A.570-646A.589 », was signed into law by Governor Kotek and takes effect on July 1, 2024.
Press Release: Oregonians Gain Significant New Consumer Privacy Protections »
Scam Alert
New Rights? New Scammers: How to Protect Yourself from Privacy Scammers »
What is Privacy?
Privacy is broadly, the right to be left alone. Traditionally this means you have privacy in certain spaces, like your home. In the modern age, it also relates to control over information about you that companies collect. This is called data privacy.
Generally, any data that reveals information about you, as a person, is considered “personal data.” This could be a name, email address, home address, ISP, etc. Data that reveals private information about you, such as your race, ethnicity, religion, mental or physical health, sexuality, citizenship or immigration status, status as transgender or nonbinary, status as a crime victim, genetic or biometric data, or location data, is “sensitive data.” (Any data about children under 13 is also sensitive data.)
Historically, most people in the United States have had little control over their personal data. Some states like Oregon are changing this by giving power back to individual consumers.
What does the Oregon Consumer Privacy Act do for YOU?
It gives you different rights over your data!
Keep it L.O.C.K.E.D.! You can get a List of the specific entities that received your data or any data from a business. You can Opt-out (say “no”) to a business selling, profiling, and using targeted advertising with your personal information. You can get a Copy of the personal and sensitive data a business has about you. You can Know what information a business has collected about you. You can Edit any inaccuracies in the data about you. Finally, you can Delete personal and sensitive information businesses have about you.
Does my Business Need to Comply with the Oregon Consumer Privacy Act?
The OCPA has a threshold, meaning that certain only certain businesses must comply with the law. This is based on how much personal data a business has from Oregon consumers. The law applies to for- and non-profit businesses (non-profits have until July 1, 2025, to comply).
Some exemptions apply to businesses with certain types of data (ex: financial, protected health information). If you believe an exemption might apply to your business, make sure to consult your legal counsel and/or carefully read the full text of the law.
Report a Complaint Under the Oregon Consumer Privacy Act
Consumers wishing to file a report about a suspected violation of the Oregon Consumer Privacy Act can use our online complaint form. (Note, this is a complaint form specifically for the privacy law.)
After submitting a complaint, the complaint will be reviewed by a member of the Oregon Department of Justice’s consumer privacy team. The Department of Justice may follow up with the consumer for more information, refer the complaint to another government agency if that is most appropriate, or in some cases, follow-up with the business to pursue the complaint.
Why should I report? The Department of Justice enforces the OCPA. Your complaint may be used to monitor industry compliance or to inform an enforcement action. For us to do our job, we need to hear from you! Tell us about any issues you’re having with businesses concerning your new privacy rights.
If you have any questions, or aren’t sure your complaint is OCPA related, feel free to call the Consumer Hotline at 1-877-877-9392. The Attorney General’s Consumer Hotline is open from 8:30 a.m. to 4:30 p.m. and is staffed by dedicated volunteers who field more than 50,000 calls each year on various consumer issues.
Outreach & Education
FAQs – The Department of Justice has put together Frequently Asked Questions (FAQs) for consumers and businesses to help prepare for the privacy law.
Educational Handouts – The Department of Justice has put together some educational handouts targeted at both consumers and businesses to help them understand how this new privacy law works.
Templates & Checklists – The Department of Justice has also put together some checklists for businesses to simplify/help them streamline compliance with the OCPA. Additionally, the DOJ has prepared some templates for consumers to use when they are reaching out directly to a business to request their privacy rights.
For Consumers
For Businesses
Contact – If you have other questions that are not covered by the information above, please reach out to oregonprivacy@doj.oregon.gov.
Disclaimers – The information and resources contained on this website address select provisions of the OCPA. The published resources do not cover all potentially applicable laws or enforcement circumstances; the Civil Enforcement Division will make case-by-case enforcement determinations. The published resources do not implement, interpret, or make specific the law enforced or administered by the Department of Justice, establish substantive policy or rights, constitute legal advice, or reflect the views of the Attorney General.
The published resources do not provide any options for alternative relief or safe harbor from potential violations. The statute controls in the event of any conflicting interpretation. Businesses should consult the statute and/or an attorney before taking any action to ensure compliance with the law.