Oregon Consumer Privacy Law
As announced on June 23, 2023, the Oregon Legislature passed Senate Bill 619 », a consumer privacy law (the “Oregon Consumer Privacy Act” or “the law”). Senate Bill 619 was developed by the Attorney General’s Consumer Privacy Task Force working with 150 consumer privacy experts and stakeholders to answer the call for comprehensive consumer privacy legislation. The Oregon Consumer Privacy Act (OCPA), ORS 646A.570-646A.589 », was signed into law by Governor Kotek and takes effect on July 1, 2024.
Press Release: Oregonians Gain Significant New Consumer Privacy Protections »
Scam Alert
New Rights? New Scammers: How to Protect Yourself from Privacy Scammers »
What is Privacy?
Privacy is broadly, the right to be left alone. Traditionally this means you have privacy in certain spaces, like your home. In the modern age, it also relates to control over information about you that companies collect. This is called data privacy.
Generally, any data that reveals information about you, as a person, is considered “personal data.” This could be a name, email address, home address, ISP, etc. Data that reveals private information about you, such as your race, ethnicity, religion, mental or physical health, sexuality, citizenship or immigration status, status as transgender or nonbinary, status as a crime victim, genetic or biometric data, or location data, is “sensitive data.” (Any data about children under 13 is also sensitive data.)
Historically, most people in the United States have had little control over their personal data. Some states like Oregon are changing this by giving power back to individual consumers.
What does the Oregon Consumer Privacy Act do for YOU?
It gives you different rights over your data!
Keep it L.O.C.K.E.D.! You can get a List of the specific entities that received your data or any data from a business. You can Opt-out (say “no”) to a business selling, profiling, and using targeted advertising with your personal information. You can get a Copy of the personal and sensitive data a business has about you. You can Know what information a business has collected about you. You can Edit any inaccuracies in the data about you. Finally, you can Delete personal and sensitive information businesses have about you.
Does my Business Need to Comply with the Oregon Consumer Privacy Act?
The OCPA has a threshold, meaning that certain only certain businesses must comply with the law. This is based on how much personal data a business has from Oregon consumers. The law applies to for- and non-profit businesses (non-profits have until July 1, 2025, to comply).
Some exemptions apply to businesses with certain types of data (ex: financial, protected health information). If you believe an exemption might apply to your business, make sure to consult your legal counsel and/or carefully read the full text of the law.
Report a Complaint Under the Oregon Consumer Privacy Act
Consumers wishing to file a report about a suspected violation of the Oregon Consumer Privacy Act can use our online complaint form. (Note, this is a complaint form specifically for the privacy law.)
After submitting a complaint, the complaint will be reviewed by a member of the Oregon Department of Justice’s consumer privacy team. The Department of Justice may follow up with the consumer for more information, refer the complaint to another government agency if that is most appropriate, or in some cases, follow-up with the business to pursue the complaint.
Why should I report? The Department of Justice enforces the OCPA. Your complaint may be used to monitor industry compliance or to inform an enforcement action. For us to do our job, we need to hear from you! Tell us about any issues you’re having with businesses concerning your new privacy rights.
If you have any questions, or aren’t sure your complaint is OCPA related, feel free to call the Consumer Hotline at 1-877-877-9392. The Attorney General’s Consumer Hotline is open from 8:30 a.m. to 4:30 p.m. and is staffed by dedicated volunteers who field more than 50,000 calls each year on various consumer issues.
Outreach & Education
FAQs – The Department of Justice has put together Frequently Asked Questions (FAQs) for consumers and businesses to help prepare for the privacy law.
Educational Handouts – The Department of Justice has put together some educational handouts targeted at both consumers and businesses to help them understand how this new privacy law works.
- How to Protect Your Personal Data
- Consumer Handout
- Consumer L.O.C.K.E.D. Handout
- Protecting Children’s Data Privacy in Oregon
- Business Handout
Templates & Checklists – The Department of Justice has also put together some checklists for businesses to simplify/help them streamline compliance with the OCPA. Additionally, the DOJ has prepared some templates for consumers to use when they are reaching out directly to a business to request their privacy rights.
For Consumers
For Businesses
Social Media Materials – Download by right clicking an image below to save it onto your desktop. Log on to your favorite social media site, such as Facebook or Instagram. Copy and paste one of the sample messages below into your status update—or create your own message. (For a larger image, first click on the image to open it in the lightbox.)
Know your privacy rights! The Oregon Consumer Privacy Act gives you more control over your personal and sensitive data. Under the new law, certain businesses must limit the collection of personal data, keep it secure, and provide extra protection for the data of children and teens.
Learn how to protect your data on the DOJ’s website: doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy.
Parents in Oregon have a powerful new tool to secure their children’s personal data: the Oregon Consumer Privacy Act. Special requirements for protecting the data of children and teens include:
Children under 13: Businesses must get consent from a parent or legal guardian before collecting, using or processing any personal data. All data about children under 13 is considered sensitive.
Teens 13-15: Businesses can’t use the data of consumers under 16 for targeted ads or certain types of profiling without permission. Teens 13-15 can deny permission themselves.
Learn more about how to protect your child’s data on the DOJ website: doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy.
Oregon businesses must provide detailed information to consumers about their data practices and protect personal data in new ways under the Oregon Consumer Privacy Act. The new law requires certain businesses to limit the collection of personal data, tell consumers how they use and secure that data, conduct data risk assessments, and provide extra protection for the data of children and teens.
Learn more about how to follow the law on the DOJ website: doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy.
Contact – If you have other questions that are not covered by the information above, please reach out to oregonprivacy@doj.oregon.gov.
Disclaimers – The information and resources contained on this website address select provisions of the OCPA. The published resources do not cover all potentially applicable laws or enforcement circumstances; the Civil Enforcement Division will make case-by-case enforcement determinations. The published resources do not implement, interpret, or make specific the law enforced or administered by the Department of Justice, establish substantive policy or rights, constitute legal advice, or reflect the views of the Attorney General.
The published resources do not provide any options for alternative relief or safe harbor from potential violations. The statute controls in the event of any conflicting interpretation. Businesses should consult the statute and/or an attorney before taking any action to ensure compliance with the law.