Oregon OCPA
Oregon Consumer Privacy Act (ORS 646A.570 to 646A.589)
The OCPA is Oregon's consumer privacy law, effective 1 July 2024. It is known for giving consumers the right to obtain a list of the specific third parties that received their data, and for covering nonprofits. HB 2008 (2025), effective 1 January 2026, banned the sale of precise geolocation data and of personal data of consumers known to be under 16.
Who it applies to
Persons conducting business in Oregon or providing products or services to Oregon residents that control or process the personal data of 100,000 or more consumers, or 25,000 or more consumers while deriving 25 percent or more of gross revenue from selling personal data. Motor vehicle manufacturers that process vehicle data are covered regardless of size.
Identity requirements
- Obtain consent before processing sensitive data, including biometric and genetic data, precise geolocation and status as transgender or nonbinary
- Obtain parental consent for children under 13 and opt-in consent for targeted advertising, sale or certain profiling of consumers aged 13 to 15
- Do not sell precise geolocation data or the data of consumers known to be under 16 (from 1 January 2026)
- Provide, on request, a list of the specific third parties to which personal data was disclosed
- Conduct data protection assessments for higher-risk processing and recognize universal opt-out signals
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Customer identity & consent (CIAM) | Sensitive-data consent and age-based restrictions must be applied at sign-up and in consent records. |
| Identity verification (KYC/proofing) | Biometric identity checks are sensitive data needing consent and an assessment. |
| Audit, logging & accountability | Controllers must be able to report the specific third parties that received each consumer's data, which depends on accurate disclosure logging. |
Penalties
The Attorney General may seek civil penalties of up to 7,500 dollars per violation and injunctive relief. The 30-day cure period expired on 1 January 2026.
Status and dates last verified against primary sources on 2026-10-31.
Oregon OCPA: frequently asked questions
- When did the Oregon Consumer Privacy Act take effect?
- It took effect on 1 July 2024. Amendments under HB 2008 took effect on 1 January 2026.
- What is unusual about the OCPA?
- It lets consumers obtain a list of the specific third parties that received their personal data, rather than only categories of recipients.