Oregon’s Consumer Data Privacy Act

Parents and guardians may exercise the rights on behalf of their children under the age of 13. Additionally, sensitive data of a child must be processed per the provisions of the Children's Online Privacy Protection Act (COPPA). For children ages 13 to 15, opt-in consent is required to process personal data for targeted advertising or sale.

The OCDPA applies to any entity that conducts business in Oregon or provides a product/service to Oregon residents and processes the personal data of at least 100,000 consumers or derives 25% or more of its annual gross revenue from selling the personal data of at least 25,000 consumers.

Under the OCDPA, a controller has 45 days to respond to a consumer’s request to exercise their rights, followed by a possible extension of 45 days more when reasonably necessary, owing to the complexity or volume of requests received.

The OCDPA does not allow for a private right of action.

The Oregon Attorney General’s Office is responsible for enforcing the OCDPA;

The Attorney General will provide a controller with a 30-day notice period in case of a possible violation. If the violation persists following this period, the AG may levy a fine of $7,500 in civil penalties per violation.

The law will take effect on July 1, 2024, with delays in enforcement and other applicable obligations for some entities until July 1, 2025.