Law note · Oregon
Oregon Consumer Privacy Act (OCPA), general applicability and controller duties
OCPA governs private-sector processing of Oregon consumers' personal data. Enacted as S.B. 619 (2023 Regular Session), Or. Laws 2023, ch. 369, effective July 1, 2024 for most controllers; nonprofits were exempt from OCPA duties until January 1, 2026.
Two 2025 amendments, both effective January 1, 2026, are already reflected in the current codified text: H.B. 2008 added a precise-geolocation sale ban and a strict under-16 processing prohibition for targeted advertising, sale, and profiling; H.B. 3875 removed motor-vehicle manufacturers from the small-controller exemption.
What it asks of an app
- Confirm you conduct business in Oregon, or produce a product or service used by Oregon residents, and process or sell personal data before relying on OCPA's scope in compliance planning.
- Do not sell precise geolocation data or process a known Oregon minor's (under-16) data for targeted advertising, sale, or profiling; both are prohibited outright as of January 1, 2026.
- Do not rely on the small-controller exemption if you manufacture motor vehicles; that exemption no longer applies to motor-vehicle manufacturers as of January 1, 2026.
When LexLint raises it
Declared activities: automated_outreach, crawls_web, deploys_chatbot, processes_biometrics, processes_voice, trains_models
Primary source: official Oregon statute text, ORS 646A.570 to 646A.589, Oregon Revised Statutes