Law note · Oregon
Oregon Consumer Privacy Act, Attorney General enforcement
The Oregon Attorney General has exclusive authority to enforce OCPA; no other Oregon law creates a private right of action for a violation. Civil penalties run up to $7,500 per violation, and the statute of limitations is five years from the last violative act.
The cure opportunity was discretionary from the outset: the Attorney General may notify a controller of a violation only if the Attorney General determines the violation can be cured, and, per secondary reporting, that discretionary practice tightened further as of January 1, 2026.
What it asks of an app
- Expect OCPA violations to be enforced exclusively by the Oregon Attorney General, never by a private plaintiff.
- Do not assume a cure opportunity as of right. The Attorney General decides whether a violation is curable before offering notice, and may proceed directly to enforcement without a cure opportunity.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Oregon statute text, ORS 646A.570 to 646A.589, Oregon Revised Statutes