Oregon Consumer Privacy Act (OCPA), sensitive-data consent and geolocation

OCPA applies to a person conducting business in Oregon, or providing products or services to Oregon residents, that during a calendar year controls or processes the personal data of 100,000 or more consumers, other than data processed solely to complete a payment transaction, or of 25,000 or more consumers while deriving 25 percent or more of gross revenue from selling personal data, with no separate dollar-revenue threshold of its own.

Sensitive data is defined to include a consumer's precise present or past location, accurate within a 1,750-foot radius, and genetic or biometric data, and a controller may not process sensitive data about a consumer without first obtaining the consumer's consent.

OCPA's own 'personal data' definition does carry a publicly-available-information exemption, and 'sensitive data' is itself defined as a subset of personal data, so the same exemption applies upstream to it: personal data does not include data that is lawfully available through federal, state, or local government records or through widely distributed media, or that a controller reasonably has understood to have been lawfully made available to the public by the consumer (ORS 646A.570(13)(b)).

This is narrower than a blanket public-availability exemption, since it does not cover data merely observable online that a scraper, rather than the consumer or a distributed-media outlet, is the one making public; scraped sensitive or personal data of unclear provenance should still be treated as covered unless one of those two specific showings applies.

Oregon amended OCPA in 2025 (HB 2008, reported signed by Governor Kotek June 3, 2025) to flatly ban selling a consumer's precise geolocation data effective January 1, 2026, a stricter rule than most peer states' consent-based approach; this amendment is reported by contemporaneous legal commentary and was not independently confirmed against HB 2008's own enrolled text in this research, so its effective date and exact mechanism should be treated as reported rather than machine-verified.

Enforcement is by the Attorney General only, with a civil penalty of up to $7,500 per violation and a cure period through 2026; OCPA carries no private right of action.