DPO SchoolDPO School

Oregon Consumer Privacy Act

Oregon privacy law (OCPA): applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The act covers persons doing business in Oregon, or providing products or services to residents, that in a calendar year control or process personal data of 100,000 or more consumers (payment-only data excluded), or 25,000 or more while deriving 25% or more of annual gross revenue from selling personal data. Since 26 September 2025 it also covers motor vehicle manufacturers and affiliates processing vehicle-use data, whatever the volume. Nonprofits are covered (501(c)(3) organizations from 1 July 2025); the GLBA exemption is data-level, with entity exemptions for financial institutions as defined by Oregon law and insurers.

Key points

  1. Threshold: personal data of 100,000 or more consumers in a calendar year, excluding payment-only data.

    Section: ORS 646A.572(1)(a)(A)

  2. Alternative threshold: 25,000 or more consumers and 25% or more of annual gross revenue from selling personal data.

    Section: ORS 646A.572(1)(a)(B)

  3. Motor vehicle manufacturers and affiliates processing data from use of a vehicle are covered regardless of thresholds (since 26 September 2025).

    Section: ORS 646A.572(1)(b)

  4. No general nonprofit exemption; 501(c)(3) organizations were covered from 1 July 2025. Only insurance-fraud nonprofits and certain noncommercial media activity are excluded.

    Section: ORS 646A.572(2)(r), (s); 2023 c.369 § 13

  5. GLBA: information handled under the GLBA is exempt at data level; financial institutions as defined in ORS 706.008 (and affiliates only engaged in financial activities) and insurers are exempt as entities.

    Section: ORS 646A.572(2)(k)(A), (L), (n)

  6. HIPAA: protected health information is exempt at data level; there is no general entity exemption for covered entities.

    Section: ORS 646A.572(2)(b)

  7. Public bodies are exempt; there is no general exemption for private higher education.

    Section: ORS 646A.572(2)(a)

  8. Employment-related data and people acting in a commercial or employment context are outside the act.

    Section: ORS 646A.570(7); ORS 646A.572(2)(i)

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Oregon statute

Reference material, not legal advice.