---
title: "Oregon privacy law (OCPA): applicability"
canonical: "https://dposchool.com/state-privacy-laws/state/oregon/applicability"
source: "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Oregon Consumer Privacy Act

# Oregon privacy law (OCPA): applicability

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

The act covers persons doing business in Oregon, or providing products or services to residents, that in a calendar year control or process personal data of 100,000 or more consumers (payment-only data excluded), or 25,000 or more while deriving 25% or more of annual gross revenue from selling personal data. Since 26 September 2025 it also covers motor vehicle manufacturers and affiliates processing vehicle-use data, whatever the volume. Nonprofits are covered (501(c)(3) organizations from 1 July 2025); the GLBA exemption is data-level, with entity exemptions for financial institutions as defined by Oregon law and insurers.

## Key points

1. Threshold: personal data of 100,000 or more consumers in a calendar year, excluding payment-only data.

   Section: [ORS 646A.572(1)(a)(A)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

2. Alternative threshold: 25,000 or more consumers and 25% or more of annual gross revenue from selling personal data.

   Section: [ORS 646A.572(1)(a)(B)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

3. Motor vehicle manufacturers and affiliates processing data from use of a vehicle are covered regardless of thresholds (since 26 September 2025).

   Section: [ORS 646A.572(1)(b)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

4. No general nonprofit exemption; 501(c)(3) organizations were covered from 1 July 2025. Only insurance-fraud nonprofits and certain noncommercial media activity are excluded.

   Section: [ORS 646A.572(2)(r), (s); 2023 c.369 § 13](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

5. GLBA: information handled under the GLBA is exempt at data level; financial institutions as defined in ORS 706.008 (and affiliates only engaged in financial activities) and insurers are exempt as entities.

   Section: [ORS 646A.572(2)(k)(A), (L), (n)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

6. HIPAA: protected health information is exempt at data level; there is no general entity exemption for covered entities.

   Section: [ORS 646A.572(2)(b)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

7. Public bodies are exempt; there is no general exemption for private higher education.

   Section: [ORS 646A.572(2)(a)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

8. Employment-related data and people acting in a commercial or employment context are outside the act.

   Section: [ORS 646A.570(7); ORS 646A.572(2)(i)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

## Sources

- [ORS chapter 646A (2025 edition), ORS 646A.570 to 646A.589 with notes](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)
- [Oregon Laws 2025, chapter 163 (HB 3875)](https://www.oregonlegislature.gov/bills_laws/lawsstatutes/2025orLaw0163.pdf)
- [Oregon Laws 2023, chapter 369 (SB 619)](https://www.oregonlegislature.gov/bills_laws/lawsstatutes/2023orLaw0369.pdf)

[Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Oregon statute](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

Reference material, not legal advice.

## Other topics for Oregon

- [Consumer rights](https://dposchool.com/state-privacy-laws/state/oregon/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/oregon/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/oregon/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/oregon/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/oregon/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Oregon](https://dposchool.com/state-privacy-laws/state/oregon) / Applicability

Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/oregon/consumer-rights)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents