---
title: "Oregon privacy law (OCPA): consumer rights"
canonical: "https://dposchool.com/state-privacy-laws/state/oregon/consumer-rights"
source: "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Oregon Consumer Privacy Act

# Oregon privacy law (OCPA): consumer rights

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Consumers may confirm processing and the categories processed, obtain (at the controller's option) a list of specific third parties that received their data or any data, get a portable copy, correct, delete (including derived data and data from other sources), and opt out of targeted advertising, sale and significant profiling. Controllers answer within 45 days, extendable once by 45 days, and the first request in 12 months is free. Appeals must be decided within 45 days, with a route to the Attorney General on denial.

## Key points

1. Confirmation, categories processed, a copy of all personal data, and (at the controller's option) a list of specific third parties that received the consumer's data or any data.

   Section: [ORS 646A.574(1)(a)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

2. Correction, and deletion of data provided by the consumer, obtained from other sources and derived data.

   Section: [ORS 646A.574(1)(b), (c)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

3. Opt out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects.

   Section: [ORS 646A.574(1)(d)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

4. Portable, readily usable copy.

   Section: [ORS 646A.574(2)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

5. Response within 45 days, one 45-day extension with notice; first request in 12 months free.

   Section: [ORS 646A.576(5)(a), (c)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

6. Opt-out requests are honored without authentication, unless reasonably believed fraudulent.

   Section: [ORS 646A.576(5)(e)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

7. Appeal decided within 45 days, with written reasons and a way to complain to the Attorney General if denied.

   Section: [ORS 646A.576(6)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

8. Authorized agents, including browser or device signals, may opt out for the consumer.

   Section: [ORS 646A.576(4)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

## Sources

- [ORS chapter 646A (2025 edition), ORS 646A.570 to 646A.589 with notes](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

[Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access)
- [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion)
- [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Oregon statute](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

Reference material, not legal advice.

## Other topics for Oregon

- [Applicability](https://dposchool.com/state-privacy-laws/state/oregon/applicability)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/oregon/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/oregon/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/oregon/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/oregon/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Oregon](https://dposchool.com/state-privacy-laws/state/oregon) / Consumer rights

Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/oregon/applicability)

Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/oregon/sensitive-data)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents