DPO SchoolDPO School

Oregon Consumer Privacy Act

Oregon privacy law (OCPA): controller duties

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Controllers must state express purposes, limit collection to what is adequate, relevant and reasonably necessary, and apply the security safeguards of ORS 646A.622. The privacy notice must list categories of data and sensitive data, purposes, rights and appeals, data shared and detailed categories of third parties, a monitored contact, the controller's registered and assumed business names, and opt-out procedures. Data protection assessments are required for heightened-risk processing from 1 July 2024 and kept five years; opt-out preference signals must be honored from 1 January 2026.

Key points

  1. Purpose specification and data minimisation (adequate, relevant and reasonably necessary).

    Section: ORS 646A.578(1)(a), (b)

  2. Security: same safeguards as required for personal information under ORS 646A.622.

    Section: ORS 646A.578(1)(c)

  3. Privacy notice contents, including third-party categories described in detail and the controller's registered and assumed business names.

    Section: ORS 646A.578(4)

  4. Clear and conspicuous opt-out link to a webpage.

    Section: ORS 646A.578(5)(b)

  5. Opt-out preference signals for sale and targeted advertising must be honored (operative 1 January 2026).

    Section: ORS 646A.578(5)(c); 2023 c.369 § 15(2)

  6. Data protection assessments for targeted advertising, sensitive data, sale and risky profiling; processing on and after 1 July 2024; kept at least five years.

    Section: ORS 646A.586(1), (5), (6)

  7. No discrimination for exercising rights; bona fide loyalty programs allowed.

    Section: ORS 646A.578(2)(e), (3)

Sources

Compare controller duties across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Oregon statute

Reference material, not legal advice.