---
title: "Oregon privacy law (OCPA): controller duties"
canonical: "https://dposchool.com/state-privacy-laws/state/oregon/controller-duties"
source: "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Oregon Consumer Privacy Act

# Oregon privacy law (OCPA): controller duties

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Controllers must state express purposes, limit collection to what is adequate, relevant and reasonably necessary, and apply the security safeguards of ORS 646A.622. The privacy notice must list categories of data and sensitive data, purposes, rights and appeals, data shared and detailed categories of third parties, a monitored contact, the controller's registered and assumed business names, and opt-out procedures. Data protection assessments are required for heightened-risk processing from 1 July 2024 and kept five years; opt-out preference signals must be honored from 1 January 2026.

## Key points

1. Purpose specification and data minimisation (adequate, relevant and reasonably necessary).

   Section: [ORS 646A.578(1)(a), (b)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

2. Security: same safeguards as required for personal information under ORS 646A.622.

   Section: [ORS 646A.578(1)(c)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

3. Privacy notice contents, including third-party categories described in detail and the controller's registered and assumed business names.

   Section: [ORS 646A.578(4)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

4. Clear and conspicuous opt-out link to a webpage.

   Section: [ORS 646A.578(5)(b)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

5. Opt-out preference signals for sale and targeted advertising must be honored (operative 1 January 2026).

   Section: [ORS 646A.578(5)(c); 2023 c.369 § 15(2)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

6. Data protection assessments for targeted advertising, sensitive data, sale and risky profiling; processing on and after 1 July 2024; kept at least five years.

   Section: [ORS 646A.586(1), (5), (6)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

7. No discrimination for exercising rights; bona fide loyalty programs allowed.

   Section: [ORS 646A.578(2)(e), (3)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

## Sources

- [ORS chapter 646A (2025 edition), ORS 646A.570 to 646A.589 with notes](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)
- [Oregon Department of Justice, Privacy page](https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/)

[Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Oregon statute](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

Reference material, not legal advice.

## Other topics for Oregon

- [Applicability](https://dposchool.com/state-privacy-laws/state/oregon/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/oregon/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/oregon/sensitive-data)
- [Processors](https://dposchool.com/state-privacy-laws/state/oregon/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/oregon/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Oregon](https://dposchool.com/state-privacy-laws/state/oregon) / Controller duties

Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/oregon/sensitive-data)

Next: [Processors](https://dposchool.com/state-privacy-laws/state/oregon/processors)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents