DPO SchoolDPO School

Oregon Consumer Privacy Act

Oregon privacy law (OCPA): enforcement

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Attorney General has exclusive enforcement authority, may serve investigative demands and may seek a civil penalty of up to $7,500 per violation, injunctions and fees. The general 30-day cure period ended on 1 January 2026. There is no private right of action, and actions must be brought within five years of the last violating act.

Key points

  1. Attorney General has exclusive authority; no private right of action.

    Section: ORS 646A.589(7)

  2. Investigative demands for testimony, interrogatories and documents, including assessments.

    Section: ORS 646A.589(1); ORS 646A.586(3)

  3. Civil penalty up to $7,500 per violation, plus injunction and fees for a prevailing Attorney General.

    Section: ORS 646A.589(4)

  4. 30-day cure for curable violations until 31 December 2025; afterwards only for certain noncommercial educational broadcast stations, and repealed on 1 July 2026.

    Section: 2025 c.417 §§ 5, 6 (note after ORS 646A.589)

  5. Five-year limitation period from the last act constituting the violation.

    Section: ORS 646A.589(5)

Sources

Compare enforcement across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Oregon statute

Reference material, not legal advice.