---
title: "Oregon privacy law (OCPA): enforcement"
canonical: "https://dposchool.com/state-privacy-laws/state/oregon/enforcement"
source: "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Oregon Consumer Privacy Act

# Oregon privacy law (OCPA): enforcement

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

The Attorney General has exclusive enforcement authority, may serve investigative demands and may seek a civil penalty of up to $7,500 per violation, injunctions and fees. The general 30-day cure period ended on 1 January 2026. There is no private right of action, and actions must be brought within five years of the last violating act.

## Key points

1. Attorney General has exclusive authority; no private right of action.

   Section: [ORS 646A.589(7)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

2. Investigative demands for testimony, interrogatories and documents, including assessments.

   Section: [ORS 646A.589(1); ORS 646A.586(3)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

3. Civil penalty up to $7,500 per violation, plus injunction and fees for a prevailing Attorney General.

   Section: [ORS 646A.589(4)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

4. 30-day cure for curable violations until 31 December 2025; afterwards only for certain noncommercial educational broadcast stations, and repealed on 1 July 2026.

   Section: [2025 c.417 §§ 5, 6 (note after ORS 646A.589)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

5. Five-year limitation period from the last act constituting the violation.

   Section: [ORS 646A.589(5)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

## Sources

- [ORS chapter 646A (2025 edition), ORS 646A.570 to 646A.589 with notes](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)
- [Oregon Laws 2025, chapter 417 (SB 1121)](https://www.oregonlegislature.gov/bills_laws/lawsstatutes/2025orLaw0417.pdf)

[Compare enforcement across all states](https://dposchool.com/state-privacy-laws/topic/enforcement)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 83: General conditions for imposing administrative fines](https://dposchool.com/gdpr/article/83) (enforcement)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Oregon statute](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

Reference material, not legal advice.

## Other topics for Oregon

- [Applicability](https://dposchool.com/state-privacy-laws/state/oregon/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/oregon/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/oregon/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/oregon/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/oregon/processors)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Oregon](https://dposchool.com/state-privacy-laws/state/oregon) / Enforcement

Previous: [Processors](https://dposchool.com/state-privacy-laws/state/oregon/processors)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents