--- title: "Oregon privacy law (OCPA): sensitive data" canonical: "https://dposchool.com/state-privacy-laws/state/oregon/sensitive-data" source: "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Oregon Consumer Privacy Act # Oregon privacy law (OCPA): sensitive data Law as of October 28, 2026 ยท [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Sensitive data includes racial or ethnic background, national origin, religious beliefs, health, sexual orientation, transgender or nonbinary status, status as a crime victim, citizenship or immigration status, a child's data, precise geolocation and genetic or biometric data. Processing it requires prior consent, and a known child's data must follow COPPA. Since 1 January 2026 a controller may not sell precise geolocation data or the data of a consumer it knows (or wilfully disregards) is under 16, and may not use such a consumer's data for targeted advertising or significant profiling, even with consent. ## Key points 1. Broad sensitive data list, including transgender or nonbinary status, crime-victim status and national origin. Section: [ORS 646A.570(18)(a)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html) 2. Precise geolocation means location within a radius of 1,750 feet. Section: [ORS 646A.570(18)(a)(C)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html) 3. Prior consent needed for sensitive data; a known child's (under 13) data must be processed under COPPA. Section: [ORS 646A.578(2)(b); ORS 646A.570(5)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html) 4. No targeted advertising or significant profiling of consumers known or wilfully disregarded to be under 16 (from 1 January 2026). Section: [ORS 646A.578(2)(c)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html) 5. No sale of personal data of consumers known or wilfully disregarded to be under 16 (from 1 January 2026). Section: [ORS 646A.578(2)(d)(A)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html) 6. No sale of precise geolocation data (from 1 January 2026), with carve-outs for communications content and utility metering data. Section: [ORS 646A.578(2)(d)(B)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html) 7. Consent cannot be obtained through interfaces that impair choice; inaction is not consent. Revocation must stop processing within 15 days. Section: [ORS 646A.570(6); ORS 646A.578(1)(d)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html) ## Sources - [ORS chapter 646A (2025 edition), ORS 646A.570 to 646A.589 with notes](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html) - [Oregon Laws 2025, chapter 251 (HB 2008)](https://www.oregonlegislature.gov/bills_laws/lawsstatutes/2025orLaw0251.pdf) [Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Oregon statute](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html) Reference material, not legal advice. ## Other topics for Oregon - [Applicability](https://dposchool.com/state-privacy-laws/state/oregon/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/oregon/consumer-rights) - [Controller duties](https://dposchool.com/state-privacy-laws/state/oregon/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/oregon/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/oregon/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Oregon](https://dposchool.com/state-privacy-laws/state/oregon) / Sensitive data Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/oregon/consumer-rights) Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/oregon/controller-duties) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents