EffectiveOregon

Oregon Consumer Privacy Act

Data last verified: March 23, 2026

Effective Date
July 1, 2024
Enforcement Date
Not specified in statute

Summary

Oregon Consumer Privacy Act provides consumers the right to opt out of profiling for significant decisions and requires data protection assessments. Cure period expired January 1, 2026; AG now has full enforcement discretion.

Who It Applies To

100K+ consumers (excluding payment-only data), OR 25K+ consumers while deriving 25%+ gross revenue from data sales.

Min Consumers:
100,000

Any threshold triggers applicability

Penalties

Penalty Range
$0 – $7,500per violation
Cure Period
Not specified in statute
Private Right of Action
No private right of action
Enforcement Body
Oregon Attorney General

Requirements (2)

  • Opt-OutSB 619, Section 3(1)(d)(C)

    This law provides consumers the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.

  • Impact AssessmentSB 619, Section 8

    This law requires controllers to conduct data protection assessments for processing activities involving profiling, targeted advertising, sale of personal data, or sensitive data.

Claire tracks 31 state and local AI laws across 23 US states. No prescriptive federal AI compliance statutes have been enacted. EU AI Act and sector-specific regulations are not covered.

Check if this law applies to your business