Oregon Data Privacy: A Plain-Language Overview
Oregon Consumer Privacy Act (OCPA)
Status: Effective July 1, 2024; enforceable by the Attorney General.
Oregon passed a comprehensive consumer privacy law similar to those in other states, granting residents the right to access, delete, and opt-out of the sale of their data. It places restrictions on the use of sensitive personal information and requires businesses to ensure data protection. Enforcement is handled exclusively by the state Attorney General, rather than through a private right of action.
Rights residents generally have
- access (know what data is collected and how it is used)
- delete (remove personal data)
- correct (fix inaccurate personal data)
- opt-out of the sale of personal data
- opt-out of targeted advertising
- data portability (receive a copy of data in a usable format)
- appeal if a request is denied
Who it generally applies to
Applies to for-profit entities that do business in Oregon and handle personal data of 100,000+ consumers (excluding payment transactions), or derive 25%+ of gross revenue from selling personal data and handle data of 25,000+ consumers.
What this means for B2B outreach
The OCPA applies to 'consumer' data, largely excluding data about individuals acting as employees or contractors of a business. However, business contact information (like a work email) used for a commercial purpose is generally exempt, while personal communications used for marketing may still fall under scope.
Authoritative source: Oregon Department of Justice (Attorney General). Always confirm current requirements there.
Marketing that respects privacy by design
We run permission-based, compliance-minded campaigns with real opt-out handling.
Talk to us