As of July 1, Oregonians have gained significant new consumer privacy rights under the Oregon Consumer Privacy Act (OCPA). This law, enacted in July 2023 but now in effect, results from four years of work by the Attorney General’s Consumer Privacy Task Force, a group of over 150 experts.  

The OCPA offers broad definitions of personal and biometric data and provides comprehensive protections for consumer data. It empowers consumers with control over their data and mandates businesses to adhere to high standards. 

1. Right to Know: Consumers can request a list of entities that have received their personal data. 

2. Right to Correction: Consumers can correct inaccuracies in their data. 

3. Right to Deletion: Consumers can delete data held by businesses. 

4. Right to Opt Out: Consumers can refuse the sale, profiling, or targeted advertising using their data. 

5. Right to Data Portability: Consumers can obtain a copy of their personal data from businesses. 

The OCPA also introduces enhanced protections for sensitive data, which includes information on racial or ethnic background, health conditions, sexual orientation, and precise geolocation, among others. Businesses must obtain explicit consent before processing this data. Children and youth receive special protections. For children under 13, businesses must comply with the federal Children’s Online Privacy Protection Act (COPPA). For youth aged 13 to 15, businesses need "opt-in" consent for targeted advertising, profiling, or selling personal data. 

Attorney General Ellen Rosenblum highlighted the importance of the OCPA in keeping consumer protection laws up-to-date with technological advancements. She urged Oregonians to learn about their new rights and protections under the law. Businesses are required to be transparent about their data use, secure consumer consent for sensitive data collection, and protect children’s data. 

While some companies have already offered these protections, the OCPA now makes them mandatory. Not all businesses fall under this law, and certain industries with existing privacy regulations are exempt. However, for many Oregonians, the OCPA marks a significant step forward in managing and safeguarding personal data.