Laws

Oregon Consumer Privacy Act (OCPA): your rights and how to use them

Quick answer

If you live in Oregon, the Oregon Consumer Privacy Act lets you see, correct and delete the personal data a covered business holds about you, get a list of the specific companies it gave your data to, and opt out of sales and targeted ads. Use the request method in the business's privacy notice. According to the Oregon Department of Justice, the business has 45 days to answer, and if it says no you can appeal and then complain to the DOJ.

“The Oregon Consumer Privacy Act (OCPA), ORS 646A.570-646A.589 ... was signed into law by Governor Kotek and takes effect on July 1, 2024.”

All privacy laws
Applies in
Oregon
In force since
Companies must answer within
According to the Oregon Department of Justice: 45 days from receiving your request, with up to 45 more days under certain conditions if the business tells you it needs the time and why. Appeals: 45 days.
Regulator
Oregon Department of Justice (Attorney General), Consumer Protection
Last updated

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: doj.state.or.us, dfr.oregon.gov

Last verified against the official page:

How we research this Report an error

Oregon residents. According to the Oregon Department of Justice, the law applies to businesses located in Oregon or targeting Oregonians that process the personal data of 100,000 or more Oregonians, or of 25,000 or more while getting at least 25% of their annual gross revenue from selling personal data. Since September 2025 it also covers motor vehicle manufacturers and their affiliates that process vehicle data. Some businesses, such as banks, credit unions and insurers, aren't covered.

Your rights

  • Access

    See the personal data a business has collected about you.

  • List of recipients

    Get a list of the specific companies that received your personal data from the business, or that received any personal data from it.

  • Correct

    Have inaccurate personal data fixed.

  • Delete

    Have your personal data deleted.

  • Get a copy

    Get a copy of your personal data. It's free once every 12 months.

  • Opt out

    Opt out of targeted advertising, the sale of your data and certain profiling, either by asking or with a universal opt-out signal. Businesses must honor qualifying signals since January 1, 2026.

  • Appeal

    Appeal a denial. The business must answer in writing within 45 days of getting your appeal.

General information, not legal advice.

How to use it

  1. 1

    Find the privacy notice

    A covered business has to explain in its privacy notice how to ask for deletion, correction, a copy or the list of recipients, and it has to link to an opt-out on its website.

  2. 2

    Send your request

    Use the method the notice gives. Say which right you're using, for example: "Under the Oregon Consumer Privacy Act, please delete the personal data you hold about me."

  3. 3

    Turn on Global Privacy Control for opt-outs

    Since January 1, 2026, businesses must honor universal opt-out signals such as Global Privacy Control. Turning it on in your browser opts you out of sales and targeted ads on sites you visit, without writing to each one.

  4. 4

    Use an agent for opt-outs if you want

    You can name an agent to opt out for you. Businesses don't have to accept agent requests for the other rights, so send deletion and access requests yourself.

  5. 5

    Wait up to 45 days

    The business must respond within 45 days. It can take 45 more days if it tells you why.

  6. 6

    Appeal a denial

    The appeal instructions should be in the privacy notice. The business must answer within 45 days, and if it rejects the appeal it has to tell you how to complain to the Oregon Attorney General.

  7. 7

    Complain to the Oregon DOJ

    Use the privacy complaint form on the Oregon DOJ consumer privacy page, or call the Consumer Hotline at 1-877-877-9392. A member of the DOJ privacy team reviews each complaint and may follow up with you, refer it to another agency, or contact the business. You can't sue under this law yourself: only the Attorney General enforces it.

No answer in time? Complain to Oregon Department of Justice (Attorney General), Consumer Protection .

Who has to follow the OCPA

The law took effect on July 1, 2024 for businesses and on July 1, 2025 for nonprofits. According to the Oregon Department of Justice, it covers businesses located in Oregon or targeting Oregonians that process the personal data of 100,000 or more Oregonians. A smaller business is covered too if it handles data on 25,000 or more Oregonians and gets at least 25% of its annual gross revenue from selling personal data.

Since September 2025 it also covers motor vehicle manufacturers and their affiliates that process vehicle data, whatever their size. Some businesses, such as banks, credit unions and insurers, fall outside it, and that's a common reason a request gets refused.

What changed on January 1, 2026

Three things. Businesses now have to honor universal opt-out signals such as Global Privacy Control. Selling precise geolocation data (accurate to within 1,750 feet) of any Oregon consumer is banned. Selling the personal data of anyone under 16 is banned too.

Oregon's data broker registry

Since January 1, 2024, data brokers that operate in Oregon have to register with the Division of Financial Regulation (DFR), part of the Department of Consumer and Business Services (DCBS). Registration costs $600 a year and expires on December 31.

The registry is how you find a broker's opt-out. DFR's consumer privacy resources page links to the DCBS license search: search by the broker's name or license number, or choose DFR-Data Broker or Data Broker to list them. Each company record shows its opt-out information.

People-search sites and public records

The DOJ is plain about the limit here. Data a people-search site bought can often be deleted, but data that's part of a public record can't be deleted from the site. Many sites offer an opt-out or suppression option for it instead, so use that.

About our sources

Everything on this page comes from the Oregon Department of Justice and DFR guidance, not from the statute text itself (ORS 646A.570 to 646A.589). If you need the exact legal wording, read the statute on the Oregon Legislature's site.

Where Serus fits

Oregon gives you strong rights, including the list of who got your data, but you still have to find each broker and send each request. Serus finds the data brokers that operate where you live, sends the opt-out and deletion requests for you, and checks whether your data comes back. The DOJ steps above are free if you'd rather do it by hand.

Data brokers that list people in United States

Each guide shows how to opt out of that site, step by step.

All data broker guides
Serus

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Related

Frequently asked

Can I sue a business under Oregon's privacy law?

No. Only the Oregon Attorney General can enforce the Oregon Consumer Privacy Act.

What happens after I file a complaint?

A member of the Oregon DOJ privacy team reviews it. They may follow up with you, refer it to another agency, or contact the business.

Is my location data protected in Oregon?

Yes. Since January 1, 2026, selling the precise geolocation data (accurate to within 1,750 feet) of any Oregon consumer is banned.

Do data brokers have to register in Oregon?

Yes. Since January 1, 2024, data brokers must register with the Division of Financial Regulation to collect, sell or license Oregonians' data. Registration costs $600 a year and expires on December 31.

How do I find a registered data broker's opt-out?

Search the DCBS license search by the broker's name or license number, or pick DFR-Data Broker or Data Broker to list them. The company record shows its opt-out information.

Can I get my data deleted from people-search sites?

Often, yes, for data the site bought. Data that comes from a public record can't be deleted from a people-search site, but many sites offer an opt-out or suppression option.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.