Meet OCPA consumer privacy obligations with less manual effort

The Oregon Consumer Privacy Act (OCPA) is Oregon's comprehensive consumer privacy law, codified at ORS 646A.570 to 646A.589. Passed as Senate Bill 619 in 2023, it gives Oregon residents rights to access, correct, delete and port their personal data and to opt out of targeted advertising, sale and significant profiling. It also requires controllers to publish privacy notices, minimise data, get consent for sensitive data and carry out data protection assessments.

The OCPA applies to any person that conducts business in Oregon or provides products or services to Oregon residents and, in a calendar year, controls or processes personal data of 100,000 or more consumers (excluding data used only to complete payments), or of 25,000 or more consumers while deriving 25 percent or more of annual gross revenue from selling personal data. Motor vehicle manufacturers are covered regardless of these thresholds. Unlike many state laws, it also covers non-profits.

The OCPA took effect for most businesses on 1 July 2024 and for non-profit organisations on 1 July 2025. Later provisions followed: the duty to honour universal opt-out preference signals and the 2025 ban on selling precise geolocation data and data of consumers under 16 both apply from 1 January 2026. Data protection assessment duties cover processing activities that occur on or after 1 July 2024.

The Oregon Attorney General can seek a civil penalty of up to $7,500 for each violation of the OCPA, as well as injunctions and other equitable relief. The Attorney General has exclusive enforcement authority and there is no private right of action. The 30-day cure period that applied to most controllers ended on 1 January 2026, so the Attorney General can now take action without first offering a chance to fix the problem.

A controller must respond to a consumer request without undue delay and within 45 days of receiving it. It may extend this by another 45 days where reasonably necessary, provided it tells the consumer within the first 45 days and explains why. Consumers get one free response in any 12-month period. Appeals against a refusal must also be decided within 45 days, with details of how to complain to the Attorney General if denied.

A data protection assessment is required for any processing that presents a heightened risk of harm to consumers. This includes targeted advertising, processing sensitive data, selling personal data and profiling that creates a reasonably foreseeable risk of unfair treatment, financial or reputational injury, or intrusion. Assessments must weigh benefits against risks, be kept for at least five years and be provided to the Attorney General on request during an investigation.

The OCPA shares many concepts with GDPR, including controllers and processors, data minimisation, consent for sensitive data, processor contracts and risk assessments, but it is an opt-out law for most processing rather than requiring a lawful basis. ISO 27001 and SOC 2 are not required by the OCPA, yet their security, vendor and access controls help demonstrate the reasonable safeguards and processor oversight the Act expects. A GDPR DPIA can satisfy the OCPA if reasonably similar in scope.

The OCPA is mapped in OneClickComply's control library and available on request; it is not yet a live framework in the product. On request, OneClickComply links its requirements to controls you already run for frameworks such as GDPR, ISO 27001 or SOC 2, so evidence for privacy notices, consumer requests, vendor contracts and security safeguards is reused. OneClickComply does not certify compliance or replace legal advice.