Oregon becomes the 12th state to pass comprehensive digital privacy legislation.

If signed by Governor Tina Kotek, the Oregon Consumer Privacy Act (OCPA) will give the state’s 4 million residents the right to opt out of online targeted ads starting next July.

Who does the law apply to?

The law applies to companies that conduct business in Oregon and control or process the personal data of 100,000 or more consumers. This, however, excludes the collection of personal data collected at the time of completing a payment transaction. It requires companies of 25,000 or more consumers and drive 25% or more of their annual revenue from the sale of personal data.

What are the companies required to do?

Such companies, under the law, will be required to seek residents’ opt-in consent before collecting sensitive data, such as race, ethnicity, health conditions, religion, sexual orientation, immigration status, precise location and biometric data.

What rights do consumers have?

Under the OCPA, Oregon residents have the right to know what personal data, including pseudonymous identifiers such as cookies, is collected about them and which third parties have access to that data.

The OCPA also allows consumers the right to correct inaccuracies in their data collected by companies, request deletion of their data and opt out of processing of personal data collected for sale or add targeting purposes.

And data controllers?

Oregon will join the ranks of California, Colorado, Connecticut and Montana in introducing a requirement for data controllers to adopt universal opt-out mechanisms effective from Jan. 1, 2026.

Those data controllers will be required to perform a data protection assessment for processing activities that pose an elevated risk of harm to consumers. This requirement encompasses the processing of sensitive personal data and personal data used for targeted advertising, selling or profiling when specific foreseeable risks exist.

Who can enforce the law?

The law tasks the Attorney General’s office for enforcement, and the bill contains no private right of action where residents are allowed to sue over violations.

A federal privacy bill was stalled in Congress last year. States like New York and Massachusetts are working on emulating that bill. To that, the adland grapples to navigate compliance challenges that come with the patchwork of state-level laws. And requests from people to modify or delete their data held by companies are on the rise.