OCPA requirements
Oregon's law has applied to businesses since July 1, 2024 and to nonprofits since July 1, 2025. It is notable for the breadth of its sensitive-data definition, which includes precise geolocation and status as transgender or nonbinary, and for a 2025 amendment that has banned the sale of precise geolocation data and of personal data about anyone under 16 since January 1, 2026. Controllers have had to honor universal opt-out signals since the same date. The Oregon Department of Justice enforces, and its first six-month report cited more than a hundred consumer complaints, many about opt-outs that did not work. The 30-day cure period expired at the end of 2025; penalties of up to $7,500 per violation now apply without a cure notice. Location-based advertising tags are the obvious exposure.
Other US State Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.