Oregon’s New Privacy Law Sparks 214 Complaints in First Year as Residents Demand Data Control

Transgression of the Oregon Consumer Privacy Act (OCPA) attracted 214 complaints during its first year, which, according to Attorney General Dan Rayfield, is a ‘significant number compared to other similarly sized states.’

The Law Gives Oregonians the Right to Control Their Personal Data

In a report-back, Rayfield says it is obvious ‘Oregonians care about their privacy rights.’ The OCPA became law last July and grants individuals and families the right to control their personal data, including their browsing history and residential addresses. Mental health issues are also protected.

Online data brokers attracted the most complaints, and 38 cases have been closed by the Privacy Unit, which sent notices of violation and requests for further information to companies. Rayfield says this gives companies the opportunity to address compliance issues before facing further action.

The OCPA instructs the Department of Justice (DOJ) to give companies that have transgressed the law, 30 days to rectify the situation before taking formal action.

Rayfield says the overall response has been positive, with most companies updating their privacy issues.

Businesses Must Adhere to the Compliance Laws

The DOJ advises businesses to adhere to compliance laws by disclosing any third parties, including the sale of consumer data to consumers.

Nonprofits will also have to adhere to the OCPA July 1 2025, and will incorporate all auto manufacturers that collect personal data from September 26.

The OCPA introduces further restrictions on January 1, 2026, when controllers will be banned from selling geolocation data and the data of children under the age of 16.

The DOJ Consumer Privacy website includes FAQs for nonprofits, as well as for businesses and consumers. The website also includes resources to protect personal data.