Oregon Consumer Privacy Act: Your Rights

Oregonians can ask which specific entities received their data, and the law has stricter rules for sensitive categories.

By Siddharth ShankarUpdated October 24, 2026

Oregon’s privacy law includes a right that many other states do not highlight: asking a business for the specific entities that received your data. This guide follows the Oregon Department of Justice’s consumer FAQ.

When the law applies

The Oregon Consumer Privacy Act, or OCPA, applied to for-profit businesses from July 1, 2024 and to nonprofit entities from July 1, 2025. From January 1, 2026 it bans selling the precise geolocation data of Oregon consumers, and bans selling the personal data of consumers under 16 or using it for targeted advertising or profiling. The Department of Justice also notes that the law applies to all motor vehicle manufacturers and their affiliates from September 2025, regardless of how many Oregonians they serve.

Your rights

You can:

• access your personal data;
• know the specific entities that received your personal data, or any personal data from a business;
• correct inaccuracies;
• have your personal data deleted;
• obtain a copy of your personal data;
• opt out of certain processing, manually or through a universal opt-out signal.

How to make a request

Businesses must provide a privacy notice explaining how to make requests. They must also place opt-out links for targeted advertising, certain profiling and data sales on their website. You can designate an authorised agent to exercise opt-out rights, and the agent must use the method the business specifies. A parent or guardian can act for a child under 13, and a guardian or conservator can act for a person under their protection. You get one free request every 12 months, and additional requests may carry a reasonable fee.

Deadlines and appeals

Businesses must respond within 45 days, and can take an additional 45 days if they explain why. They may deny requests only for specified reasons, such as providing a requested product, issuing recalls, preventing fraud or complying with law. If a business denies your request, you may appeal. The appeal information should be in the business’s privacy notice. The business must respond to the appeal in writing within 45 days, and if it rejects the appeal, it must tell you how to contact the Oregon Attorney General.

Filing a complaint

Submit a complaint through the privacy complaint form on the Oregon DOJ website. For questions, you can call the Attorney General’s Consumer Hotline at 1-877-877-9392 (toll-free), 8:30 a.m. to 4:30 p.m., Monday to Friday. Private individuals cannot sue businesses under the law. Only the Attorney General can enforce it.

What the law does not cover

The Department of Justice says the law does not cover federal, state and local governments, or personal data collected or used in connection with employment, such as job applications or benefits paperwork. Certain businesses, such as banks, credit unions and insurance companies, are also outside it even if they meet the coverage thresholds. The page also notes that there is currently no reliable way to send a universal opt-out signal from mobile devices and apps.

How to use it well

1. Start with the privacy notice on the business’s website.
2. Say you are an Oregon resident and name the right you are using.
3. Ask for the list of entities that received your data if you want to see who it has been shared with.
4. Keep a record of your request and the date.
5. Appeal if refused, then complain to the Attorney General if needed.
6. Send an opt-out signal from your browser. See how to turn on Global Privacy Control.

Compared with other states

Rights and deadlines are similar in several states, but the details differ. Read Virginia, Connecticut, Colorado and Texas. For brokers, see how to opt out of data brokers.