Oregon Consumer Privacy Act (SB 619, Oregon Laws 2023, chapter 369; ORS 646A.570 to 646A.589): profiling opt-out and data protection assessments

Summary

Oregon's comprehensive consumer privacy law, enacted as SB 619 (Oregon Laws 2023, chapter 369) and in force since July 1, 2024. It applies to persons doing business in Oregon or serving its residents that in a calendar year control or process personal data of 100,000 or more consumers (excluding data processed only to complete a payment), or of 25,000 or more consumers while deriving 25 percent or more of annual gross revenue from selling personal data. Information processed under the Gramm-Leach-Bliley Act is exempt at the data level. Consumers may opt out of profiling in furtherance of decisions that produce legal effects or effects of similar significance, defined to include decisions on financial or lending services, housing, insurance, education, criminal justice, employment, health care and essential goods and services. Controllers must conduct and document a data protection assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial, physical or reputational injury. The Attorney General has exclusive enforcement authority and may seek civil penalties of up to $7,500 per violation; there is no private right of action.

Key dates

1. July 18, 2023Enacted
2. July 1, 2024Takes effect
3. October 16, 2026Checked against sources
4. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. The Oregon Consumer Privacy Act (OCPA), ORS 646A.570-646A.589 » , was signed into law by Governor Kotek and takes effect on July 1, 2024.

   Supports: Name, codification, signature and effective date

   Consumer Privacy (Oregon Consumer Privacy Act) Oregon Department of Justice Primary source

2. Chapter Number: Chapter 369

   Supports: Session-law chapter

   SB 619, 2023 Regular Session, measure overview Oregon Legislative Information System Primary source

3. Sections 1 to 9 of this 2023 Act and the amendments to ORS 180.095 by section 10 of this 2023 Act become operative on July 1, 2024.

   Supports: Operative date

   Enrolled Senate Bill 619 (SB 619-B), 2023 Regular Session Oregon Legislative Assembly Primary source

4. On July 18, 2023, Oregon Governor Tina Kotek signed Senate Bill 619, referred to as the "Oregon Consumer Privacy Act"

   Supports: Signing date

   Oregon Becomes 11th State to Enact a Comprehensive Data Privacy Law Jones Day Reporting or analysis

5. The personal data of 100,000 or more consumers, other than personal data controlled or processed solely for the purpose of completing a payment transaction; or (B) The personal data of 25,000 or more consumers, while deriving 25 percent or more of the person’s annual gross revenue

   Supports: Applicability thresholds

   The Gramm-Leach-Bliley Act, P.L. 106-102, and regulations adopted to implement that Act

   Supports: GLBA data exemption

   means decisions that result in providing or denying financial or lending services, housing, insurance, enrollment in education or educational opportunity, criminal justice, employment opportunities, health care services or access to essential goods and services

   Supports: Decisions with legal or similar effects include financial or lending services

   “Profiling” means an automated processing of personal data for the purpose of evaluating, analyzing or predicting an identified or identifiable consumer’s economic circumstances

   Supports: Profiling definition

   (C) Profiling the consumer in furtherance of decisions that produce legal effects or effects of similar significance.

   Supports: Profiling opt-out (ORS 646A.574(1)(d))

   A controller shall conduct and document a data protection assessment for each of the controller’s processing activities that presents a heightened risk of harm to a consumer.

   Supports: Assessment duty (ORS 646A.586)

   Using the personal data for purposes of profiling, if the profiling presents a reasonably foreseeable risk of: (i) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (ii) Financial, physical or reputational injury to consumers

   Supports: Risky profiling is a heightened-risk activity

   The Attorney General may bring an action to seek a civil penalty of not more than $7,500 for each violation of ORS 646A.570 to 646A.589

   Supports: Penalty

   The Attorney General has exclusive authority to enforce the provisions of ORS 646A.570 to 646A.589.

   Supports: Attorney General enforcement; no private right of action follows in the same subsection

   ORS chapter 646A (2025 edition), sections 646A.570 to 646A.589 Oregon State Legislature (Oregon Revised Statutes) Primary source