# Oregon — US state consumer data privacy laws: applicability thresholds by state

For Oregon, law name and abbreviation is Oregon Consumer Privacy Act (OCPA); effective date is July 1, 2024; consumer volume threshold is The personal data of 100,000 or more consumers, other than personal data controlled or processed solely for the purpose of completing a payment transaction; revenue-from-data-sales threshold is The personal data of 25,000 or more consumers, while deriving 25 percent or more of the person's annual gross revenue from selling personal data; threshold combination logic is OR — during a calendar year, controls or processes either threshold, recorded from its source on 2026-08-12.

- **State:** Oregon _(our reading, not quoted from the source)_
- **Law name and abbreviation:** Oregon Consumer Privacy Act (OCPA)
- **Effective date:** July 1, 2024
- **Consumer volume threshold:** The personal data of 100,000 or more consumers, other than personal data controlled or processed solely for the purpose of completing a payment transaction _(verified: appears in the quote below)_
- **Revenue-from-data-sales threshold:** The personal data of 25,000 or more consumers, while deriving 25 percent or more of the person's annual gross revenue from selling personal data
- **Threshold combination logic:** OR — during a calendar year, controls or processes either threshold
- **Key exemptions:** Public corporations and public bodies; HIPAA-covered entities; nonprofit organizations (exempt until July 1, 2025)
- **Enforcement mechanism:** Attorney General; exclusive authority; civil penalty; no private right of action
- **Statute citation:** Or. Rev. Stat. §§ 646A.570 to 646A.589
- **Notes:** Oregon does not exclude payment-only data processing from the data-sales threshold — only from the volume threshold. As of the 2025 amendments, the law also applies to motor vehicle manufacturers regardless of consumer volume thresholds. Oregon had the latest nonprofit exemption expiration (July 1, 2025) and includes a universal opt-out mechanism requirement effective January 1, 2026.

## What the source says

> ����� (20) �Third party� means a person, a public corporation, including the Oregon Health and Science University and the Oregon State Bar, or a public body, as defined in ORS 174.109, other than a consumer, a controller, a processor or an affiliate of a controller or processor. [2023 c.369 �1] ����� 646A.572 Scope and application; exclusions. (1)(a) ORS 646A.570 to 646A.589 apply to any person that conducts business in this state, or that provides products or services to residents of this state, and that during a calendar year, controls or processes: ����� (A) The personal data of 100,000 or more consumers, other than personal data controlled or processed solely for the purpose of completing a payment transaction;

## Source

- https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html

Last verified: 2026-08-12. Review by: 2026-11-10.
Part of [US state consumer data privacy laws: applicability thresholds by state](https://referencesource.org/state-data-privacy-applicability-thresholds/).