Oregon Consumer Privacy Act

What it is

The Oregon Consumer Privacy Act, effective 1 July 2024 (1 July 2025 for nonprofits). Grants Oregon residents access, correction, deletion, portability, and opt-out rights. Distinctive for its 'right to know specific third parties' that have received the consumer's data and its broad coverage of nonprofit entities.

Why it matters

Civil penalties up to $7,500 per violation. The Oregon DOJ has set up a dedicated Privacy Unit to enforce the OCPA — coverage of nonprofits and the third-party-recipient transparency requirement together create a compliance bar a step beyond CCPA.

Who it applies to

Oregon residents — applies to controllers processing 100K+ Oregon consumers, or 25K+ where 25%+ of revenue is from selling personal data; nonprofits are included as of 1 July 2025.

• Jurisdictions: United States

How WQI scores it

Web Quality Index considers this standard satisfied when all of the 4 supporting factors pass.

0 of 4 supporting factors are currently collected. Sites where the remaining 4 haven't been measured will show as partial or unknown on this standard until the data lands.

Related standards

See also

CCPA , VCDPA , CPA , CTDPA , UCPA , TDPSA

Standards that share factors with this one

Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.

• Australian Privacy Act + APPs 3 shared factors Privacy Australia's federal privacy law, anchored on the 13 Australian Privacy Principles. The 2024 reforms added a statutory tort for serious privacy invasions and direct OAIC penalty powers.
• COPPA 3 shared factors Privacy If your site is directed at U.S. children under 13 — or you knowingly collect from them — you need verifiable parental consent before any data collection. The 2025 amendments tightened this further around third-party advertising.
• GDPR 3 shared factors Privacy If a single EU resident can see your site, GDPR can apply. Cookie consent, a real privacy policy, and not silently tracking by default are the visible signs of compliance.
• HIPAA 3 shared factors Privacy If your site collects, displays, or transmits protected health information, HIPAA applies. A privacy policy plus an explicit Notice of Privacy Practices and a clear consent flow are the minimum visible signals.
• LGPD 3 shared factors Privacy Brazil's GDPR analogue. If you serve Brazilian residents, treat it like GDPR-lite: lawful basis, consent for cookies, a real privacy policy, and ANPD-shaped data subject rights.

Other references

• regulation Oregon Legislature — SB 619 (OCPA)