As of July 1, Oregonians have gained a new set of consumer privacy rights and protections under the Oregon Consumer Privacy Act (OCPA). The law, signed in July 2023, was developed by the Attorney General’s Consumer Privacy Task Force over four years. This group comprised over 150 experts and stakeholders who consulted with business and civic leaders to study best practices from other states.
The OCPA defines personal and biometric data broadly, providing comprehensive protection for consumer data rights. It also imposes stringent standards on companies that handle this data. The Act grants consumers control over their personal information, including the right to manage and safeguard it.
Attorney General Ellen Rosenblum commented, “As technology advances, our consumer protection laws must keep pace. The OCPA does just that—providing the gold standard in consumer privacy protections nationwide.” She expressed gratitude to those involved in the task force, the legislature for passing the law, and the Governor for signing it.
Under the OCPA, consumers have several key rights:
- **Right to Know**: Consumers can obtain a list of entities that have received their personal data.
- **Right to Correction**: Consumers can correct inaccuracies in their data.
- **Right to Deletion**: Consumers can delete their data held by businesses.
- **Right to Opt Out**: Consumers can refuse the sale or use of their data for targeted advertising.
- **Right to Data Portability**: Consumers can receive a copy of their personal and sensitive data.
- **Sensitive Data Protections**: Heightened protections are provided for sensitive personal data.
- **Special Protections for Youth**: Enhanced protections apply to children under 13 years old and require "opt-in" consent for certain uses of data from youths aged 13 to 15.
Businesses are now legally required to provide these protections, which include clear privacy notices and easy contact methods. They must limit data collection appropriately, be transparent about data usage, secure consent before collecting sensitive information, and protect children's data.
The Act has specific thresholds that not all businesses meet and exempts certain industries regulated by other frameworks. To assist consumers and businesses in understanding the law, detailed information is available on the OCPA website.
The Oregon Department of Justice (DOJ) encourages anyone with concerns about potential violations of their privacy rights to submit a complaint form on the OCPA website. For further questions or uncertainties regarding complaints related to OCPA, consumers can call the DOJ Consumer Hotline at 1-877-877-9392.