Attorney General Dan Rayfield has published a report detailing the initial six months of Oregon's Consumer Privacy Act. This legislation, effective since July, aims to give individuals and families control over their personal data, which can include home addresses, browsing history, and mental health information.
"This law gives people and families the ability to manage their personal information, and have it removed from websites," stated Rayfield. "We’re already seeing real results and we’ll continue pushing to make sure companies respect these rights and that every Oregonian has the control they deserve over their own data."
The Privacy Unit within the Civil Enforcement Division at Oregon DOJ received 110 complaints by early 2025. This number is significant compared to other states of similar size. For instance, Connecticut reported only 30 complaints in the first six months after its privacy law took effect.
Most complaints involved online data brokers, particularly websites offering background reports for a fee and social media or technology platforms. The primary issue was denied requests for deleting personal information.
In response to these issues, the Privacy Unit initiated and closed 21 privacy matters over six months by sending notices of violation or "cure notices" along with broader information requests to companies.
Common deficiencies noted in cure notices included lacking disclosures about consumer rights under OCPA, inadequate explanations regarding third-party data sales, confusing privacy notices not clear to average consumers, and burdensome mechanisms for exercising rights such as opting out or requesting privacy rights.
The OCPA allows companies a 30-day period to address identified violations. Responses so far have been positive with most companies updating privacy notices or improving consumer rights mechanisms promptly after contact from the Privacy Unit.
Starting July 1, 2025, nonprofits will also be required to comply with OCPA regulations. The Privacy Unit has begun outreach efforts with some of Oregon’s nonprofits and is preparing specific support materials for them on the Consumer Privacy Webpage.
In January, Oregon DOJ introduced a new toolkit including handouts and social media content aimed at helping residents protect their online information. If businesses fail to respond when individuals request removal of their information, affected parties can submit a complaint form.