Governance, risk & compliance
Oregon Consumer Privacy Act (OCPA) ORS 646A.570 to 646A.589 (as amended 2025)
The Oregon Consumer Privacy Act (ORS 646A.
570 to 646A. 589, 2023 c.
369 as amended), operative 1 July 2024. It applies to a person that does business in Oregon or serves its residents and handles the data of at least 100,000 consumers, or at least 25,000 consumers while earning 25% or more of gross revenue from sale; motor vehicle manufacturers are covered whatever their size.
It has no general exemption for nonprofits (501(c)(3) nonprofits have been covered since 1 July 2025). Consumers can learn the categories of data and optionally the specific third parties, get a copy of all their personal data, correct, delete, and opt out of targeted advertising, sale and profiling, with a 45-day response and a 45-day appeal.
Controllers must honour consent revocation within 15 days, honour an opt-out signal from 1 January 2026, avoid targeted advertising, profiling and sale for consumers under 16, not sell precise location data, and keep assessments for five years. The Attorney General alone enforces with penalties up to $7,500 per violation; the general cure period ended on 1 January 2026.
Not verified: (1) The end of the general cure period on 1 January 2026 is inferred from the Act’s operative dates; it was not stated in a single sentence. (2) The effective date of the 2025 c.
251 ban on selling precise location data was not read. (3) Whether the 2025 c.
163 motor vehicle manufacturer provisions are operative as of today was not checked beyond the ORS text read. General information for compliance work, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses Oregon Consumer Privacy Act (OCPA) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Controller | A person that, alone or jointly with others, determines the purpose and means of processing personal data and meets the applicability test in 646A.572 (100,000 consumers, or 25,000 with 25% of revenue from sale). Carries the notice, consumer rights, consent, security, assessment and enforcement duties. | — |
| Processor | A person that processes personal data on behalf of a controller (646A.581). Must follow the controller’s instructions, help with consumer requests and security, give assessment information, bind its people and subcontractors, and delete or return data at the end of the service. A processor that decides purposes and means is treated as a controller. | — |
How Lavawall® helps you get to Oregon Consumer Privacy Act (OCPA) compliance
Most of Oregon Consumer Privacy Act (OCPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Oregon Consumer Privacy Act (OCPA), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against Oregon Consumer Privacy Act (OCPA) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports Oregon Consumer Privacy Act (OCPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- Oregon Consumer Privacy Act (OCPA) ORS 646A.570 to 646A.589 (as amended 2025)
- Category
- Privacy
- Region
- USA - Oregon
- Levels
- 2 assessment tiers
All Oregon, United States frameworks and training →
Map this framework freeTalk to our team