EdLaw nat/us/state/or/consumer-privacy/README.md

language: en · status: in-force · last checked: 2026-09-19

Oregon Consumer Privacy Act

Oregon's comprehensive consumer-privacy act, enacted by 2023 c.369 and amended by 2024 c.64 and 2025 c.251. The structure is the familiar one — consumer rights, controller duties, mandatory processor contract terms, data protection assessments, Attorney General enforcement — but three of its design choices differ from every other comprehensive act in this corpus, and all three matter to a vendor.

Applicability to EdTech

School districts are out; we are in. §646A.572(2)(a) excludes "a public body, as defined in ORS 174.109", which covers an Oregon school district. A vendor selling into one is in scope on the (1)(a) test.

The threshold counts consumers only, and there is no small-business escape. §646A.572(1)(a) applies the Act to any person conducting business in Oregon, or providing products or services to Oregon residents, that in a calendar year controls or processes the personal data of 100,000 or more consumers (excluding payment-transaction-only data), or 25,000 or more while deriving 25% or more of gross revenue from selling personal data. Unlike Texas, being a small business is not itself a way out.

The FERPA exemption is at the level of the data. §646A.572(2)(k)(C) exempts information collected, processed, sold or disclosed under and in accordance with FERPA. Student data handled as education records falls out; teacher accounts, consumer users, marketing contacts and telemetry outside FERPA do not.

The access right names third parties. §646A.574(1)(a)(B) lets a consumer obtain "a list of specific third parties, other than natural persons, to which the controller has disclosed" either that consumer's personal data or any personal data — the controller choosing which of the two lists to give. Every other act here stops at categories of third party. Answering it requires a disclosure register keyed to named recipients, which is a build item, not a policy item.

A child's personal data is sensitive data outright. §646A.570(18)(a)(B) makes any child's personal data sensitive — "child" being under 13 ((5)) — alongside genetic and biometric data ((18)(a)(D)) and precise location within 1,750 feet ((18)(a)(C)). Sensitive data may not be processed without consent, or, for a child, without processing in accordance with COPPA (§646A.578(2)(b)).

Under-16s get a separate, knowledge-based bar. Targeted advertising and profiling in furtherance of legal-effect decisions are prohibited where the controller has actual knowledge that, or willfully disregards whether, the consumer is under 16 (§646A.578(2)(c)), and selling such a consumer's personal data likewise ((2)(d)(A)). "Wilfully disregards" is the operative phrase: designing not to know is not a defence.

Biometric data is personal data generated by automatic measurements of biological characteristics — fingerprint, voiceprint, retinal pattern, iris pattern, gait — that allow or confirm unique identification (§646A.570(3)(a)). Photographs, audio and video recordings, data derived from them, and facial mapping or facial geometry are excluded only where they were neither generated for nor used for identifying a specific consumer ((3)(b)).

Key obligations at a glance

Enforcement

The Attorney General has exclusive authority, and the Act states in terms that neither it nor any other Oregon law creates a private right of action (§646A.589(7)). The civil penalty is up to $7,500 per violation (§646A.589(4)(a)), with a five-year limitation period running from the last act constituting the violation ((5)), and the Attorney General may recover attorney, expert-witness and investigation costs on prevailing. An investigative demand may require documents, testimony under oath and answers to interrogatories (§646A.589(1)(a)); data protection assessments are within its reach, as the confidentiality provision that follows says in terms ((3)(a)).

The right to cure is expiring. It never sat in the codified text: it lives in sections 4 to 6 of chapter 417, Oregon Laws 2025, reproduced as the Legislative Counsel's Note after §646A.589 in the fact document. Section 5 requires the Attorney General to give notice and 30 days to cure where the controller can cure — but from 1 January 2026 that duty applies only to a controller that is a noncommercial educational broadcast station meeting further conditions, and section 6 repeals section 5 outright on 1 July 2026. For every ordinary controller the cure period is already gone.

Contents

Document Covers
CONSUMER-PRIVACY.md ORS 646A.570 to 646A.589 in full — definitions, scope and exclusions, consumer requests and rights, the request and appeal process, controller duties and privacy notice, processor duties and contract terms, de-identified data, data protection assessments, and the Attorney General's investigative and enforcement powers — together with the uncodified 2025 c.417 §§4–6 note on notice and cure

The bare renumbering placeholders in the range (646A.575, .577, .580, .582, .585, .588) are reproduced as the chapter prints them, which is why the numbering skips.

Licence

The reproduced text is ORS 646A.570 to 646A.589, enacted by the Oregon Legislative Assembly and published by the Oregon Legislative Counsel Committee on oregonlegislature.gov. No copyright subsists in this text. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It went on: "judges—and, we now confirm, legislators—may not be considered the 'authors' of the works they produce in the course of their official duties as judges and legislators. That rule applies regardless of whether a given material carries the force of law." (slip opinion, pp. 1 and 5–6, read 2026-10-01.)

The chapter file carries no copyright notice (the builder's cached copy, checked 2026-10-01). The notes and bracketed source credits in it are written by Legislative Counsel, the Legislature's own staff, which the holding above also covers.

Public-domain text carries no conditions. The corpus attributes it all the same: the {.meta} provenance line on each section names the publisher, the Sources section links the official text, and the Meta section describes what the builder changed (markup and anchors only). Nothing here suggests that the Oregon Legislative Assembly endorses the corpus.

Sources