# Oregon

## [Oregon Consumer Privacy Act (OCPA)](https://olis.oregonlegislature.gov/liz/2023R1/Downloads/MeasureDocument/SB619/Enrolled)

|     |     |
| --- | --- |
| **Passed** | **July 18, 2023** |
| **Effective Date** | **July 1, 2024** |
| **Who it applies to** | Entities that (1) do business in Oregon or provide products/services to Oregon residents; and (2) control/process data of 100,000+ Oregon consumers; or derive 25%+ revenue from selling data of 25,000+ consumers. Exempt entities include government agencies, public corporations, financial institutions as defined under the Bank Holding Company Act (BHCA), and nonprofits connected with insurance activities. |
| **Penalties** | Up to $7,500 per violation |

### What’s notable about it:

It has a unique definition of personal data that includes "derived data," which is information or identifiers reasonably linked to a consumer. Make sure you check whether your business is covered under the [OCPA’s long and complicated list of exemptions](https://olis.oregonlegislature.gov/liz/2023R1/Downloads/MeasureDocument/SB619/Enrolled). While Oregon’s law applies relatively broadly, there are some oddly-specific carve-outs—for example, for nonprofits involved in insurance fraud or media programming.

The Strict Spectrum

Least Strict  
Less Strict  
Moderately Strict  
More Strict  
Most Strict

[continue reading](/content/resources/interactive/data-privacy-laws-by-state/rhode-island/index.html)