The office of the Oregon Attorney General recently releases a six-month enforcement report regarding the Oregon’s Consumer Privacy Act (OCPA).

What are we discussing with our clients?

• There are lots of complaints (110 since the beginning of 2025); 21 privacy matters initiated and closed in last 6 months.
• Most of the complaints were about online data brokers.
• The number one right consumers have requested and been denied is the right to delete their information.
• Starting July 1, 2025, nonprofits will also be subject to the OCPA.

Main issues:

• Lacking disclosures (e.g., failure to incorporate notice of consumer rights under the OCPA).
• Inadequate disclosures (e.g., failure to sufficiently inform Oregon consumers about their rights under the law, specifically the list of third parties to whom their data has been sold).
• Confusing privacy notices (e.g., notices that are not clear or accessible to the average consumer); special emphasis on making it clear that Oregon is included in the privacy rights section (or not implying that it is not by naming other states and not Oregon).
• Lacking or burdensome rights mechanisms (e.g., failure to include a clear and conspicuous link to a webpage enabling consumers to opt out, request their privacy rights, or inappropriately difficult authentication requirements).