The office of the Oregon Attorney General recently releases a six-month enforcement report regarding the Oregon’s Consumer Privacy Act (OCPA).
What are we discussing with our clients?
- There are lots of complaints (110 since the beginning of 2025); 21 privacy matters initiated and closed in last 6 months.
- Most of the complaints were about online data brokers.
- The number one right consumers have requested and been denied is the right to delete their information.
- Starting July 1, 2025, nonprofits will also be subject to the OCPA.
Main issues:
- Lacking disclosures (e.g., failure to incorporate notice of consumer rights under the OCPA).
- Inadequate disclosures (e.g., failure to sufficiently inform Oregon consumers about their rights under the law, specifically the list of third parties to whom their data has been sold).
- Confusing privacy notices (e.g., notices that are not clear or accessible to the average consumer); special emphasis on making it clear that Oregon is included in the privacy rights section (or not implying that it is not by naming other states and not Oregon).
- Lacking or burdensome rights mechanisms (e.g., failure to include a clear and conspicuous link to a webpage enabling consumers to opt out, request their privacy rights, or inappropriately difficult authentication requirements).