Privacy
Oregon Consumer Privacy Act (OCPA)
The OCPA applies to any person that conducts business in Oregon or provides products or services to Oregon residents and that, during a calendar year, controls or processes the personal data of 100,000 or more consumers, not counting data processed only to complete a payment transaction, or the personal data of 25,000 or more consumers while deriving 25 percent or more of annual gross revenue from selling personal data. Motor vehicle manufacturers and their affiliates are covered for vehicle data regardless of these thresholds.
What the website needs
- The privacy notice must list the categories of personal data processed, including sensitive data, the purposes, how consumers can exercise and appeal their rights, all categories of personal data shared with third parties, the categories of third parties described in enough detail to understand what each is, an actively monitored email address or online contact method, and the controller's business name as registered with the Secretary of State and any assumed name (ORS 646A.578(4)).
- The privacy notice must clearly describe any targeted advertising or profiling with legal or similarly significant effects and the procedure for opting out (ORS 646A.578(4)(h)).
- The controller must provide a clear and conspicuous link to a webpage where a consumer or authorized agent can opt out of targeted advertising, sale and certain profiling (ORS 646A.578(5)(b)).
- A controller may not process sensitive data without consent, may not use the data of a consumer it knows or willfully disregards is under 16 for targeted advertising or significant profiling, and may not sell such a consumer's data or data that locates a consumer or device within a radius of 1,750 feet (ORS 646A.578(2)).
