Oregon data privacy and data broker removal

Oregon has both a comprehensive privacy law and a public data-broker registry, which puts it among the stronger states for privacy protections. Here is what that means for you and how to use it.

Your rights in Oregon

Oregon residents are protected by the Oregon Consumer Privacy Act (OCPA).

• Right to access and know. Request a copy of the personal information a company holds about you.
• Right to correct. Ask a company to fix inaccurate personal information.
• Right to delete. Ask a company to delete your personal information.
• Right to data portability. Get your data in a portable format you can take to another service.
• Right to opt out of sale. Tell a company to stop selling your personal information.
• Right to opt out of targeted advertising. Stop companies from targeting ads at you based on your personal data.
• Right to opt out of profiling. Stop companies from building a behavioral profile about you.
• Right to a list of specific recipients. Ask for the names of the specific third parties a company shared your data with. Most state laws only require the categories, so this one is stronger than usual.
• Right to appeal. Challenge a company's decision to deny your privacy request.

Does this cover the company that has my data?

Most companies that collect or sell personal data in Oregon are covered. The law applies to a business that handles the personal data of 100,000 or more Oregon consumers, or 25,000 or more consumers if it makes at least a quarter of its revenue from selling personal data. As of July 1, 2025, it reaches many nonprofits too.

How to remove yourself from data brokers in Oregon

Oregon gives you more tools than most states. Here is how to use them, ordered from strongest to most practical.

1. Use the data-broker registry

Oregon requires data brokers to register with the state. The public registry lets you see exactly which companies are collecting and selling your information, and gives you a starting point for opt-out requests. Unlike California, Oregon does not yet offer a single-request deletion mechanism, so you will need to contact each broker separately.

2. Enable Global Privacy Control

Global Privacy Control is a free browser setting that automatically tells every website you visit not to sell or share your data. It takes two minutes to enable and works quietly in the background on every site. As of January 1, 2026, Oregon law requires covered businesses to honor it, so this is not just a request. It carries legal weight.

3. Submit direct opt-out requests

For brokers not covered by the registry or GPC, you can submit requests directly. Look for the "Do Not Sell My Personal Information" link in a company's website footer; most major brokers have one. You can also submit formal access, deletion, or correction requests through each company's privacy policy page.

Under Oregon's law, covered companies must respond within the statutory deadline. If they don't, you have grounds to file a complaint with the Oregon Attorney General.

4. Automate ongoing removal

Here is the part nobody tells you: even after you finish every step above, brokers pull your information back in from public records, data-sharing networks, and commercial databases. Within a few months, your profiles reappear. Staying removed is not a one-time task. It is ongoing work that is hard to keep up by hand.

Oregon's data broker law: what it means for you

Under House Bill 2052, data brokers have to register with the state. The public registry gives you a clear view of who is collecting and selling your information, and a starting point for opt-out requests.

• Registration became mandatory on January 1, 2024. A broker must register before collecting, selling, or licensing personal data in Oregon.
• Brokers pay a $600 fee for registration and annual renewal.
• The public registry is run by the Oregon Division of Financial Regulation (linked in Sources below).
• There is no single-request deletion mechanism, so you contact each registered broker individually to opt out or delete. California is the only state that currently offers one.

Other privacy protections in Oregon

Beyond the comprehensive privacy law, Oregon has other protections that may apply to you:

• Address Confidentiality Program. Run by the Oregon Department of Justice, it gives survivors of domestic violence, stalking, and sexual assault a substitute address to keep their real one out of public records.
• Protections for minors. A company that knows a consumer is under 16 needs consent before using their data for targeted advertising, sale, or profiling.
• Biometric data. Oregon has no standalone biometric law you can sue under, but your biometric data counts as sensitive data under the OCPA, so a company needs your consent before collecting it.

How to file a privacy complaint in Oregon

Privacy complaints go to the Oregon Department of Justice, Consumer Protection, at doj.state.or.us/consumer-protection. For questions about the data-broker registry, contact the Division of Financial Regulation at dfr.ndp.licensing@dcbs.oregon.gov.

Most state agencies enforce privacy laws in the aggregate: they investigate patterns of violations rather than resolving individual disputes. Filing a complaint still matters. It creates a record that helps trigger enforcement.

Frequently asked questions

Sources

• oregonlegislature.gov
• dfr.oregon.gov
• dfr.oregon.gov (registry FAQs)
• doj.state.or.us