Oregon Cybersecurity Laws You Should Know (2026)

Last Updated: August 27, 2026

Oregon cybersecurity laws require businesses to protect personal information, notify consumers after qualifying data breaches, and comply with one of the country’s more comprehensive state consumer privacy laws.

The Oregon Consumer Privacy Act (OCPA) gives Oregon residents substantial control over how businesses collect, process, sell, and share their personal data. Oregon also maintains specific data breach notification requirements that can require notification to affected consumers and the Oregon Attorney General.

Several important privacy requirements became effective in 2026, making this an especially important year for businesses to review their Oregon cybersecurity and privacy compliance programs.

Whether your organization is based in Oregon or simply collects personal information from Oregon residents, understanding these requirements can help reduce regulatory risk, improve cybersecurity practices, and strengthen consumer trust.

This guide explains the major Oregon cybersecurity laws businesses should understand in 2026.

Oregon Cybersecurity Laws at a Glance

Requirement	Summary
Primary Privacy Law	Oregon Consumer Privacy Act (ORS 646A.570 through 646A.589)
Primary Breach Law	Oregon Consumer Identity Theft Protection Act
Privacy Law Effective Date	July 1, 2024 for most businesses
Nonprofit Effective Date	July 1, 2025
Primary Regulator	Oregon Attorney General
Breach Notification Deadline	Generally no later than 45 days
Attorney General Breach Notification	Required when more than 250 consumers must be notified
Universal Opt-Out	Required beginning January 1, 2026
Precise Geolocation Sales	Prohibited beginning January 1, 2026

Oregon Cybersecurity Law Timeline

Year	Legislative Update
2007	Oregon established its Consumer Identity Theft Protection Act, including breach notification requirements.
2023	Oregon enacted Senate Bill 619, creating the Oregon Consumer Privacy Act.
July 1, 2024	The Oregon Consumer Privacy Act became effective for qualifying businesses.
July 1, 2025	The OCPA became applicable to qualifying nonprofit organizations.
September 2025	Oregon expanded OCPA coverage to qualifying motor vehicle manufacturers and affiliates regardless of normal consumer thresholds.
January 1, 2026	Universal opt-out requirements, stronger protections for consumers under 16, and restrictions on selling precise geolocation data became effective.
January 1, 2026	The OCPA’s general 30-day right-to-cure provision ended, increasing enforcement exposure for covered organizations.

The Oregon Department of Justice provides current guidance regarding these requirements through its Oregon Consumer Privacy resources.

Who Should Read This Guide?

This guide is particularly useful for:

• Technology companies
• Healthcare organizations
• Manufacturers
• Construction companies
• Retailers
• E-commerce companies
• Professional service firms
• Nonprofit organizations
• Automotive manufacturers
• SaaS companies
• Organizations collecting information from Oregon residents

Because the OCPA can apply to companies located outside Oregon, businesses should evaluate whether their data-processing activities meet Oregon’s statutory thresholds even if they have no physical office in the state.

What’s New With Oregon Cybersecurity Laws in 2026?

Oregon introduced several significant privacy changes on January 1, 2026.

Covered organizations must now recognize qualifying universal opt-out mechanisms, allowing consumers to use browser settings or similar technologies to automatically communicate that they do not want their information sold or used for targeted advertising.

Oregon also strengthened protections involving younger consumers. Beginning January 1, 2026, covered controllers generally may not sell the personal data of consumers they know are under 16 or process that information for targeted advertising or certain types of profiling.

Another major change involves location information. Oregon now prohibits covered businesses from selling consumers’ precise geolocation data, which Oregon defines using a geographic radius of 1,750 feet and includes both current and historical location information.

Finally, the OCPA’s general 30-day opportunity to cure violations sunset on January 1, 2026. The Oregon Attorney General therefore has greater flexibility to pursue enforcement without first giving most businesses an opportunity to correct the violation. Civil penalties can reach $7,500 per violation.

These changes make 2026 an important year for businesses to review privacy notices, consent mechanisms, advertising technologies, website tracking, consumer request procedures, and data governance practices.

Oregon Consumer Privacy Act

The centerpiece of Oregon privacy regulation is the Oregon Consumer Privacy Act, codified at ORS 646A.570 through 646A.589.

Official statute: Oregon Revised Statutes Chapter 646A

The Oregon Legislature passed Senate Bill 619 in 2023, and the law became effective for most covered businesses on July 1, 2024. Qualifying nonprofit organizations became subject to the law beginning July 1, 2025.

Unlike a traditional cybersecurity law that focuses mainly on what businesses must do following a breach, the OCPA regulates how organizations handle personal information throughout its lifecycle.

That includes:

• Collection
• Processing
• Storage
• Sale
• Targeted advertising
• Profiling
• Disclosure to third parties
• Consumer requests
• Sensitive data
• Data security

Businesses should therefore treat OCPA compliance as both a privacy and cybersecurity responsibility.

Which Businesses Must Comply With the Oregon Consumer Privacy Act?

The OCPA generally applies to organizations that conduct business in Oregon or provide products or services to Oregon residents and, during a calendar year:

1. Control or process personal data belonging to at least 100,000 consumers, excluding data processed solely for completing payment transactions, or
2. Control or process personal data belonging to at least 25,000 consumers while deriving more than 25% of annual gross revenue from selling personal data.

These same thresholds generally apply to qualifying nonprofit organizations.

The law contains exemptions for certain organizations and types of data, including some financial institutions and data regulated under other privacy frameworks.

Businesses should review the full statute rather than assuming that another regulatory obligation automatically exempts the entire organization.

Special Rules for Motor Vehicle Manufacturers

Oregon expanded the OCPA’s reach in 2025.

Beginning in September 2025, the law applies to motor vehicle manufacturers and certain affiliates that control or process personal data obtained from an Oregon consumer’s use of a motor vehicle regardless of whether the company meets the normal 100,000 or 25,000-consumer thresholds.

This is increasingly significant as modern vehicles collect information involving:

• Vehicle location
• Driving behavior
• Mobile device connections
• Entertainment systems
• Vehicle diagnostics
• Connected applications
• User profiles

Automotive manufacturers and related technology providers should carefully review whether Oregon’s expanded rules apply to their data practices.

Consumer Rights Under the Oregon Consumer Privacy Act

The OCPA provides Oregon consumers with several significant privacy rights.

Consumers generally have the right to:

• Confirm whether an organization processes their personal data
• Access personal data
• Correct inaccurate information
• Delete personal information
• Obtain a copy of personal data
• Opt out of the sale of personal data
• Opt out of targeted advertising
• Opt out of certain profiling activities
• Obtain information regarding third parties receiving their information

One particularly noteworthy feature of Oregon’s law is the ability of consumers to request information regarding the specific third parties that have received their personal data or personal data generally. This provides consumers with greater transparency into how their information moves throughout the data ecosystem.

Controllers generally must respond to qualifying consumer requests within 45 days. An additional 45 days may be available when reasonably necessary because of the complexity or number of requests, provided the consumer is notified within the original response period.

Universal Opt-Out Requirements

One of the most important 2026 changes to Oregon privacy law is the requirement to recognize universal opt-out mechanisms.

Beginning January 1, 2026, covered businesses must recognize qualifying signals that allow consumers to automatically communicate their preference not to have personal data sold or used for targeted advertising.

Rather than visiting every website individually and locating a privacy settings page, consumers can use technology such as browser settings or extensions to communicate their preference.

Businesses should therefore evaluate:

• Website consent management platforms
• Advertising pixels
• Analytics tools
• Marketing platforms
• Data sharing integrations
• Cookie management systems

A website that provides a manual “Do Not Sell My Data” button but ignores a valid universal opt-out signal may no longer satisfy Oregon requirements.

Oregon’s Precise Geolocation Restrictions

Beginning January 1, 2026, Oregon prohibits the sale of consumers’ precise geolocation data.

Oregon DOJ guidance describes precise geolocation as location information within a radius of approximately 1,750 feet, including both present and historical location information.

This restriction can be especially relevant to:

• Mobile applications
• Advertising platforms
• Retail applications
• Connected vehicles
• Fitness applications
• Location-based services
• Data brokers

Organizations collecting location data should determine why the information is needed, how long it is retained, which vendors receive it, and whether any activity could constitute a prohibited sale.

Protections for Children and Teenagers

Oregon also strengthened privacy protections for minors in 2026.

Businesses already generally need parental or guardian consent before processing sensitive personal information belonging to children under 13.

Beginning January 1, 2026, controllers generally may not knowingly:

• Sell personal information belonging to consumers under 16
• Use their personal data for targeted advertising
• Use their personal data for certain profiling activities

The restrictions apply even though businesses may still be permitted to collect and use the information for other lawful purposes.

Organizations operating websites, applications, gaming platforms, education services, social platforms, or other digital products likely to be used by minors should review these requirements carefully.

Sensitive Personal Data

The OCPA provides additional protections for sensitive personal data.

Oregon DOJ guidance identifies sensitive information as including information that may reveal:

• Racial or ethnic background
• Religious beliefs
• Mental or physical health
• Sexuality
• Citizenship or immigration status
• Transgender or nonbinary status
• Crime victim status
• Genetic information
• Biometric information
• Precise location
• Certain information belonging to children

Covered controllers generally must obtain consent before processing sensitive data.

Organizations should therefore classify sensitive information separately from ordinary customer information and apply stronger privacy and cybersecurity controls where appropriate.

Business Responsibilities Under the OCPA

Businesses subject to the Oregon Consumer Privacy Act should develop a comprehensive privacy governance program.

Responsibilities generally include:

• Maintaining an accessible privacy notice
• Providing mechanisms for consumers to exercise privacy rights
• Limiting collection of personal information
• Maintaining reasonable administrative safeguards
• Maintaining reasonable technical safeguards
• Maintaining reasonable physical safeguards
• Obtaining consent before processing sensitive data
• Managing contracts with processors
• Conducting data protection assessments for higher-risk activities
• Honoring valid opt-out requests
• Recognizing universal opt-out signals
• Maintaining appropriate data retention practices

The Oregon statute specifically requires personal data to be protected through reasonable administrative, technical, and physical measures designed to preserve confidentiality, integrity, and security.

Oregon Data Protection Assessments

Covered organizations must conduct data protection assessments before engaging in certain processing activities that present a heightened risk of harm to consumers.

These may include activities involving:

• Targeted advertising
• Sale of personal information
• Certain profiling
• Sensitive personal data
• Other processing presenting heightened privacy risks

Organizations must generally retain these assessments for at least five years. The Oregon Attorney General may request relevant assessments during an investigation, although the statute provides confidentiality protections for the assessments.

Businesses should consider integrating privacy assessments with their broader cybersecurity risk assessment process.

Oregon Consumer Identity Theft Protection Act

Oregon maintains separate requirements governing security breaches under its Consumer Identity Theft Protection Act, found primarily in ORS 646A.600 through 646A.628.

Official statute: Oregon Revised Statutes Chapter 646A

When a covered entity experiences a qualifying security breach, it generally must notify affected consumers as soon as possible and without unreasonable delay, but no later than 45 days after discovering or receiving notification of the breach.

Before providing notice, organizations may take reasonable measures necessary to:

• Determine the scope of the breach
• Identify appropriate consumer contact information
• Restore the integrity and security of affected information

Notification may be delayed when a law enforcement agency determines that providing notice would interfere with a criminal investigation and requests the delay in writing.

Oregon Attorney General Breach Notification

Oregon has a relatively low threshold for Attorney General notification compared with many states.

If a covered entity must notify more than 250 consumers, it must also notify the Oregon Attorney General.

This is an important distinction because many other states set regulatory notification thresholds at 500 or 1,000 affected residents.

Businesses should therefore incorporate Oregon-specific requirements into their incident response procedures rather than relying on a generic nationwide breach response checklist.

Third-Party Vendor Breaches

Oregon also establishes clear requirements for vendors.

A vendor that discovers or has reason to believe that a breach occurred generally must notify the covered entity as soon as practicable but no later than 10 days after discovery or having reason to believe the breach occurred.

Vendors may also have independent Attorney General reporting responsibilities when a breach involves personal information belonging to more than 250 consumers and the covered entity has not already provided the required notice.

This makes vendor cybersecurity especially important for Oregon businesses.

Organizations should ensure contracts address:

• Incident notification
• Investigation cooperation
• Security requirements
• Breach response responsibilities
• Regulatory reporting
• Cyber insurance
• Data deletion

What Information Is Protected Under Oregon’s Breach Law?

Oregon’s breach notification law covers specified categories of personal information that could create risks of identity theft, financial fraud, or other harm when compromised.

Businesses should understand where personal information is located across:

• Employee systems
• Customer databases
• Cloud platforms
• Accounting systems
• CRM platforms
• Email
• File servers
• Backup environments
• Third-party applications

An accurate data inventory can dramatically reduce the amount of time required to determine whether an incident triggers Oregon’s 45-day notification requirement.

Oregon Privacy Enforcement

The Oregon Attorney General has exclusive authority to enforce the OCPA.

The Attorney General may seek civil penalties of up to $7,500 for each violation, as well as injunctive or other equitable relief.

One of the most important changes for businesses in 2026 is the expiration of the general 30-day cure period.

Prior to January 1, 2026, businesses generally received notice and an opportunity to cure qualifying violations before enforcement. That broad protection has now ended for most covered organizations.

That makes proactive compliance substantially more important than it was during the OCPA’s initial implementation period.

Oregon Insurance and Financial Privacy Requirements

Certain Oregon organizations operating in insurance and financial services face additional privacy and cybersecurity obligations beyond the Oregon Consumer Privacy Act.

Oregon insurance law includes specific requirements governing how insurers, insurance producers, and insurance-support organizations collect, use, disclose, and protect personal information.

Official statute: Oregon Revised Statutes Chapter 746

Oregon law establishes standards designed to limit unnecessary disclosure of personal information and provide consumers with greater transparency into information collected in connection with insurance transactions. Health insurers subject to HIPAA and the Gramm-Leach-Bliley Act also face Oregon-specific privacy requirements.

Insurance organizations should evaluate:

• What personal information they collect
• How customer information is used
• Who can access sensitive information
• How information is shared with third parties
• Vendor cybersecurity practices
• Security controls protecting policyholder information
• Incident response procedures
• Data retention and secure destruction practices

Financial institutions should also evaluate whether federal GLBA requirements apply alongside Oregon law.

Reasonable Cybersecurity Safeguards Under Oregon Law

Oregon’s Consumer Identity Theft Protection Act does more than require notification after a data breach.

Covered entities and vendors must develop, implement, and maintain reasonable safeguards designed to protect the security, confidentiality, and integrity of personal information.

Official statute: ORS 646A.622

The law specifically recognizes administrative, technical, and physical safeguards. It also addresses secure disposal of personal information.

Depending on the organization’s size and risk profile, reasonable safeguards may include:

• Cybersecurity policies
• Risk assessments
• Access controls
• Multi-factor authentication
• Encryption
• Endpoint protection
• Network monitoring
• Secure backup systems
• Vendor management
• Employee cybersecurity training
• Incident response planning
• Secure data destruction

Organizations already complying with certain federal requirements, including applicable HIPAA or GLBA security rules, may satisfy portions of Oregon’s reasonable safeguards requirement when those rules provide sufficient protection.

Federal Cybersecurity Laws That May Apply in Oregon

Oregon cybersecurity laws represent only one layer of an organization’s compliance responsibilities.

Depending on the industry, type of information maintained, and customers served, businesses may also need to comply with federal cybersecurity and privacy requirements.

Health Insurance Portability and Accountability Act (HIPAA)

Healthcare providers, health plans, healthcare clearinghouses, and qualifying business associates may be subject to HIPAA when handling protected health information.

Official resource: U.S. Department of Health and Human Services HIPAA Resources

HIPAA requires covered organizations to maintain administrative, physical, and technical safeguards designed to protect protected health information.

Important cybersecurity considerations include:

• Security risk assessments
• Access controls
• Workforce training
• Audit logging
• Authentication
• Incident response procedures
• Business associate agreements
• Backup and recovery planning

An Oregon healthcare organization experiencing a breach may therefore need to evaluate both federal HIPAA requirements and Oregon’s state breach notification law.

Gramm-Leach-Bliley Act (GLBA)

Certain financial institutions may be subject to the Gramm-Leach-Bliley Act and the FTC’s Safeguards Rule.

Official resource: FTC Gramm-Leach-Bliley Act Guidance

Covered organizations may be required to establish a written information security program, conduct risk assessments, oversee service providers, and implement safeguards appropriate to their operations.

Oregon law expressly recognizes compliance with qualifying GLBA regulations when evaluating reasonable safeguards for personal information.

Federal Trade Commission Act

The Federal Trade Commission may pursue organizations that engage in unfair or deceptive cybersecurity and privacy practices.

Official resource: Federal Trade Commission

Businesses should ensure that statements made in privacy policies, contracts, marketing materials, and security documentation accurately reflect their actual practices.

For example, a business should not claim that customer information is encrypted everywhere if portions of that information remain unencrypted.

Family Educational Rights and Privacy Act (FERPA)

Schools, colleges, universities, and certain education-related organizations may also be subject to the Family Educational Rights and Privacy Act.

Official resource: U.S. Department of Education Student Privacy

FERPA governs access to and disclosure of student education records.

Educational organizations should evaluate both privacy obligations and cybersecurity controls protecting student information.

DFARS and NIST SP 800-171

Oregon businesses working in the defense supply chain may face cybersecurity requirements through federal contracts.

Manufacturers and contractors handling Controlled Unclassified Information may need to comply with DFARS cybersecurity clauses and NIST SP 800-171. NIST notes that manufacturers frequently encounter DFARS and other federal cybersecurity requirements through their contractual relationships.

Official NIST resource: NIST SP 800-171

These requirements can involve:

• Multi-factor authentication
• Access control
• System monitoring
• Configuration management
• Security assessments
• Incident reporting
• Controlled access to sensitive information

Organizations supporting federal agencies or defense contractors should review their specific contracts rather than assuming Oregon state law represents their complete compliance obligation.

NIST Cybersecurity Framework

Many Oregon organizations use the NIST Cybersecurity Framework (CSF 2.0) as a foundation for managing cybersecurity risk.

Official resource: NIST Cybersecurity Framework

The framework organizes cybersecurity activities around six functions:

• Govern
• Identify
• Protect
• Detect
• Respond
• Recover

Using an established framework can make it easier to organize security policies, identify gaps, prioritize cybersecurity investments, and demonstrate a structured approach to protecting information.

This can be particularly valuable in Oregon because state law requires covered entities to maintain reasonable safeguards rather than prescribing one identical cybersecurity program for every business.

Oregon Cybersecurity Compliance Checklist

Organizations collecting or maintaining personal information belonging to Oregon residents should regularly evaluate their privacy and cybersecurity programs.

Consider the following steps:

• Inventory personal information throughout the organization.
• Identify sensitive personal data covered by the OCPA.
• Determine whether the Oregon Consumer Privacy Act applies.
• Review website and application privacy notices.
• Provide consumers with required privacy request mechanisms.
• Configure systems to recognize qualifying universal opt-out signals.
• Review targeted advertising technologies.
• Identify whether precise geolocation information is being sold.
• Review personal data involving consumers under age 16.
• Obtain consent before processing sensitive personal information where required.
• Conduct required data protection assessments.
• Maintain reasonable administrative, technical, and physical safeguards.
• Require multi-factor authentication for critical systems.
• Encrypt sensitive information where appropriate.
• Maintain endpoint detection and response.
• Review third-party vendor security practices.
• Include breach notification responsibilities in vendor contracts.
• Develop and test an incident response plan.
• Prepare procedures for Oregon’s 45-day breach notification deadline.
• Prepare procedures for notifying the Oregon Attorney General when more than 250 consumers are affected.
• Train employees on phishing and social engineering.
• Test backup and disaster recovery procedures.
• Review privacy and cybersecurity requirements annually.

As of January 1, 2026, covered Oregon businesses and nonprofits must also recognize qualifying universal opt-out mechanisms for certain privacy requests.

Example: An Oregon Manufacturer Experiences Ransomware

Consider an Oregon manufacturing company that discovers ransomware across several servers.

The investigation determines that attackers obtained administrator credentials through a phishing campaign and accessed files containing employee records, customer information, and financial data.

Approximately 700 Oregon consumers may have been affected.

The organization’s response team would need to determine:

1. What information was actually accessed?
2. Does the incident meet Oregon’s definition of a security breach?
3. Which Oregon residents were affected?
4. When did the organization discover the breach?
5. When does the 45-day notification deadline expire?
6. Does the Oregon Attorney General need to be notified?
7. Did a third-party vendor contribute to the breach?
8. Are federal or contractual cybersecurity requirements also triggered?

Because more than 250 consumers require notification in this example, the organization would generally also need to notify the Oregon Attorney General. Oregon law generally requires consumer notice as soon as possible and without unreasonable delay, but no later than 45 days after discovery or notification of the breach, subject to statutory exceptions.

If the incident originated with a third-party vendor, Oregon’s vendor notification requirements would also become important. Vendors generally must notify the covered entity as soon as practicable and no later than 10 days after discovering or having reason to believe a breach occurred.

This demonstrates why organizations should address breach notification responsibilities before an incident occurs rather than trying to determine them during a ransomware investigation.

Frequently Asked Questions About Oregon Cybersecurity Laws

What is Oregon’s primary cybersecurity law?

Oregon maintains several important cybersecurity and privacy laws.

The Oregon Consumer Identity Theft Protection Act establishes breach notification and reasonable security requirements, while the Oregon Consumer Privacy Act regulates how covered businesses collect and process consumers’ personal information.

Does Oregon have a comprehensive consumer privacy law?

Yes.

The Oregon Consumer Privacy Act became effective for most covered businesses on July 1, 2024 and qualifying nonprofits on July 1, 2025.

Which businesses must comply with the Oregon Consumer Privacy Act?

The OCPA generally applies to businesses operating in Oregon or providing products or services to Oregon residents that process personal information belonging to at least:

• 100,000 consumers, excluding information processed solely for payment transactions, or
• 25,000 consumers when more than 25% of annual gross revenue comes from selling personal data.

Certain exemptions apply. Motor vehicle manufacturers and some affiliates are subject to additional rules regardless of those normal thresholds.

What changed under Oregon privacy law in 2026?

Several significant changes took effect on January 1, 2026.

Covered businesses must recognize qualifying universal opt-out mechanisms. Oregon also prohibited the sale of precise geolocation information and strengthened restrictions involving personal information belonging to consumers under 16.

What is a universal opt-out mechanism?

A universal opt-out mechanism allows consumers to communicate certain privacy preferences through their browser or similar technology rather than manually opting out on every individual website.

Oregon specifically identifies technologies such as Global Privacy Control as an example of this approach.

Can businesses sell precise geolocation data in Oregon?

Covered organizations generally may not sell consumers’ precise geolocation data beginning January 1, 2026.

Oregon defines precise geolocation using a radius of approximately 1,750 feet and includes both current and historical location information.

What privacy protections apply to children and teenagers?

Before processing certain information involving children under 13, parental or guardian consent may be required.

Beginning January 1, 2026, covered businesses generally may not knowingly sell personal information belonging to consumers under 16 or use that information for targeted advertising or certain profiling activities.

How quickly must Oregon consumers be notified after a breach?

Organizations generally must provide notification as soon as possible and without unreasonable delay, but no later than 45 days after discovering or receiving notification of a qualifying breach, subject to applicable statutory exceptions.

When must the Oregon Attorney General be notified?

When a covered entity must notify more than 250 consumers, it generally must also notify the Oregon Attorney General.

This relatively low threshold makes Oregon-specific incident response procedures particularly important.

Do Oregon businesses have to maintain reasonable cybersecurity safeguards?

Yes.

Covered entities and vendors must develop, implement, and maintain reasonable safeguards designed to protect the security, confidentiality, and integrity of personal information.

Does Oregon require data protection assessments?

Yes.

Covered businesses must conduct assessments for certain processing activities presenting heightened risks, such as targeted advertising, selling personal information, processing sensitive information, and certain profiling activities.

Does ransomware automatically require breach notification?

No.

An organization should investigate whether information covered by Oregon law was accessed, acquired, or otherwise compromised before determining whether notification requirements have been triggered.

Does complying with Oregon law satisfy federal cybersecurity requirements?

No.

Oregon businesses may also need to comply with federal requirements such as HIPAA, GLBA, FERPA, DFARS, NIST SP 800-171, contractual cybersecurity obligations, or industry-specific standards.

Related Cybersecurity Guides

Continue learning about cybersecurity compliance by exploring:

• Washington Cybersecurity Laws
• California Cybersecurity Laws
• Idaho Cybersecurity Laws
• Nevada Cybersecurity Laws
• Alaska Cybersecurity Laws

Conclusion

Oregon has developed one of the more comprehensive state cybersecurity and privacy frameworks in the country. Businesses may need to comply with both the Oregon Consumer Privacy Act and the Oregon Consumer Identity Theft Protection Act, along with applicable federal, contractual, and industry-specific cybersecurity requirements.

The compliance environment became particularly important in 2026. Covered organizations must now recognize universal opt-out mechanisms, the sale of precise geolocation data is prohibited, protections for consumers under age 16 have expanded, and the OCPA’s general 30-day opportunity to cure violations has expired.

Organizations should therefore treat Oregon cybersecurity compliance as an ongoing governance responsibility. Data inventories, privacy notices, vendor management, cybersecurity risk assessments, employee training, incident response procedures, and technical safeguards should all be periodically reviewed as business operations and regulations evolve.

Businesses that proactively strengthen these areas are better positioned to protect sensitive information, respond effectively to cyber incidents, meet Oregon’s legal requirements, and maintain trust with customers.

Disclaimer: This article is provided for informational purposes only and does not constitute legal advice. Organizations should consult qualified legal counsel regarding the application of Oregon cybersecurity and privacy laws to their specific circumstances.