Oregon's Consumer Privacy Act: the Automated Decision Opt-Out

Oregon’s Consumer Privacy Act, ORS 646A.570 to 646A.589, has applied to most controllers since 1 July 2024. Its profiling opt-out reads almost identically to Virginia’s. It nonetheless reaches a meaningfully different set of organisations, and the reason is in the exemptions rather than in the right.

The opt-out and the effects it attaches to

A consumer may opt out of the processing of personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal effects or effects of similar significance. Profiling is defined as automated processing of personal data to evaluate, analyse or predict an individual’s economic circumstances, health, personal preferences, interests, reliability, behaviour, location or movements — the same enumeration the other state statutes use.

Note what is absent: there is no “solely automated” qualifier of the kind Delaware uses. Oregon, like Virginia, attaches the right to profiling in furtherance of a decision, which means a workflow with a human in it is not obviously outside the right. That is the single most consequential difference between the two formulations, and a controller that has built one opt-out implementation for all states will have built it to whichever standard it read first.

The decisions in question are those that result in the provision or denial of financial and lending services, housing, insurance, education enrolment or opportunity, criminal justice, employment opportunities, health care services, or access to basic necessities. The statute is published by the Oregon Legislature at oregonlegislature.gov.

Where Oregon differs: the exemption structure

Most US privacy statutes exempt whole categories of organisation. If you are a HIPAA-covered entity, or a financial institution subject to the Gramm-Leach-Bliley Act, or a nonprofit, several states simply switch off. Oregon does much less of that, and the effect is that organisations who correctly concluded they were exempt in Virginia have to run the analysis again.

• Health care. Oregon’s exemptions for health data are largely written at the level of the data — protected health information and information used in accordance with specified federal rules — rather than switching off an entire covered entity. A hospital’s marketing analytics and its clinical records are therefore treated differently, and only the second is outside.
• Nonprofits. Oregon brought nonprofit organisations within scope, with a delayed application date of 1 July 2025 and some carve-outs. Nonprofits are exempt outright in Virginia.
• Thresholds. Oregon applies to controllers processing the personal data of 100,000 or more consumers, or 25,000 or more consumers where more than 25% of annual gross revenue comes from selling personal data. Virginia’s second limb uses 50%, so an organisation deriving a third of its revenue from data sales is caught in Oregon and not in Virginia.

The lesson generalises: two statutes with the same operative sentence can have very different populations, and the exemption sections are where multi-state analysis has to start. Reading only the rights sections produces a confident and wrong map.

The specific-third-parties right

Oregon includes a right that no other US state has adopted in the same form: a consumer may request, and the controller must provide, a list of the specific third parties to which the controller has disclosed the consumer’s personal data, or to which it has disclosed any personal data. Every other comprehensive statute that offers something similar — Delaware, for instance — asks only for categories.

For anyone running AI features, that turns a documentation problem into a disclosure problem. The list of specific third parties includes the model providers, the vector database, the observability vendor and the evaluation service, if personal data reaches them. It has to be accurate, it has to be current, and it has to be producible on request within the statutory response window. In practice the only way to answer it reliably is to maintain the record continuously rather than to reconstruct it, which is the same artefact a record of processing activities is meant to be.

A related consequence: adding or swapping a subprocessor is now a disclosure event as well as a contractual one. If a routing layer can send a request to a provider you have not listed, the list is wrong the moment it does.

Assessments, and the sunsetting cure period

Oregon requires a data protection assessment for processing that presents a heightened risk of harm, on the now-familiar list: targeted advertising, the sale of personal data, processing sensitive data, and profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment or disparate impact, financial, physical or reputational injury, intrusion upon private affairs that would be offensive to a reasonable person, or other substantial injury. The Attorney General may require production of an assessment in an investigation, and the assessments are confidential.

Two Oregon-specific timing points matter. First, the statute’s 30-day right to cure a violation before enforcement was written to expire, and it expired at the start of 2026. Enforcement after that point does not have to be preceded by a cure opportunity. Second, controllers must recognise universal opt-out mechanisms from 1 January 2026, so a consumer’s browser-level signal has to switch off targeted advertising and sale — and controllers should check carefully how their implementation treats the profiling limb, which is the one that is easiest to leave out of a signal handler.

Enforcement is by the Oregon Department of Justice, with civil penalties of up to $7,500 per violation. There is no private right of action. The Department has published enforcement reports describing the complaints it receives, and the recurring themes have been hard-to-find privacy notices and opt-out mechanisms that do not work — which is a useful signal that the first enforcement risk in this statute is not the model, it is the button.

Reading Oregon next to Virginia

The right way to use the two statutes together is to treat the shared operative language as settled and to diff everything around it.

• Same: the definition of profiling, the “in furtherance of decisions” formulation with no solely-automated qualifier, the enumerated significant effects, the assessment trigger language, AG-only enforcement, and the $7,500 per-violation ceiling.
• Different: the applicability thresholds, the treatment of nonprofits, the entity-versus-data structure of the health and financial exemptions, the specific-third-parties right, the universal opt-out duty, and whether the cure period survives.

For an AI system that means the substantive question — is this profiling in furtherance of a significant decision — can be answered once and applied in both. The operational questions cannot. The set of controllers in scope, the mechanisms an opt-out must support, the records you must be able to produce, and the enforcement runway all differ, and it is those that decide whether a compliance programme actually works when a request arrives. The wider map of which states impose which duties is in the state AI laws overview and the enacted-versus-pending position in the snapshot.