Oregon's data broker registry and privacy law: what you can ask a data broker to do

Oregon gives you two separate tools. The Oregon Consumer Privacy Act (OCPA, ORS 646A.570 to 646A.589, operative July 1, 2024) says a resident may ask a covered company to confirm, copy, correct and delete personal data, to opt out of sales and targeted advertising, and to provide "a list of specific third parties" it disclosed data to. Each request goes to each company, which has 45 days to answer, extendable by 45 more. The data broker registration law (HB 2052, 2023, now ORS 646A.593) makes brokers register with the Department of Consumer and Business Services, which publishes how residents can opt out. The registry is a list, not a deletion service. Neither law reaches data "lawfully available through federal, state or local government records," which is what many people-search listings are built from. This guide quotes the texts, shows the process and says where it stops.

Oregon's data broker registry

HB 2052 (2023) is codified at ORS 646A.593. The enrolled bill says the registration section "becomes operative on January 1, 2024." The Division of Financial Regulation (DFR) inside the Department of Consumer and Business Services runs it.

Who must register. "A data broker may not collect, sell or license brokered personal data within this state unless the data broker first registers." A data broker is "a business entity or part of a business entity that collects and sells or licenses brokered personal data to another person." Brokered personal data covers a resident's name, address, birth date or place, biometrics, government ID numbers and "other information that, alone or in combination with other information that is sold or licensed, can reasonably be associated with the resident individual."

Who is left out. Consumer reporting agencies under the Fair Credit Reporting Act, financial institutions under Gramm-Leach-Bliley, and businesses collecting data about their own customers or employees. Subsection (2)(b) adds that no registration is needed if the activity involves only, among other things, "providing information that is lawfully available from federal, state or local government records."

What the registration shows. Contact details plus "a declaration" stating "whether resident individuals may opt out of all or a portion of the data broker's collection, sale or licensing" and "the method by which a resident individual may exercise the choices." The department "shall make the information that business entities submit for registration under this section publicly available on or by means of the department's website." The DFR registry page puts the fee at $600 a year and asks for "a succinct narrative (under 600 characters in total)" on opt-out methods, "published on the division's website for consumers to review."

How to search it. The DFR page links a license verification search, where "Data Broker" is a license type, and an "Opt out information" page. Search a people-search site by company name; the DFR says each broker's opt-out narrative is "published on the division's website for consumers to review."

What registration does not mean. It is not a compliance finding; penalties under ORS 646A.593 are capped at $500 per violation and "$10,000 during any calendar year." The registry does not take requests, forward them or check that a broker honored one. Whether a registered broker is also a "controller" under the OCPA depends on the thresholds below.

What the Oregon Consumer Privacy Act lets you ask for

ORS 646A.574 says a consumer, "a natural person who resides in this state" acting outside a commercial or employment context, "may":

1. Obtain confirmation of "whether the controller is processing or has processed the consumer's personal data and the categories."
2. Obtain a list of third parties. The text: "At the controller's option, a list of specific third parties, other than natural persons, to which the controller has disclosed: (i) The consumer's personal data; or (ii) Any personal data." The Oregon DOJ's one-year report calls the OCPA "the first comprehensive privacy law" to include this. "At the controller's option" means the company chooses between a list specific to you and a list of everyone it discloses to.
3. Obtain a copy "of all of the consumer's personal data that the controller has processed or is processing."
4. Require correction of inaccuracies.
5. Require deletion of "personal data about the consumer, including personal data the consumer provided to the controller, personal data the controller obtained from another source and derived data." The "another source" wording is the part that describes a data broker.
6. Opt out of "targeted advertising," "selling the personal data," or profiling "in furtherance of decisions that produce legal effects."

One clause matters for brokers. ORS 646A.576(7) says a controller that got your data "from a source other than the consumer" complies with a deletion request if it either deletes the data and keeps "a minimal amount of data necessary to ensure that the personal data remains deleted," or "opts the consumer out of the controller's processing" for any non-exempt purpose. A suppression can count as compliance.

How to send a request

The process in ORS 646A.576:

• Use the company's channel. Requests go through "the method that the controller specifies in the privacy notice." The controller "may not require a consumer to create an account." The DOJ publishes a template letter for consumers.
• Authentication. If the controller "cannot, using commercially reasonable methods, authenticate the consumer's request without additional information," it notifies you and need not comply until you provide it. Opt-out requests are handled "without requiring authentication."
• 45 days. The controller "shall respond to a request from a consumer without undue delay and not later than 45 days after receiving the request," and "may extend the period within which the controller responds by an additional 45 days if the extension is reasonably necessary," with notice inside the first 45 days.
• Cost. Information comes "once during any 12-month period without charge." A follow-up request to verify a deletion is also free.
• Denial and appeal. A controller that declines must explain "the justification for not taking action" and include "instructions for appealing." It must "approve or deny the appeal within 45 days," and if it denies, "the notice must provide or specify information that enables the consumer to contact the Attorney General to submit a complaint."
• Complaint. The Oregon DOJ runs a privacy complaint form and a hotline at 1-877-877-9392. It says it "doesn't represent individual consumers"; complaints "may be used to monitor industry compliance or to inform an enforcement action."
• Who enforces. ORS 646A.589 gives the Attorney General "exclusive authority," a civil penalty of "not more than $7,500 for each violation," and no "private right of action." The 30-day cure notice ran until January 1, 2026; after that, the DOJ's Q3 2025 report says, the Privacy Unit "is not legally required to provide businesses with an opportunity to fix alleged violations."

The DOJ's one-year report shows the traffic: 214 complaints in year one and 38 cure-letter matters. "Data brokers continue to be of chief concern of consumers; 62 of the total consumer complaints involved data brokers." By right: 77 about deletion, 20 about copies, 19 about the third-party list. By September 30, 2025 the total was 265.

Who is covered and who is not

Thresholds. ORS 646A.572 applies to a person doing business in Oregon that in a calendar year controls or processes "the personal data of 100,000 or more consumers," or "the personal data of 25,000 or more consumers, while deriving 25 percent or more of the person's annual gross revenue from selling personal data." A small broker below both lines is outside the act even if it is on the registry. Nonprofits came under the act on July 1, 2025.

Exempt entities and data. Public bodies, HIPAA-covered health information, FCRA activity by consumer reporting agencies, data under Gramm-Leach-Bliley, the Driver's Privacy Protection Act and FERPA, insurers, and "noncommercial activity" of news publishers, among others.

Publicly available information. ORS 646A.570 says personal data "does not include deidentified data or data that: (A) Is lawfully available through federal, state or local government records or through widely distributed media; or (B) A controller reasonably has understood to have been lawfully made available to the public by a consumer." The DOJ's one-year report applies this to people-search sites: "Sites that provide lists of public records associated with names generally do not pose OCPA concerns because that information is not personal data. However, some of these people search sites combine public records with purchased data to compile detailed profiles of individuals." Which kind a given listing is remains a question for the site and the DOJ.

Authorized agents. ORS 646A.576(4) provides for an agent "for the purpose of opting out." The DOJ's report: "While a controller can choose to honor a deletion request or other privacy request from an authorized agent on behalf of a consumer, the controller is not obligated to." A service that sends Oregon deletion requests for you relies on the broker's choice to accept them.

2026 changes. HB 2008 (2025) amended ORS 646A.578. The enrolled text says a controller may not "sell personal data that" pertains to a consumer "if the controller has actual knowledge that, or willfully disregards whether, the consumer is under 16 years of age," or that "accurately identifies within a radius of 1,750 feet a consumer's present or past location." The DOJ's one-year report says both bans "go into effect on January 1, 2026"; the Q3 report adds a universal opt-out "signal" from the same date.

Oregon vs California

Both states have a registry. California adds DROP, described in California's Delete Act and DROP. Oregon's registry publishes each broker's opt-out narrative and stops there: each request goes to each company, and the 45-day clock runs per company. The DOJ's one-year report calls the OCPA "the first comprehensive privacy law" to give consumers the list of specific third parties.

Practical order

1. Search your name and note which people-search sites show you. What is a data broker explains who these companies are.
2. Look each one up in the DFR verification search. If it is registered, read its opt-out narrative and use that route first.
3. For each site, send a request through the channel its privacy notice names. Ask for deletion under ORS 646A.574(1)(c) and, in the same message, for the list of specific third parties under 646A.574(1)(a)(B). Keep a dated copy.
4. Mark 45 days, and 45 more if an extension notice arrives. On a denial, use the appeal route it must describe; if the appeal is denied, file a DOJ complaint with the notices attached.
5. Re-search your name later. ORS 646A.576(7) lets a broker satisfy a deletion request with a suppression, and a suppressed record can be re-created from a new data purchase. Our directory notes Oregon registry status where we have checked it, and How to remove your information from the internet covers sites outside Oregon's reach.

We cannot promise a listing stays down. The DOJ's own figures show deletion is the request complained about most.

If you are at risk

If someone is using people-search listings to find you, do not wait on the 45-day clock. Contact local law enforcement or the National Domestic Violence Hotline at 1-800-799-7233 first. The OCPA process is a consumer-protection channel, not an emergency one, and the DOJ says it does not represent individuals.

FAQ

Does the Oregon data broker registry delete my data? No. ORS 646A.593 is a registration law. It makes brokers register with the Department of Consumer and Business Services, pay a fee and file a declaration about whether and how residents may opt out. The department publishes that information. Deletion requests go to each company under the Oregon Consumer Privacy Act, not through the registry.

How long does a company have to answer my Oregon privacy request? ORS 646A.576 says a controller shall respond without undue delay and not later than 45 days after receiving the request, and may extend by an additional 45 days if the extension is reasonably necessary, with notice to the consumer inside the first 45 days.

Can an Oregon people-search site keep showing my address after I ask for deletion? Possibly. The act's definition of personal data excludes data lawfully available through government records or widely distributed media. The Oregon DOJ's one-year report says sites that list public records associated with names generally do not pose OCPA concerns, while sites that combine public records with purchased data to build profiles are a different case.

Can a removal service send my Oregon deletion request for me? ORS 646A.576 provides for an authorized agent only for opt-out requests. The Oregon DOJ's one-year report says a controller can choose to honor a deletion request from an authorized agent but is not obligated to, and that the only agent request controllers are required to grant is an opt-out.