To whom does the Oregon Consumer Privacy Act apply?
The Oregon Consumer Privacy Act imposes transparency and disclosure obligations on a “controller” (an individual or legal entity who, “alone or jointly with another person, determines the purposes and means for processing personal data”) who either:
- conducts business in Oregon; or
- produces products or services that are targeted to the residents of Oregon;
and that during a calendar year:
- controls or processes personal data of not less than 100,000 Oregon residents, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or
- controls or processes personal data of not less than 25,000 Oregon residents and derives more than 25 percent of its gross revenue from the sale of personal data.
