Oregon Data Broker Registry law
Data Broker Registry
Data brokers
Requires data brokers to register annually (mandatory since January 1, 2024; $600 fee) with the Department of Consumer and Business Services before collecting, selling or licensing brokered personal data about Oregon residents. Registration discloses whether and how residents can opt out, and the department publishes registrant information online.
- Where
- Oregon
- Citation
- ORS 646A.593 (2023 Or. Laws ch. 395, HB 2052)
- Status
- In force
- In force since
- 2024-01-01
- Enforced by
- Oregon Department of Consumer and Business Services (Division of Financial Regulation)
- People can sue
- No
- Penalties
- Civil penalty up to $500 per violation or $500 per day for a continuing violation, capped at $10,000 per data broker per calendar year (ORS 646A.593(7)).
- Applies to
- Business entities that collect and sell or license brokered personal data about Oregon residents with whom they have no direct relationship (ORS 646A.593(1)(c))
- Excludes FCRA-regulated activity, GLBA-regulated activity, and businesses dealing with their own customers, employees, investors or donors (ORS 646A.593(1)(c)(B)); certain activities (public-record data, news and publications, directory assistance, one-time asset sales) do not require registration (ORS 646A.593(2)(b))
What a privacy notice must say
- Registration declaration must state whether residents may opt out, which activities or data the opt-out covers, how to exercise it, and whether an authorized agent may act for the resident.ORS 646A.593(3)(c)
Registration
- Register with DCBS and pay a fee before collecting, selling or licensing brokered personal data in Oregon; registration expires December 31 each year.ORS 646A.593(2)(a), (3)-(4)
Other duties
- DCBS must make registrant information publicly available on its website.ORS 646A.593(6)
Sources
- Official text
- ORS 646A.593 (ORS chapter 646A, 2025 edition)
- 2023 Or. Laws ch. 395 (HB 2052), effective 2023-07-27
- DCBS Division of Financial Regulation, Data Broker registry
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Act took effect 2023-07-27; DFR states registration became mandatory 2024-01-01 and sets the fee at $600 (initial and renewal). Implementing rules (proposed as OAR 441-830) were not fetched.
Research reference, not legal advice.