Oregon data broker registry

Oregon's data broker law (House Bill 2052, 2023) requires businesses that collect and sell or license personal data of Oregon residents they have no direct relationship with to register annually with the state. It is a transparency law: it does not give consumers new deletion rights by itself, but it tells regulators and the public who the brokers are.

Oregon's comprehensive privacy law (OCPA) applies alongside it and gives consumers rights, including to ask which specific third parties received their data.

• Data brokers: businesses that collect and sell or license brokered personal data of Oregon residents with whom they do not have a direct relationship.
• Exclusions cover, among others, consumer reporting agencies regulated under the Fair Credit Reporting Act, financial institutions under the Gramm-Leach-Bliley Act, and data about a business's own customers, employees or users.

The Department of Consumer and Business Services can impose civil penalties for each day a broker operates without registering, subject to an annual cap, and for false registration information.

1. Decide whether you are a data broker under Oregon's definition.
2. Register annually with the Division of Financial Regulation and pay the fee.
3. Keep your registration details accurate, including how consumers can opt out.
4. Check Oregon's privacy law (OCPA) for the rights consumers can use against you as a controller.
5. Track the other state registries (California, Texas and Vermont) and keep one register of obligations.