Oregon’s data broker law generally applies when a business:
-
Collects personal information about Oregon residents.
-
Sells, licenses, or otherwise provides that information to third-parties.
-
Does not have a direct relationship with the individuals whose information is collected.
Companies that compile consumer profiles, operate advertising technology platforms, or sell aggregated marketing data may fall within the scope of the law depending on how their services operate.
Organizations should review their data collection and sharing practices to determine whether the law applies.
For operational guidance and structured compliance documentation tools, visit the CLIClaw Data Broker Compliance Library.
This FAQ is provided for general informational purposes only and is not legal advice. It is intended as a starting point for understanding the issues discussed and should not be relied on as a substitute for advice from qualified legal counsel.