When Does the Oregon Data Broker Law Apply to a Business?

Oregon’s data broker law generally applies when a business:

• Collects personal information about Oregon residents.

• Sells, licenses, or otherwise provides that information to third-parties.

• Does not have a direct relationship with the individuals whose information is collected.

Companies that compile consumer profiles, operate advertising technology platforms, or sell aggregated marketing data may fall within the scope of the law depending on how their services operate.

Organizations should review their data collection and sharing practices to determine whether the law applies.

For implementation guidance, governance documentation templates, and audit-readiness support, visit the CLIClaw Data Broker Compliance Library.