Oregon’s Data Broker Law establishes operational compliance obligations for organizations that collect, sell, or license personal data involving consumers with whom the organization does not maintain a direct relationship.
Enacted through HB 2052 and effective January 1, 2024, the law introduces annual registration obligations and operational governance requirements applicable to qualifying data broker activities operating within Oregon.
The law focuses heavily on registration governance, operational accountability, regulator-facing readiness, and compliance oversight involving data broker activities and personal data commercialization practices. The Oregon Data Broker Law became effective January 1, 2024.
Operational Focus Areas.
Organizations evaluating Oregon data broker compliance obligations should pay particular attention to:
Applicability and direct relationship analysis,
Annual registration requirements,
Regulator-facing governance procedures,
Personal data sale and licensing practices,
Operational compliance oversight,
Documentation and audit-readiness controls, and
Data governance and safeguard practices.
Organizations Commonly Use These Resources To:
Evaluate Oregon data broker applicability,
Operationalize annual registration procedures,
Coordinate regulator-facing compliance workflows,
Strengthen governance and oversight activities,
Support audit and regulator response readiness, and
Maintain defensible data broker compliance operations.
