Oregon Data Broker Registration Law: Requirements and Deadlines

What Oregon’s data broker law requires, maintained by Stauss PLLC. Last reviewed September 2026.

What You Need to Know

Oregon's data broker law requires covered entities to annually register with the state and pay a registration fee. The law contains unique definitions that impact its applicability.

Official law text

How Oregon defines and regulates data brokers

Who counts as a data broker	Business entity or part of business entity that collects and sells or licenses brokered personal data to another person
Which businesses it applies to	“Business entity” means: (i) a resident individual who regularly engages in commercial activity for the purpose of generating income; (ii) a corporation or nonprofit corporation, LLC, partnership or LLP, business trust, joint venture or other form of business organization the constituent parts of which share a common economic interest; (iii) a financial institution, as defined in ORS 706.008; or (iv) another person that controls, is controlled by or is under common control with a person described above. It does not include the state or a state agency, a local government, as defined in ORS 174.116, a public corporation or a business entity or other person during a period in which the business entity or person is acting solely on behalf of and at the direction of the state, a state agency, the local government or a public corporation.
Information covered	“Brokered personal data” means any of the following computerized data elements about a resident individual, if categorized or organized for sale or licensing to another person: (A) The resident individual’s name or the name of a member of the resident individual’s immediate family or household; (B) The resident individual’s address or an address for a member of the resident individual’s immediate family or household; (C) The resident individual’s date or place of birth; (D) The maiden name of the resident individual’s mother; (E) Biometric information about the resident individual; (F) The resident individual’s Social Security number or the number of any other government-issued identification for the resident individual; or (G) Other information that, alone or in combination with other information that is sold or licensed, can reasonably be associated with the resident individual.
Other provisions	Data brokers must notify the director of data breaches within 45 days of the breach
Penalties	$500 per violation per day with $10,000 annual cap

Compliance requirements5

Requirement	Applies?
Annual Registration Requirement	Yes
Registration Disclosure Obligations	Yes
Privacy Policy Disclosure Obligations	No
Creates Substantive Consumer Rights	No
Delete Request & Opt-out Platform (DROP)	No

Tracking Oregon data broker law? We write about it as the law changes.

Key dates5

Date	What happens
December 31, 2026	Annual deadline for Oregon data brokers to renew licenses
December 31, 2027	Annual deadline for Oregon data brokers to renew licenses
December 31, 2028	Annual deadline for Oregon data brokers to renew licenses
December 31, 2029	Annual deadline for Oregon data brokers to renew licenses
December 31, 2030	Annual deadline for Oregon data brokers to renew licenses

Questions about Oregon’s data broker law?

Stauss PLLC advises companies on state privacy, AI, and data broker compliance.

Contact Stauss PLLC

Follow Oregon’s data broker law

Our analysis, by email, as the law moves.

This page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.