You own your information and thanks to the Oregon Consumer Privacy Act, you can take control of your data privacy!

This law requires businesses to limit the collection of personal data, keep it secure, and give Oregonians rights over their personal and sensitive data—but only at your direct request.

6 things you can do with the Oregon Consumer Privacy Act:

1. DELETE information a business has about you.

2. SAY NO (“OPT OUT”) to a business selling or using your personal information for advertising.

3. GET A LIST of places where your information was sold.

4. GET A COPY of the personal and sensitive data any business has about you.

5. KNOW what personal information has been collected about you.

6. CHANGE the information a business has about you.

How to get started

You don’t have to do it all at once! We can begin with small steps. 

Start with a list

The law requires Oregonians to contact each company directly to request their privacy rights. Begin by brainstorming a list of companies that likely have your information, using questions like these to start:

• Where have you shared your phone number?

• What businesses do you have a login for?

• Where do you purchase things online?

• Where are you signed up for rewards or points?

• What are you searching for on the internet?

• What accounts have you canceled in the past?

• What spam messages have you received lately and where did they come from?

Take action

1. PRIVACY POLICY: Using the list, head to the website of each business you identified. Look for their privacy notice or “privacy policy.” They’re usually located at the bottom of a company’s site.
2. KEYWORD SEARCH: These policies are packed with information and legal jargon. To cut through that, search for keywords in the business’s privacy policy page. Depending on what you want to do with your data, some words to search include:

   • ACCESS: To see what information businesses have collected or sold of yours.

   • CORRECT / EDIT: Change the information a business has about you.

   • DO NOT SELL / OPT-OUT: Say no to a business collecting, selling, or using your information.

   • DELETE / DELETION / REMOVE: Delete your information from a business’s database.

   • THIRD-PARTY / THIRD PARTY: Get a list of places where your information was sold.

3. SUBMIT YOUR REQUEST: You will need to submit a request for whatever it is you’d like to do with your data. The privacy policy will indicate how to do so—usually through an online form, email message, or phone call. 

How do I do a keyword search? Go to the privacy policy page and using your keyboard press Ctrl+F on a PC or ⌘ Command+F on a Mac

Don’t know what to say?

If a business asks for an email or phone call, you can use this sample language and letter template from the Oregon Department of Justice to make your request.

Rinse and repeat with the next business on your list.

Follow Up

Keep a record of the date you sent your request! Businesses have to respond to your request within 45 days. 

You can file a complaint with the Oregon Department of Justice if they don’t meet that deadline or if you believe they violated your privacy rights under this law. 

And that’s it! From taking control of your data, choosing what information you share or keep to yourself, and alerting the state when businesses aren’t following the law, you just exercised your data privacy rights.

Your data belongs to you, but not everyone has the ability or knowledge to keep our information to ourselves. The Oregon Consumer Privacy Act is only as strong as we make it—and that means helping people around us so we can all exercise our collective rights under the law.