But how do they get our information in the first place?

Data brokers get our information from a lot of places, using a mix of public and private records. For example, when you make an online purchase, you enter your name, contact information, and credit card number. The company may then sell that information you just entered to a data broker. Data brokers can also use publicly available information such as your social media profile, voter registration lists, or property records.

What can be done?

While our daily activities create personal data, we can control what data brokers are allowed to do with our data thanks to the Oregon Consumer Privacy Act. You just need a computer with internet access.

Get started

There are two ways to get started. Both will lead you to the Oregon Department of Consumer and Business Services data broker registry. 

1. Targeted data broker search

Start with a brainstorm

List companies that likely have your information, using questions such as:

• Where have I shared my phone number?
• What businesses do I have a login for?
• Where do I purchase things online?
• What am I searching for on the internet?
• What accounts have I canceled in the past?

Request a list

Under the Oregon Consumer Privacy Act, you can request that businesses send you a list of “third parties” they sold your information to. Use this list and search for each business name in the data broker registry. Make sure you’re searching for a Contractor / Business License rather than a Person.

Data Broker Information

If they are a registered data broker, their name should appear when you search the registry. 

When you click on the broker name, you will be directed to a page with information about the data broker, including business address, license number, and opt out information.

2. Broker registry list

If you don’t have a list of data brokers from a previous data privacy request, you can still view the list of data brokers on the Oregon Department of Consumer and Business Services data broker registry. 

In the Search Criteria, select DFT-Data Broker under Profession and Data Broker as the License Type. Leave all other fields blank and press the search button.

You will be directed to the full list of data brokers registered with the state of Oregon. You can go down the list of brokers, clicking on their business name to make your privacy requests under the OPT OUT section.

Take Action

Regardless of which search option you choose, you will find yourself using the data broker registry to make your privacy requests with data brokers. The OPT OUT Contact Information section for each licensed broker includes a “narrative,” or instructions, to exercise your rights under the Oregon Consumer Privacy Act. The narrative should also tell you where and how to submit your privacy requests–usually by form, email message, or phone call.

Don’t know what to say?

If a business asks for an email or phone call, you can use sample language from the Oregon Department of Justice for your request.

Follow up

Businesses have to respond to your request within 45 days. 

You can file a complaint with the Oregon Department of Justice if they don’t meet that deadline or if you believe they violated your privacy rights under this law. 

And that’s it! From taking control of your data, choosing what information you share or keep to yourself, and alerting the state when businesses aren’t following the law, you just exercised your data privacy rights.

Your data belongs to you, but not everyone has the ability or knowledge to protect our information. The Oregon Consumer Privacy Act is only as strong as we make it—that means helping people around us so we can all exercise our collective rights under the law.