Oregon Consumer Privacy Act, controller duties (sensitive data consent) (ORS 646A.578(2)(b) (2025 ed.))
Sensitive data (including national origin, transgender or nonbinary status and crime-victim status in Oregon) needs prior opt-in consent before it is processed.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(b) Process sensitive data about a consumer without first obtaining the consumer’s consent”
Where it was read
Also read from the same source
- Oregon, data broker registration with the Department of Consumer and Business Services (ORS 646A.593(1)(c)-(d), (2)(a))
- Oregon Consumer Privacy Act, definitions (sale) (ORS 646A.570(17)(a) (2025 ed.))
- Oregon Consumer Privacy Act, prohibited sales (under-16 data, precise geolocation) (ORS 646A.578(2)(d) (2025 ed.))
- Oregon Consumer Privacy Act, controller's use of deidentified data (ORS 646A.583(1)(a) (2025 ed.))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide