Oregon, data broker registration with the Department of Consumer and Business Services (ORS 646A.593(1)(c)-(d), (2)(a))
Oregon requires registration before anyone collects, sells or licenses brokered personal data in the state, and licensing means granting access to data for consideration. A business collecting data about its own customers, subscribers or users is excluded, so the duty falls on buyers and resellers who hold data about strangers.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(c)(A) “Data broker” means a business entity or part of a business entity that collects and sells or licenses brokered personal data to another person. (B) “Data broker” does not include: ... (iii) A business entity that collects information about a resident individual if the resident individual is or was: (I) A customer, subscriber or user of the business entity’s goods or services; ... (d)(A) “License” means a grant of access to, or distribution of, data by one person to another person in exchange for consideration. ... (2)(a) Except as provided in paragraph (b) of this subsection, a data broker may not collect, sell or license brokered personal data within this state unless the data broker first registers with the Department of Consumer and Business Services as provided in subsection (3) of this section.”
Where it was read
Also read from the same source
- Oregon Consumer Privacy Act, definitions (sale) (ORS 646A.570(17)(a) (2025 ed.))
- Oregon Consumer Privacy Act, controller duties (sensitive data consent) (ORS 646A.578(2)(b) (2025 ed.))
- Oregon Consumer Privacy Act, prohibited sales (under-16 data, precise geolocation) (ORS 646A.578(2)(d) (2025 ed.))
- Oregon Consumer Privacy Act, controller's use of deidentified data (ORS 646A.583(1)(a) (2025 ed.))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide