Oregon Consumer Privacy Act

Applies at 100,000+ Oregon consumers, or 25,000+ if you derive revenue from selling personal data (nonprofits get a delayed effective date of Jul 1, 2025 but most are otherwise covered — only insurance-fraud-detection nonprofits and certain noncommercial publisher/broadcaster activity are exempt). Oregon's HIPAA exemption is data-level only (covers PHI processed per HIPAA, not covered entities/business associates as a whole). Its GLBA exemption is also data-level for GLBA-regulated data generally; a separate, much narrower entity-level carve-out exists only for FDIC-insured banks and Oregon/federally chartered credit unions (not GLBA-regulated financial institutions generally). No general higher-education exemption — only Oregon Health & Science University is separately named as an exempt public corporation.