Oregon DOJ to Companies: Cure Letters Not Required After Jan. 1
The right to cure in Oregon's comprehensive privacy law sunsets -- and a universal opt-out requirement dawns -- in two months, Oregon DOJ warned businesses in an October enforcement report released Wednesday.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
The department’s privacy unit continued in Q3 2025 to send cure letters to companies under the Oregon Consumer Privacy Act (OCPA), giving their recipients a chance to fix possible problems without penalty, Oregon DOJ said. However, it cautioned that OCPA’s right to cure expires in about two months, on Jan. 1. “After that date, the Privacy Unit is not legally required to provide businesses with an opportunity to fix alleged violations before taking enforcement action. Businesses should expect that Oregon DOJ may use other methods to address OCPA noncompliance, including serving Civil Investigative Demands.”
“Enforcement may also include coordinated action by Oregon with the Consortium of Privacy Regulators,” the report said. Two more state enforcers, attorney general offices from Minnesota and New Hampshire, joined the group of state enforcers earlier this month (see 2510080008).
A delayed provision in OCPA requiring companies to comply with requests from universal opt-out preference signals will also take effect this January, Oregon DOJ noted. “This is already a requirement under several states’ privacy laws, and Oregon is working on a public education campaign to help Oregonians understand this technology.”
The privacy unit received 51 consumer complaints from July 1-Sept. 30, Oregon DOJ reported. The unit has received 265 complaints since OCPA took effect on July 1, 2024, it said.
The Oregon enforcer noted that it has revised outreach materials to reflect an OCPA amendment that took effect in September. Under HB-3875, signed May 27, Oregon privacy rules related to collecting and using personal data, including consumer rights to access, correct, delete and port data, now apply to car manufacturers and some of their affiliates (see 2506040027).
Meanwhile, the privacy unit is “developing resources” for another amendment (HB-2008) that took effect this year. That update to OCPA prohibits processing, profiling or selling data of a consumer who a controller knows is younger than 16. It also bans selling precise geolocation data that shows the location of a consumer within 1,750 feet.
Oregon DOJ in September issued another privacy enforcement report, which covered the first year since OCPA took effect. It found that many of the consumer complaints related to data brokers (see 2509020036).