Quick answer
If you live in Oregon, you can ask covered companies to delete the personal information they have about you, and they must respond within 45 days. Send your request through the company's privacy form or privacy email, and keep a record of when you sent it.
Your rights under the OCPA
The Oregon Consumer Privacy Act (OCPA) gives Oregon residents the right to:
- Find out what personal information a company has about you
- Get a list of the specific companies it shared your information with
- Have it deleted
- Correct information that's wrong
- Get a copy of your data in a usable format
- Opt out of targeted advertising, the sale of your data, and certain kinds of profiling
What makes Oregon's law stand out
Oregon was one of the first states to let you ask for the names of the specific companies your data was shared with, rather than just general categories like "advertisers." That makes it much easier to follow your data and ask those companies to delete it too. Minnesota now offers a similar right, and Connecticut lets you get a list of the companies your data was sold to.
Oregon's law also has narrower exemptions than many other states' laws. For example, it covers nonprofits, which many states exempt.
Which companies have to comply
Companies and nonprofits doing business in Oregon that handle the personal information of at least 100,000 Oregon residents a year (not counting information used only to process a payment), or at least 25,000 residents if they make more than 25% of their revenue from selling personal information.
That covers most large retailers, streaming services, apps, and online platforms, but not every small business. Certain health, financial, credit-reporting, and other regulated information is exempt when it's covered by specified federal or state laws, and companies can keep data they're legally required to retain.
How to ask a company to delete your data
- Find the company's privacy policy, usually linked at the bottom of its website. Look for a privacy request form or a privacy email address.
- Ask the company to delete your personal information, and say that you're a Oregon resident making the request under the OCPA.
- Expect the company to verify your identity, often by email. That's normal, and it protects you from someone else deleting or requesting your data.
- Write down the date you sent the request. You'll need it if the company misses its deadline.
How long companies have to respond
Companies must respond within 45 days. They can take up to 45 more days when reasonably necessary, as long as they tell you.
If a company ignores or refuses your request
If a company refuses your request, it has to offer a way to appeal. If the appeal is denied too, you can file a complaint with the Oregon Department of Justice.
Make your requests in minutes, not evenings
The hard part isn't the law. It's knowing which companies have your data and writing to each one. DataTrail scans your inbox (read-only) to find every company that has your email address, writes a deletion request that cites the OCPA, and tracks the 45-day deadline for you. You review each one and send it from your own email.
Join the waitlistEnforced by the Oregon Department of Justice. This page is general information, not legal advice, and laws change. For the official text, see Oregon's state legislature or Attorney General website.