Are Nonprofits Exempt From Oregon's Consumer Privacy Act?

No. Oregon's Consumer Privacy Act (OCPA) does not give nonprofit organizations a blanket exemption the way many other state privacy laws do. The law's general effective date was July 1, 2024, and 501(c)(3) tax-exempt organizations were given a one-year delay before becoming subject to it — meaning Oregon has been able to enforce OCPA against nonprofits since July 1, 2025.

Why Oregon Delayed Nonprofit Compliance by a Year

Lawmakers built in the delayed timeline specifically because nonprofits needed extra lead time to build compliance programs most hadn't needed before, not because the legislature intended to carve them out permanently. That one-year gap between the general effective date and the nonprofit effective date is itself the distinguishing feature of Oregon's approach: most states that address nonprofits at all either exempt them outright or treat them the same as for-profit businesses from day one.

What Nonprofits Have to Do Now

Since July 1, 2025, a 501(c)(3) organization operating in Oregon or targeting Oregon residents has to meet the same core OCPA obligations a for-profit business does if it meets the law's applicability threshold — honoring consumer rights requests, maintaining a privacy notice, and conducting data protection assessments for higher-risk processing such as targeted advertising or the sale of personal data. Fundraising and donor-outreach programs that rely on behavioral data or third-party ad platforms fall squarely inside that scope.

Enforcement and the Cure Period

The Oregon Attorney General holds exclusive enforcement authority and can seek civil penalties of up to $7,500 per violation, plus injunctive relief. A statutory cure period required the AG to issue a cure notice and give 30 days to fix a remediable violation for conduct occurring between July 1, 2024 and January 1, 2026 — a window that has now closed entirely, for nonprofits and for-profits alike, so enforcement today proceeds without that automatic grace period. In the law's first year, Oregon's Department of Justice issued 28 notices of violation and assessed no civil penalties, since the cure period allowed those issues to be corrected first; that cushion is gone now.

How Oregon Compares to States That Do Exempt Nonprofits

Several other state privacy laws — including Virginia's and Colorado's original frameworks — either fully exempt nonprofits or exempt specific categories of them. Oregon deliberately chose not to follow that pattern, making it one of the clearer examples of a state treating charitable and advocacy organizations' data practices as warranting the same scrutiny as commercial ones, on a delayed but equal footing.

Bottom Line

Nonprofit marketing and development teams running Oregon-facing campaigns should treat OCPA compliance as mandatory, not optional — the one-year delay nonprofits got has already passed, the cure period has closed, and the Oregon AG can now pursue enforcement against charitable organizations the same way it can against any other covered business.

Sources: Tonkon Torp's alert on OCPA enforcement taking effect for nonprofits on July 1, 2025, DWT's and Alston & Bird's 2023 summaries of the Oregon Consumer Privacy Act's general effective date and nonprofit compliance delay, and Stoel Rives' 2026 compliance update noting the cure period's January 1, 2026 end date and the Oregon DOJ's first-year enforcement numbers.