Oregon data broker registration
Oregon: data broker registration, by 1 December each year, at least 30 days before the 31 December expiry, at the Oregon Division of Financial Regulation.
Who registers
A business, or part of one, that collects and sells or licenses brokered personal data to another person. Exempt: FCRA and GLBA activity, data from your own customers, employees, investors or donors and their service providers, and activity limited to public professional or government-record data, publishing, e-commerce software, directory assistance or a one-time asset sale. No HIPAA carve-out.
When and what it costs
- First registration
- Before selling or licensing brokered personal data; you need an active Oregon business registration and a registered agent first Fee $600.
- Renewal
- By 1 December each year, at least 30 days before the 31 December expiry, $600, not pro-rated.
- Where
- the Oregon Division of Financial Regulation
- Public notice
- No website notice; the opt-out methods you declare are published on the Division's site. Tell the Division within 45 days of any change or breach.
- If missed
- Up to $500 a violation or $500 a day while it continues, capped at $10,000 a calendar year; the registration can be suspended or ended (ORS 646A.593(7)).
- Rule
- ORS 646A.593; OAR 441-840-0040, 441-840-0070 (source, read 2026-09-30)
- Also
- A late renewal between 1 January and 28 February costs $50 extra; from 1 March a new application is needed.
How DROP runner handles it
DROP runner runs your California deletion cycle every 45 days. Its calendar also carries every state registry you tick: the first-cycle deadline where a registry is new, the renewal date each year (on your own anniversary where the state works that way), the fee, and a link to the official place to file. Reminders arrive 45, 30, 14, 7 and 1 days ahead. You file and pay yourself.
Other states: California, Connecticut, Texas, Vermont. Information from the state's own published rules; not legal advice.