Oregon recently enacted a comprehensive consumer state data privacy law (the "Act"), following multiple other states including: California, Colorado, Connecticut, Indiana, Iowa, Montana, Tennessee, Texas, Utah, and Virginia. The Act will go into effect on July 2024. The Act applies to any person that conducts business in Oregon, or that provides products or services to Oregon residents, and that during a calendar year, controls or processes: (the personal data of 100,000 or more consumers, other than personal data controlled or processed solely for the purpose of completing a payment transaction; or (ii) the personal data of 25,000 or more consumers, while deriving 25 percent or more of the person's annual gross revenue from selling personal data. "Personal data" is defined as "data, derived data or any unique identifier that is linked to or is reasonably linkable to a consumer or to a device that identifies, is linked to or is reasonably linkable to one or more consumers in a household." It excludes deidentified data or data that "is lawfully available through federal, state or local government records or through widely distributed media" or that a "controller reasonably has understood to have been lawfully made available to the public by a consumer." The Act differentiates a "controller," which is "a person that, alone or jointly with another person, determines the purposes and means for processing personal data," from a "processor," which is "a person that processes personal data on behalf of a controller." The Act grants Oregon consumers certain rights with respect to their personal data. Specifically, a consumer, or their authorized agent, may request, among other things: (confirmation from a controller as to whether the controller is processing or has processed the consumer's personal data and the categories of personal data the controller is processing or has processed; (ii) a copy of all of the consumer's personal data that the controller has processed or is processing in a portable and readily usable format; (iii) correction of inaccuracies in personal data about the consumer; (iv) deletion of the consumer's personal data; and (an ability to opt-out of any sale, targeted advertising, or certain types of profiling related to the processing of personal data.