Oregon Tightens Restrictions on Sale of Geolocation Data
Phased updates to the Oregon Consumer Privacy Act took effect at the start of 2026, following the bulk of the law's applicability since mid-2024, according to tracking by the IAPP. Covered businesses must now recognize universal opt-out preference signals sent automatically by a consumer's browser or device, rather than requiring a manual opt-out on every individual site.
The updated law also introduces stricter data processing restrictions for children under 16 and moves to end the sale of precise geolocation data outright — part of a broader 2026 trend of states singling out continuous location history as too sensitive for standard data-broker resale.
Regulators and privacy researchers have pointed to the unique risk profile of geolocation data: unlike a single address, a continuous location history reveals patterns — commute routes, workplace, medical visits — that can enable re-identification even from data initially collected in an aggregated or "anonymized" form.
Oregon's move follows earlier state-level actions restricting the resale of location data to data brokers, reflecting growing scrutiny of industries including retail foot-traffic analytics and location-based advertising.
See our explainer on how much your location data is worth and why it commands a premium over basic demographic data.
Source: IAPP.