Oregon passed a privacy law with at least three characteristics you will probably not find in any other US state legislation.

The Oregon Consumer Privacy Act (OCPA), ORS 646A.570 to 646A.589, took effect on July 1, 2024. Developed by the Attorney General's Consumer Privacy Task Force with more than 150 experts involved, and signed by Governor Tina Kotek.

In the first year of enforcement: 214 complaints received, 38 investigations opened. Enforcement is real.

The OCPA is Oregon's state personal data protection law. It grants rights to state residents and creates obligations for businesses that process their data.

Enforcement is the exclusive responsibility of the Oregon Attorney General. There is no private right of action.

On July 1, 2024.

Two important changes came into force on January 1, 2026: the obligation to honor universal opt-out signals such as the Global Privacy Control (GPC), and the elimination of the 30-day cure period. From that date, the Attorney General can act without prior notice.

Under Section 2(1) of the law, it applies to persons that conduct business in Oregon or produce products or services targeted to state residents and that, during a calendar year:

Control or process personal data of at least 100,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.

Or control or process personal data of at least 25,000 consumers while deriving 25% or more of annual gross revenue from selling personal data.

Three points that distinguish the OCPA from virtually all other state laws:

The payment transaction exclusion from the 100K threshold: data processed exclusively to complete payments does not count toward the 100K threshold. This is different from other laws that do not make this exclusion.

The 25% revenue threshold: most state laws use 50% of revenue from data sales. The OCPA uses 25%, making the second criterion easier to reach.

The inclusion of derived data in the definition of personal data: profiles created from the consumer's data are also personal data under the OCPA. This directly impacts the scope of access and deletion requests.

Understanding the distinction between controller and processor is fundamental to defining responsibilities in the processing chain.

Under Section 2(2), the following are exempt:

Government entities and public corporations of Oregon, including Oregon Health and Science University and the Oregon State Bar.

Protected health information processed by covered entities or business associates under HIPAA.

Information used solely for public health purposes.

Clinical research data regulated by federal standards.

Data processed solely in the context of employment, contractual relationships with business entities, or employer benefits.

Data regulated by the Fair Credit Reporting Act, Gramm-Leach-Bliley Act, FERPA, and Airline Deregulation Act (within each law's limits).

Financial institutions and their affiliates engaged solely in financial activities.

Insurers, insurance producers, and insurance consultants.

Non-profit organizations established to detect and prevent insurance fraud.

Non-commercial activities of press outlets and licensed radio and TV broadcasters.

As of July 1, 2025, non-profit organizations under section 501(c)(3) of the Internal Revenue Code became subject to the OCPA.

As of September 26, 2025, all auto manufacturers that collect personal data from Oregon consumers are subject to the law regardless of thresholds.

Under Section 1(13), personal data means data, derived data, or any unique identifier linked to or reasonably linkable to a consumer or to a device that identifies, is linked to, or is reasonably linkable to one or more consumers in a household.

De-identified data and data lawfully available through government records or widely distributed media are excluded.

The explicit inclusion of derived data is a key differentiator of the OCPA. Marketing profiles, behavioral scores, and audience segment classifications created from consumer data are personal data under the law.

Under Section 1(18), sensitive data includes:

Data revealing racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, status as transgender or nonbinary, status as a crime victim, or citizenship or immigration status.

Personal data of children under 13.

Precise geolocation data within a radius of 1,750 feet (approximately 533 meters).

Genetic or biometric data.

Sensitive data cannot be processed without explicit consumer consent, per Section 5(2)(b) of the OCPA.

The Oregon Department of Justice created the L.O.C.K.E.D. acronym to summarize the rights guaranteed by Section 3(1) of the OCPA:

L (List): obtain a list of the specific entities to which the controller disclosed their personal data, or a list of any personal data disclosed.

O (Opt-out): refuse processing of data for targeted advertising, sale of personal data, and profiling for decisions with legal effects or effects of similar significance.

C (Copy): obtain a copy of all personal data the controller has processed, in a portable and readily usable format where technically feasible.

K (Know): confirm whether the controller processes or has processed their data and which categories are involved.

E (Edit): correct inaccuracies in personal data, taking into account the nature and purpose of processing.

D (Delete): request deletion of personal data, including data provided by the consumer, obtained from other sources, and derived data.

The controller has 45 days to respond (Section 4(5)(a)). The deadline may be extended by an additional 45 days when reasonably necessary, with notification within the initial period.

Response is free once per 12-month period per consumer. For subsequent requests within the same period, the business may charge a reasonable fee, except when the request verifies compliance with a prior correction or deletion (Section 4(5)(c)).

Section 4(6) requires the controller to establish an appeal process. It must be conspicuously available, similar to the original submission method, and result in a written response within 45 days with the decision and reasoning.

If the appeal is denied, the notice must provide information enabling the consumer to contact the Attorney General.

Under Section 1(6), consent is an affirmative act by which the consumer clearly and conspicuously communicates freely given, specific, informed, and unambiguous agreement. The interface may not have any mechanism with the purpose or substantial effect of obtaining consent by obscuring, subverting, or impairing the consumer's autonomy and decision-making. And inaction does not constitute consent.

The correct standard for cookies: non-essential technologies off by default. The user chooses what to enable, not what to disable.

Under Section 5, the controller must:

Specify in the privacy notice the express purposes for collecting and processing personal data.

Limit collection to what is adequate, relevant, and reasonably necessary for the declared purposes.

Implement reasonable technical, administrative, and physical safeguards to protect the data.

Provide a consent revocation mechanism at least as easy as the consent mechanism. After revocation, cease processing within 15 days (Section 5(1)(d)).

Not process data for purposes incompatible with those declared, unless the consumer consents.

Not process sensitive data without prior consumer consent.

Not process data of consumers aged 13 to 15 for targeted advertising, profiling, or data sales without explicit consent.

Not discriminate against consumers who exercise their rights.

Provide an accessible, clear, and meaningful privacy notice with an actively monitored contact channel.

Establish a DSAR channel without requiring creation of a new account.

Conduct and document Data Protection Assessments for high-risk activities.

Section 5(2)(c) prohibits processing data of consumers aged 13 to 15 for targeted advertising, profiling for decisions with legal effects, or data sales without those consumers' consent, when the controller has actual knowledge or willfully disregards that age range.

As of January 1, 2026, protection was expanded: prohibition on selling data of minors under 16 and on using data of minors under 16 for targeted advertising and certain types of profiling.

Section 5(1)(d) requires the controller to provide an effective consent revocation mechanism at least as easy as the consent mechanism. After revocation, the controller must cease processing as soon as practicable, but not later than 15 days.

Cookies that collect personal data or allow user identification fall directly within the OCPA's scope.

The controller must display a clear cookie notice, provide an opt-out mechanism for targeted advertising, block non-necessary trackers before they fire, and honor consumer preferences.

Correct tag categorization is what makes it possible to identify which cookies constitute targeted advertising or data sales.

Section 1(19) defines targeted advertising as ads selected based on data collected from the consumer's activities over time and across one or more non-affiliated websites or online applications.

As of January 1, 2026, Section 5(5)(c) requires controllers to honor opt-out signals sent with the consumer's consent by platforms, technologies, or mechanisms such as the Global Privacy Control (GPC). A visitor with the GPC enabled is equivalent to a visitor who clicked the opt-out button.

Under Section 8, the controller must conduct and document Data Protection Assessments for:

Processing data for targeted advertising.

Processing sensitive data.

Selling personal data.

Profiling that presents a reasonably foreseeable risk of unfair treatment, financial, physical, or reputational harm, intrusion into privacy, or other substantial harm.

Assessments must be retained for at least five years (Section 8(6)) and are confidential. The Attorney General may request access during investigations without that constituting a waiver of attorney-client privilege.

Under Section 9, the Oregon Attorney General has exclusive enforcement authority. There is no private right of action.

Through December 31, 2025: the AG was required to notify the controller and grant 30 days to cure violations before initiating formal action.

As of January 1, 2026: the cure period was eliminated by Section 11. The AG may initiate action directly.

If violations are identified, the AG may seek:

Injunction to stop the violations.

Civil penalties of up to US$ 7,500 per violation (Section 9(4)(a)).

Recovery of attorney fees and investigation costs.

The AG has five years from the last act constituting the violation to bring an action.

Understand what you collect, including derived data, where it is, how it is used, and who it is shared with. Data mapping is the foundation of any compliance program.

The document must cover all requirements of Section 5(4), including an actively monitored contact channel and a detailed description of third-party categories.

A cookie banner that blocks non-necessary trackers before acceptance, records preferences, offers opt-out from targeted advertising, and honors the GPC from January 2026.

At least one secure and reliable mechanism for receiving requests, without requiring creation of a new account.

For each high-risk processing activity, conduct and document the assessment per Section 8. Retain for at least 5 years.

Contracts with service providers that process data on your behalf must meet the requirements of Section 6 of the OCPA.

Applying privacy by design from the start of product development is what makes compliance sustainable over time.

AdOpt records every consent interaction, blocks trackers before acceptance, honors the GPC from January 2026, processes consent revocations within 15 days, and generates the auditable log needed in an Oregon Attorney General investigation.

The automatic scan identifies all active trackers on the site, feeding the data inventory. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Ready to bring your website into compliance with the Oregon OCPA? Talk to our team.

To understand how these privacy laws compare in depth, our comparative guide goes further.

Compliance with the OCPA rests on three documents that have to agree with each other: the cookies policy, which declares every tracker and its purpose; the privacy policy, which explains what you do with the data; and the privacy portal, where the consumer exercises their rights and you keep the record of it.

1. What is the OCPA and when did it take effect?
The Oregon Consumer Privacy Act (ORS 646A.570–646A.589) is Oregon's state personal data protection law. It took effect on July 1, 2024. It has specific differentiators from other state laws: the payment transaction exclusion from the 100K threshold, the 25% revenue threshold from data sales, the inclusion of derived data in the personal data definition, and the express 15-day deadline for cessation after consent revocation. As of January 2026, it added the GPC requirement and eliminated the 30-day cure period.

2. What makes the OCPA threshold different from other state laws?
The OCPA has two particularities in the threshold: it explicitly excludes data processed solely for payment transactions from the 100K consumer count, and uses 25% of revenue from data sales as the second criterion (vs. 50% in laws like the VCDPA and Colorado CPA). The 25% threshold is shared with Connecticut's CTDPA, but the payment transaction exclusion makes both laws the most specific on this point among all US state privacy laws.

3. What is the 15-day consent revocation deadline in the OCPA?
Section 5(1)(d) requires that after receiving a consumer's consent revocation, the controller cease processing as soon as practicable, but not later than 15 days. This express deadline is unique to the OCPA (shared with Connecticut's CTDPA) and distinguishes both from other US state laws that require cessation "without undue delay" without a specific timeframe.

4. What is the Global Privacy Control and why does the OCPA require honoring it?
The Global Privacy Control (GPC) is a technical signal that consumers activate in their browsers to automatically request opt-out from data sales and targeted advertising on all sites they visit. As of January 1, 2026, Section 5(5)(c) of the OCPA requires controllers to honor this signal as a valid opt-out request. A visitor with GPC enabled is equivalent to a visitor who clicked the opt-out button.

5. What is the penalty for non-compliance with the OCPA?
The Attorney General may seek civil penalties of up to US$ 7,500 per violation, plus injunctive relief and recovery of attorney fees and investigation costs. As of January 2026, there is no longer a 30-day cure period before formal action. The AG may act directly without prior notice. There is no private right of action (Section 9).

Ready to bring your website into compliance with the Oregon OCPA? Talk to our team.