The Oregon Consumer Privacy Act (OCPA, ORS 646A.570 et seq.) has two specific requirements for sites that process data for targeted advertising or sell personal data.

This page covers one piece of the picture. For the full scope of the OCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the OCPA and cookies.

The first is immediate: a clear and conspicuous link on the site to an opt-out page.

The second took effect on January 1, 2026: the obligation to honor opt-out signals sent by platforms, technologies, or mechanisms with consumer consent, such as the Global Privacy Control (GPC).

This article focuses exclusively on what the OCPA requires from a Cookies Policy: what must be in the document, how opt-out must work, and what the law's specific requirements mean for each tracker on your site.

The cookie banner is the visual consent interface. It is what the visitor sees when they first access the site.

The Cookies Policy is the detailed document. It is where the user finds complete information about each technology: what it collects, what it is for, who receives the data, and how to exercise rights.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a clear link within the consent notice itself.

Section 5(1)(a) requires the controller to specify the express purposes for collecting and processing personal data. And Section 5(2)(a) prohibits processing for purposes incompatible with those disclosed, except with new consent.

For cookies, each tracker category needs a specific purpose description, not a generic one.

What does not work: "cookies to improve your experience."

What works: "Analytics cookies: collect browsing behavior data including pages visited, traffic source, and session duration. Used to identify content improvement opportunities. Data is not sold or used for targeted advertising."

"Advertising cookies: collect behavioral identifiers shared with advertising platforms for targeted advertising on non-affiliated websites. Include pixels from Meta Ads and Google Ads. Consumers may exercise opt-out via the link on this page or via GPC."

The Policy must list tracker categories:

Necessary cookies: essential for basic functionality. Authentication, session security, shopping cart. Do not constitute targeted advertising or data sale. Must be documented but do not require opt-out.

Analytics cookies: depends on configuration. If data stays internal, generally does not constitute targeted advertising. If sent to third parties for targeting on other sites, may qualify and requires opt-out.

Advertising cookies: almost always constitute "targeted advertising" under the OCPA, which defines it as ads based on data collected from the consumer's activities over time and across non-affiliated websites or online applications (Section 1(19)).

Functional cookies: remember user preferences. Generally do not constitute targeted advertising or sale, but must be documented.

Third-party cookies: fired by external services. Correct tag categorization is what makes accurate documentation possible.

The OCPA defines targeted advertising (Section 1(19)) as ads selected based on personal data obtained from the consumer's activities over time and across non-affiliated websites or online applications.

What does not constitute targeted advertising (Section 1(19)(b)):

Advertisements based on activities within the controller's own websites or applications.

Advertisements based on the context of the current search query or current visit.

Advertisements directed to a consumer in response to an information request.

Processing personal data solely to measure or report advertising frequency, performance, or reach.

Retargeting campaigns using behavioral data from other sites therefore almost always constitute targeted advertising under the OCPA.

The OCPA defines sale (Section 1(17)) as the exchange of personal data for monetary or other valuable consideration by the controller to a third party.

Not a sale: disclosure to processors, disclosure for products or services requested by the consumer, disclosure to affiliates, disclosure directed by the consumer, and M&A transfers.

If the site shares data with partners in exchange for services or other economic benefits, it may constitute a sale even without direct cash payment.

The Policy must identify the categories of third parties receiving data via cookies, with enough detail for the consumer to understand what type of entity each one is (Section 5(4)(e)).

This includes digital advertising platforms, analytics tools, programmatic advertising networks, email marketing platforms receiving behavioral data, and any other partner receiving identifiers or user behaviors collected via cookie.

The obligation to limit collection to what is necessary (Section 5(1)(b)) implies data should be retained only for as long as necessary. The Cookies Policy must document how long each cookie category stays active and how long data is retained in systems.

Section 5(5)(b) requires a clear and conspicuous link on the controller's website to a page enabling the consumer or their agent to opt out of targeted advertising or sale of personal data.

This link must be visible on the page, not in obscure locations. The Cookies Policy must identify this link and describe how the opt-out works.

Section 5(5)(c) requires that from January 1, 2026, controllers processing for targeted advertising or selling data honor opt-out signals sent with consumer consent by a platform, technology, or mechanism.

In practical terms for cookies: when a user visits the site with the GPC activated in their browser, the site must interpret this as an opt-out of targeted advertising and data sale, and automatically block the corresponding trackers.

The mechanism must meet OCPA-specific requirements (Section 5(5)(c)):

Cannot unfairly disadvantage another controller.

Cannot be a default setting: must represent an affirmative, freely given, and unambiguous consumer choice.

Must be consumer-friendly and easy for the average consumer.

Must be as consistent as possible with similar mechanisms required by other laws.

Must enable the controller to accurately determine whether the consumer is an Oregon resident.

The Cookies Policy must describe how the site processes these signals.

Section 1(6) defines consent as an affirmative act by which the consumer clearly and conspicuously communicates freely given, specific, informed, and unambiguous agreement. The interface may not have any mechanism with the purpose or substantial effect of obtaining consent by obscuring, subverting, or impairing the consumer's autonomy and decision-making. And inaction does not constitute consent.

The correct standard for cookies: non-essential technologies off by default. The user chooses what to enable, not what to disable.

Accepting general terms with data processing descriptions alongside unrelated information.

Continuing to browse without any explicit action.

Interfaces designed to make opting out harder than accepting.

Banners that reappear until the user accepts.

Cookie walls that block content access until all cookies are accepted.

Section 1(6)(a) of the OCPA is explicit: the interface may not have "any mechanism that has the purpose or substantial effect of obtaining consent by obscuring, subverting or impairing the consumer's autonomy, decision-making or choice."

For opt-out requests for targeted advertising, data sales, and profiling, the OCPA does not allow requiring authentication (Section 4(5)(e)).

The controller may ask for information necessary to identify who is requesting the opt-out. But it cannot create barriers that make exercising the right more difficult. If the controller has a good faith, reasonable, and documented belief that a request is fraudulent, it may deny, but must notify the requestor with the reason.

This is more restrictive than what many other US state laws require and means the opt-out mechanism in the Cookies Policy must be functional without authentication steps.

In most cases, yes.

The OCPA defines personal data as including derived data and identifiers reasonably linkable to a consumer. Analytics cookies from major platforms collect identifiers that, when cross-referenced with other data the provider holds, can identify a specific user.

The ANPD Cookie Guidance has already flagged this point: major providers have the ability to cross-reference seemingly anonymous identifiers with other data they hold to re-identify users.

The safest approach: treat analytics cookies as non-necessary in the banner, block them until the consumer makes a choice, and document this categorization in the Cookies Policy.

Section 5(2)(c) prohibits processing data of consumers aged 13 to 15 for targeted advertising, profiling for legal decisions, or data sales without consent, when the controller has actual knowledge of that age range.

As of January 1, 2026, protection was expanded: prohibition on selling data of minors under 16 and on using data of minors under 16 for targeted advertising and certain types of profiling.

For children under 13, COPPA applies per Section 5(2)(b) of the OCPA.

If the site may have users in these age ranges, the Cookies Policy must describe how their data is treated differently.

As of January 1, 2026, controllers are prohibited from selling precise geolocation data of Oregon consumers.

The OCPA defines precise geolocation as data that identifies the consumer's location within a radius of 1,750 feet (approximately 533 meters) using technologies such as GPS (Section 1(18)(a)(C)).

If any cookie or tracker on the site collects location data at that precision, the Cookies Policy must:

Explicitly identify this collection as sensitive data processing.

State that this data is not sold to third parties.

Describe that processing requires explicit consumer consent.

The OCPA requires that processing stay limited to declared purposes (Section 5(2)(a)). Any change in the tool inventory requires a Policy update.

Situations that require an update:

Adding a new advertising pixel or tracker.

A new analytics tool sending data to third parties.

A new partner receiving behavioral data from site users.

Change in the use of cookie data for new purposes.

Any modification to opt-out mechanisms.

Continuous data mapping is what keeps the cookie inventory synchronized with the document.

The first-year enforcement report (August 2025) identified three systemic problems directly related to cookies and trackers:

Businesses not offering the right to list the specific third parties that received data via pixels and trackers.

Back-end data such as marketing profiles created from trackers not being included in copy and deletion requests.

Opt-out forms and mechanisms not working correctly.

As of January 1, 2026, the 30-day cure period was eliminated. The AG can act without prior notice. An inadequate Cookies Policy and a broken opt-out mechanism are exactly what the Oregon DOJ is looking for in investigations.

AdOpt's automatic scan identifies all active technologies on the site, feeding the list of categories that must appear in the Cookies Policy.

The cookie notice configured through AdOpt blocks non-essential trackers before acceptance, presents categories with clear descriptions, offers targeted advertising opt-out without requiring authentication, detects and honors the GPC from January 2026, and logs every interaction.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Cookies Policy for your site that complies with the OCPA? Talk to our team.

Visible link in the footer and within the cookie banner.

Listing of cookie categories with a description of what each does.

Specific purpose for each category, without vague descriptions (Section 5(1)(a)).

Identification of cookies constituting targeted advertising or sale (Section 5(4)(h)).

Categories of third parties receiving data via cookies, with entity type detail (Section 5(4)(e)).

Clear and conspicuous opt-out link for targeted advertising and sale on the site (Section 5(5)(b)).

Opt-out preference signal: description of how GPC is honored from January 2026 (Section 5(5)(c)).

Opt-out without authentication for targeted advertising, sale, and profiling (Section 4(5)(e)).

Non-essential cookies disabled by default, without manipulative design patterns (Section 1(6)(a)).

Protection for teens aged 13 to 15 described where applicable (Section 5(2)(c)).

Prohibition on selling data of minors under 16 from January 2026.

Prohibition on selling precise geolocation data from January 2026.

Retention period for each cookie category.

Active email or online mechanism for contacting the controller (Section 5(4)(f)).

Accessible language, without legal jargon.

No cookie walls.

1. Is the OCPA opt-out link different from the CCPA's "Do Not Sell" link?
They are similar in function but different in requirement. The CCPA requires specific link texts: "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information." The OCPA simply requires a clear and conspicuous link to an opt-out page for targeted advertising or data sale, without mandating specific text (Section 5(5)(b)). Businesses that already have the CCPA links likely satisfy the OCPA requirement, depending on the link's scope.

2. Is the OCPA's opt-out preference signal the same as the GPC?
The GPC is the best-known mechanism meeting the OCPA's technical specifications in Section 5(5)(c). The law does not name the GPC specifically, but the GPC was developed precisely for this type of legal requirement. As long as the mechanism is an affirmative consumer choice (not a default), does not create unfair disadvantage for the controller, and allows verification that the consumer is an Oregon resident, it meets the requirement. As of January 2026, honoring the GPC is mandatory, not optional.

3. Do analytics cookies constitute targeted advertising under the OCPA?
It depends on the tool and configuration. If analytics data stays internal or is sent to the provider only to generate reports without use for targeting on other sites, it generally does not qualify. If the tool sends data used for segmentation on other sites, it may. The OCPA's criterion is data "collected from the consumer's activities over time and across non-affiliated websites or online applications" (Section 1(19)). The criterion is the use of data in environments external to the controller's site.

4. Does the OCPA require teens aged 13 to 15 to consent before any cookie?
Section 5(2)(c) is specific: it prohibits processing data of 13-to-15-year-olds for targeted advertising, profiling for legal decisions, or data sales without those consumers' consent when the controller has actual knowledge. It does not require consent for other types of processing such as internal analytics. As of January 2026, the prohibition extends to minors under 16 for targeted advertising and certain types of profiling.

5. What changes for geolocation cookies from January 2026?
As of January 1, 2026, the OCPA prohibits selling precise location data (within 1,750 feet) of Oregon consumers. Precise geolocation data was already classified as sensitive data by Section 1(18)(a)(C) of the OCPA, requiring explicit consent for processing. With the sales ban now in effect, the Cookies Policy must be updated to explicitly state that precise location data is not sold to third parties.

Ready to build a Cookies Policy for your site that complies with the OCPA? Talk to our team.