The Oregon Consumer Privacy Act (OCPA, ORS 646A.570 et seq.) has several particularities in the DSAR process that distinguish it from other US state laws.

This page covers one piece of the picture. For the full scope of the OCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the OCPA and cookies.

The most important: opt-out requests do not require authentication. And the right to list third parties that received personal data was the most frequently denied right in the first year of enforcement. The report from Attorney General Dan Rayfield (August 2025) showed businesses simply did not have that record structured.

This article covers everything: what a DSAR is under the OCPA, what rights are guaranteed under the L.O.C.K.E.D. system, specific deadlines, authentication rules, and how to build a Privacy Portal that works for Oregon law.

DSAR stands for Data Subject Access Request. It is any formal request made by an Oregon resident to exercise the rights the OCPA guarantees over their own data.

Under Section 4(1), consumers exercise their rights through means established by the controller and described in the privacy notice.

If you already know the LGPD data subject portal, the structure is familiar. The OCPA adds specific rules about derived data, opt-out without authentication, and the role of universal opt-out signals via technology.

The L.O.C.K.E.D. system from the Oregon Department of Justice summarizes the rights of Section 3(1) of the OCPA:

The consumer may request a list of the specific entities to which the controller has disclosed their personal data, or a list of any personal data disclosed (Section 3(1)(a)(B)).

The controller may choose to provide: (i) a list of specific third parties that received the individual consumer's data, or (ii) a list of any third party that received any personal data from the controller.

This was the most frequently denied right in the first year of enforcement. Businesses did not have the record of data sharing structured in a way that allowed them to respond to this request.

The consumer may obtain confirmation that the controller processes or has processed their personal data and which categories are involved (Section 3(1)(a)(A)).

The consumer may obtain a copy of all personal data the controller has processed, in a portable format and readily usable where technically feasible (Section 3(1)(a)(C)).

This scope includes derived data. Marketing profiles, behavioral scores, and audience segment classifications created from the consumer's data are part of the copy that must be delivered.

The enforcement report identified that businesses were not including back-end data such as marketing profiles in responses to copy requests. This constitutes a direct violation of the law.

The consumer may request correction of inaccuracies in personal data, taking into account the nature and purpose of processing (Section 3(1)(b)).

The consumer may request deletion of personal data, including (Section 3(1)(c)):

Data the consumer provided directly to the business.

Data the business obtained from other sources about the consumer.

Derived data created by the business from other data.

For data obtained from third parties, the OCPA provides an alternative. The controller may fulfill the deletion request by either deleting the data entirely, or opting the consumer out of processing their data for any purpose other than those exempt under Section 2(3) (Section 4(7)).

The consumer may refuse processing of data for three specific purposes (Section 3(1)(d)):

Targeted advertising.

Sale of personal data.

Profiling in furtherance of decisions that produce legal effects or effects of similar significance (such as access to credit, housing, insurance, employment, or health care services).

Under Section 4(5)(a):

45 days to respond from receipt of the request.

Extension of +45 days when reasonably necessary, considering complexity and volume of requests, with notification within the initial period.

Appeal: 45 days for a written response with decision and reasoning (Section 4(6)(d)).

Free once per 12-month period per consumer (Section 4(5)(c)). For subsequent requests, may charge a reasonable fee, except when verifying compliance with a prior correction or deletion.

A key distinction from Connecticut's CTDPA: the OCPA sets a 45-day appeal deadline, while the CTDPA sets 60 days. The OCPA is faster on appeals.

Section 4(6) requires the controller to establish an appeal process that is conspicuously available and similar to the original submission process.

The process must:

Allow a reasonable period after the consumer receives the denial for them to appeal.

Be comparable to the original request submission process.

Result in a written response within 45 days with the decision and reasoning.

If the appeal is denied, the notice must provide or specify information enabling the consumer to contact the Attorney General to submit a complaint (Section 4(6)(d)).

Section 4(5)(e) of the OCPA has a different authentication rule for opt-outs:

For exercising access, correction, deletion, and portability rights: the controller may request additional information reasonably necessary to authenticate. If unable to authenticate, it is not required to comply, but must notify the consumer (Section 4(5)(d)).

For opt-out requests: the controller cannot require authentication. It may ask only for information necessary to identify who is making the opt-out request. If it has a good faith, reasonable, and documented belief that a request is fraudulent, it may deny, but must notify the requestor explaining why and that it will not comply.

This distinction matters for the Privacy Portal: the opt-out mechanism must work without authentication barriers.

Section 4(4) allows consumers to designate another person as an authorized agent to exercise the opt-out on their behalf. This includes via technology: an internet link, browser setting, browser extension, or global device setting.

The controller must honor the opt-out received from an authorized agent if it can verify, with commercially reasonable effort, the identity of the consumer and the authority of the agent.

As of January 1, 2026, controllers processing for targeted advertising or selling data must accept opt-outs via signal sent with consumer consent (Section 5(5)(c)). This includes the Global Privacy Control (GPC).

Sections 5(4)(i) and 5(5) require the controller to establish and describe in the privacy notice the method for submitting requests. This method must:

Consider how consumers normally interact with the controller.

Ensure security and reliability in communications.

Allow authentication of the consumer's identity.

Provide a clear and conspicuous link for opting out of targeted advertising.

The controller cannot require creation of a new account (Section 4(2)). It may require use of an existing account.

Additionally, Section 5(5)(b) specifically requires a clear and conspicuous link on the site to an opt-out page for targeted advertising and data sale.

As of January 1, 2026, the channel must also recognize and honor universal opt-out signals such as the GPC, per Section 5(5)(c).

A well-structured Privacy Portal offers:

A submission form with clear categories (list of third parties, access/copy, correction, deletion, opt-out from advertising/sale/profiling).

A proportionate and non-discriminatory identity verification process.

Automatic receipt confirmation with a tracking number.

A record of each request, action taken, and response sent.

An appeal channel for denied requests.

The site consent mechanism and the Privacy Portal must be integrated so that consumer preferences are reflected across the business's operational systems.

Receive and authenticate the consumer's identity.

Consult the data sharing record.

Decide whether to provide: (i) a list of specific third parties that received the consumer's data, or (ii) a list of any third party that received any personal data.

Prepare response within 45 days.

Without a structured sharing record, compliance is impossible. Building a data sharing map is a prerequisite.

Receive and authenticate.

Locate all personal data in systems, including derived data such as marketing profiles and behavioral scores.

Prepare response in portable format within 45 days.

Receive and authenticate.

Check for a legal exemption (Section 2(3)).

For data provided by the consumer: delete from all relevant systems.

For data obtained from third parties: delete entirely or opt the consumer out of processing for non-exempt purposes (Section 4(7)).

Confirm to the consumer within 45 days.

Receive the request (via Portal, site link, or opt-out signal such as the GPC from 2026).

Authentication is not required to process.

Monitor for fraud indicators. If there is documented reasonable suspicion: notify the requestor.

Otherwise: cease processing for the indicated purposes.

Receive via Portal.

Identify whether the profiling in question is for decisions with legal effects or effects of similar significance.

If yes: cease using the data for those decisions.

Inform the consumer of the result within 45 days.

Under Section 4(5)(b), the controller that does not take action must inform the consumer without undue delay, but no later than 45 days, with:

The justification for not taking action.

Instructions on how to appeal the decision.

If the consumer had consented to processing of sensitive data or other consent-based processing and then decides to revoke, Section 5(1)(d) requires:

A revocation mechanism at least as easy as the consent mechanism.

Cessation of processing as soon as practicable, but not later than 15 days after receiving the revocation.

This deadline must be built into consent management systems and Privacy Portal operational processes.

Section 4(3) allows parents or legal guardians to exercise rights on behalf of children under 13.

Section 4(3) also allows guardians or conservators to exercise rights on behalf of consumers under guardianship, conservatorship, or other protective arrangement.

For teens aged 13 to 15: the controller cannot process data for targeted advertising or sale without those consumers' consent (Section 5(2)(c)).

As of January 2026: prohibition on selling data of minors under 16 and on using data of minors under 16 for targeted advertising.

Section 5(2)(d) prohibits discriminating against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs where the difference is reasonably related to the value the data provides (Section 5(3)(b)).

Through December 31, 2025, the AG was required to notify the business and grant 30 days to cure violations before initiating formal action.

As of January 1, 2026, that period was eliminated. The AG may act directly (Section 11 of the OCPA).

Businesses without a structured DSAR process cannot correct in 30 days what should have been implemented from the start. Without the cure period, the risk is even greater. Penalties can reach US$ 7,500 per violation, with each consumer whose right was violated potentially counting as a separate violation.

AdOpt records every consent, opt-out, and revocation interaction with a timestamp and unique identifier. When the consumer exercises opt-out via the Portal or via a signal like the GPC from 2026, the system automatically updates the corresponding trackers.

The system processes consent revocations and ensures cessation within 15 days. AdOpt's auditable log serves as evidence of compliance for the Attorney General.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Portal for your site that complies with the OCPA? Talk to our team.

Request submission channel without requiring creation of a new account (Section 4(2)).

Clear and conspicuous link on the site for opt-out from targeted advertising and sale (Section 5(5)(b)).

Opt-out preference signal honored from January 2026 (Section 5(5)(c)).

Coverage of all L.O.C.K.E.D. rights: list of third parties, access/confirmation, copy (including derived data), correction, deletion, opt-out.

Derived data included in the scope of copy and deletion (Sections 3(1)(a)(C) and 3(1)(c)).

Opt-out without mandatory authentication for targeted advertising, sale, and profiling (Section 4(5)(e)).

Fraud denial process documented for opt-outs denied on suspicion of fraud.

Authorized agents accepted for opt-out, including via technology (Section 4(4)).

Deadlines: 45 days to respond (+45 ext.); 45 days for appeal.

Appeal mechanism conspicuously available and similar to original process (Section 4(6)).

Reference to the AG provided when appeal is denied (Section 4(6)(d)).

Free service once per 12-month period per consumer (Section 4(5)(c)).

15-day consent revocation honored (Section 5(1)(d)).

Documented record of each request, action taken, and response sent.

Parents/legal guardians may exercise rights for children under 13 (Section 4(3)).

Guardians/conservators may exercise rights for consumers under protective arrangements (Section 4(3)).

Teen protection 13-15: consent process before processing for advertising/sale.

1. Why does opt-out not require authentication under the OCPA?
Section 4(5)(e) establishes that for opt-out requests from targeted advertising, sale, and profiling, the controller must comply without requiring authentication. The rationale is that opt-out is a basic right that should not have unnecessary barriers. The controller may deny only if it has a documented good-faith belief that the request is fraudulent, and must notify the requestor with the reason. Without that notification, the denial may be considered a violation.

2. Why was the right to list third parties the most denied right in the first year?
The report from AG Dan Rayfield (August 2025) identified that businesses simply did not have the structured record of who had received personal data. To comply with Section 3(1)(a)(B), the controller must know exactly which entities received data from a specific consumer, or which entities received any personal data from the controller. Without an updated data sharing map, it is impossible to respond to this request.

3. What makes the deletion of derived data a key differentiator of the OCPA?
The OCPA explicitly includes derived data in the personal data definition (Section 1(13)) and in the scope of the right to deletion (Section 3(1)(c)). When a consumer requests deletion, marketing profiles, propensity scores, and audience segment classifications created from their data must also be deleted. The enforcement report identified that businesses were not including this data in responses, which constituted a direct violation.

4. Who may exercise rights on behalf of other consumers under the OCPA?
Section 4(3) allows parents or legal guardians to exercise rights on behalf of children under 13, and guardians or conservators to exercise rights on behalf of consumers under protective arrangements. Section 4(4) allows any consumer to designate an authorized agent for opt-out, including via technology such as a browser extension or device setting.

5. What happens if the controller does not have a DSAR process when the Attorney General investigates?
As of January 2026, there is no longer a 30-day cure period. The AG may initiate action directly (Section 11 of the OCPA). If violations are identified, penalties of up to US$ 7,500 per violation may be sought. Each consumer whose right was violated can be counted as a separate violation, quickly escalating the financial exposure. The 2025 enforcement report showed that inaccessible or non-functional rights forms were among the most common problems found during investigations.

Ready to build a Privacy Portal for your site that complies with the OCPA? Talk to our team.