The Oregon Consumer Privacy Act (OCPA, ORS 646A.570 et seq.) has a specific requirement for the privacy notice that does not appear as explicitly in other US state privacy laws: the notice must include an active email address or other online method that the controller actively monitors.

This page covers one piece of the picture. For the full scope of the OCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the OCPA and cookies.

Publishing an email is not enough. It needs to be genuinely monitored. The first-year enforcement report (August 2025) identified non-functional contact channels as one of the most common problems found during investigations.

This article focuses exclusively on what the OCPA requires from the Privacy Policy, based on the official text of the law.

The law uses the term privacy notice. In practice, it is the Privacy Policy that most sites already have, but with OCPA-specific content elements.

Section 5(4) requires the controller to provide consumers with a privacy notice that is "reasonably accessible, clear, and meaningful."

The notice must list the categories of personal data processed by the controller, including categories of sensitive data (Section 5(4)(a)).

Personal data under the OCPA includes derived data, an important differentiator from other laws. Marketing profiles and behavioral scores created from the consumer's data are personal data under the law.

Sensitive data, per Section 1(18), includes: racial or ethnic background, religious beliefs, mental or physical condition, sexual orientation, status as transgender or nonbinary, status as a crime victim, citizenship or immigration status, precise geolocation data (within 1,750 feet), genetic or biometric data, and personal data of children under 13. Any of these categories must be explicitly listed.

The notice must describe the controller's purposes for processing personal data (Section 5(4)(b)).

Section 5(2)(a) prohibits processing for purposes not reasonably necessary or compatible with those declared, except with consumer consent.

Vague descriptions like "improve your services" or "personalize your experience" do not meet the requirement. "Behavioral data collected via analytics to identify pages with high abandonment rates and prioritize usability improvements" is the correct level of specificity.

The notice must describe how consumers can exercise the rights guaranteed by the OCPA and how to appeal a denial decision (Section 5(4)(c)).

It is not enough to list that rights exist. The process must be described: which channel to use, how identity authentication works, the 45-day response deadline, and how the appeal process works with its 45-day response period.

The data protection officer or compliance lead must have this workflow mapped and operationally functional.

If the business shares data with third parties, the notice must disclose all categories of personal data shared, including categories of sensitive data (Section 5(4)(d)).

This covers email marketing tools, CRMs, analytics platforms, advertising networks, payment processors, and any external service that receives user data.

This is the OCPA's most specific requirement compared to other US state laws. Section 5(4)(e) requires that the notice describe all categories of third parties with whom data is shared at a level of detail that enables the consumer to understand what type of entity each third party is and, to the extent possible, how each third party may process personal data.

Generic categories like "business partners" are not sufficient. The correct level is something like: "audience analytics platforms that use browsing data to generate aggregated usage reports" or "digital advertising networks that use behavioral identifiers to display personalized ads on other sites the consumer visits."

Section 5(4)(f) requires the notice to include an email address or other online method the consumer may use to contact the controller, and that channel must be actively monitored by the controller.

This is one of the OCPA's most specific requirements. Publishing an email address that nobody checks does not comply. The 2025 enforcement report confirmed that non-functional contact channels were among the most frequent problems found during investigations.

The notice must identify the controller, including the business name registered with the Oregon Secretary of State and any assumed business name used in the state (Section 5(4)(g)).

If the company operates under a brand different from its legal name, both must be identified.

If the business processes data for targeted advertising or profiling for decisions with legal effects or effects of similar significance, the notice must describe this clearly and conspicuously, with the opt-out procedure accessible (Section 5(4)(h)).

Targeted advertising, per Section 1(19), consists of ads based on data collected from the consumer's activities over time and across non-affiliated websites or online applications. Contextual ads based on the current session are not included.

If your site uses a Meta Pixel, Google Ads, TikTok Pixel, or any programmatic advertising tool that collects data in other environments, you are operating targeted advertising and must disclose this explicitly.

The notice must describe the method or methods the controller has established for consumers to submit rights requests (Section 5(4)(i)).

Per Section 5(5), this method must:

Consider how consumers normally interact with the controller.

Ensure security and reliability in communications.

Allow authentication of the consumer's identity.

Provide a clear and conspicuous link for opting out of targeted advertising.

As of January 1, 2026, it is also mandatory to honor universal opt-out signals, such as the Global Privacy Control (GPC), provided they meet specific technical requirements (Section 5(5)(c)).

Must not require the consumer to create a new account. The business may require use of an existing account, but cannot force new registration to exercise rights guaranteed by law (Section 4(2)).

If the business sells personal data or processes it for targeted advertising, Section 5(4)(h) requires clear and conspicuous disclosure in the Privacy Policy, along with the opt-out procedure.

The first-year enforcement report identified that many businesses were not offering consumers the right to list the specific third parties that received their data. This was the most frequently denied right in Oregon during the first year.

Sensitive data receives special treatment and must be specifically identified in the Policy.

If the business collects any data in this category, the Policy must:

Explicitly identify that sensitive data is collected.

Describe the specific purpose for processing each category.

Explain how consumer consent is obtained prior to processing.

Detail how that consent can be revoked, respecting the 15-day cessation deadline after revocation (Section 5(1)(d)).

For children's data, the business must comply with COPPA requirements, per Section 5(2)(b) of the OCPA.

Section 5(2)(c) prohibits processing data of consumers aged 13 to 15 for targeted advertising, profiling for decisions with legal effects, or data sales without those consumers' consent, when the controller has actual knowledge of that age range.

As of January 1, 2026, protection was expanded: prohibition on selling data of minors under 16 and on using data of minors under 16 for targeted advertising and certain types of profiling.

The Privacy Policy must specifically reflect these protections if the business may reach this audience.

Section 8 requires controllers to conduct and document Data Protection Assessments for high-risk activities, including targeted advertising, data sales, profiling with foreseeable risk of harm, and sensitive data processing.

Assessments do not need to be published in the Policy, but must be documented, retained for at least five years (Section 8(6)), and available to the Attorney General upon request. They are confidential and exempt from public disclosure (Section 8(7)).

The Policy should make clear that the business conducts impact assessments for high-risk activities as part of its compliance program.

Section 5(2)(d) expressly prohibits businesses from discriminating against consumers who exercise their rights. This includes denying products or services, charging different prices, or offering lower quality as a consequence.

The exception is voluntary loyalty, rewards, premium features, discount, or club card programs that offer benefits in exchange for data use, provided the consumer participates voluntarily (Section 5(3)(b)).

Through December 31, 2025, the Attorney General was required to notify the business and grant 30 days to cure violations before initiating formal action.

As of January 1, 2026, that cure period was eliminated. The AG may initiate action directly, without prior notice (Section 11 of the OCPA).

An incomplete Privacy Policy is one of the easiest violations to identify. Updating the document before an investigation was efficient when the cure period existed. Now, it is the only way to protect the business.

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The consent management platform ensures the consent and opt-out mechanism works as described, including automatic recognition of the GPC from January 2026 and processing of revocations within 15 days.

Every interaction is logged. If the Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Policy for your site that complies with the OCPA? Talk to our team.

Visible and accessible link on all pages of the site.

Categories of personal data processed, with explicit mention of sensitive data and derived data (Section 5(4)(a)).

Purpose of processing for each category, without vague descriptions (Section 5(4)(b)).

How to exercise all L.O.C.K.E.D. rights with process, channel, and 45-day response deadline (Section 5(4)(c)).

Appeal process with a 45-day deadline and information about the Attorney General (Section 4(6)).

All categories of personal data shared with third parties, including sensitive data (Section 5(4)(d)).

Categories of third parties with detail about entity type and how each may process data (Section 5(4)(e)).

Active email or online contact method, actively monitored by the controller (Section 5(4)(f)).

Complete controller identification, including assumed business name if applicable (Section 5(4)(g)).

Description of targeted advertising or data sale with accessible opt-out (Section 5(4)(h)).

Request submission method described, without requiring a new account (Section 5(4)(i) and 5(5)).

GPC recognition from January 2026 (Section 5(5)(c)).

15-day deadline for honoring consent revocation (Section 5(1)(d)).

Protection for teens aged 13 to 15 with consent requirement (Section 5(2)(c)).

Prohibition on data sales and targeted advertising for minors under 16 from January 2026.

Non-discrimination policy for consumers exercising their rights (Section 5(2)(d)).

Reference to Data Protection Assessments for high-risk activities (Section 8).

1. Why does the OCPA require the contact channel to be actively monitored?
Section 5(4)(f) specifically requires the controller to specify an email or other online method that the controller "actively monitors." This distinguishes the OCPA from other state laws that simply require an available channel. The 2025 enforcement report identified non-functional rights request forms as one of the most frequent problems during investigations, confirming that the AG verifies whether channels actually work.

2. What is derived data and why does the OCPA include it in personal data?
Derived data is data created or inferred from other consumer data. Marketing profiles, propensity scores, audience segment classifications. The OCPA explicitly includes derived data in the personal data definition (Section 1(13)), meaning that when a consumer requests a copy or deletion of their data, derived data is also in scope. The enforcement report identified that businesses were not including back-end data in responses, which constitutes a direct violation.

3. Why does the OCPA require more detail about third parties than other state laws?
Section 5(4)(e) requires the description of third-party categories to be at a level of detail that enables the consumer to understand "what type of entity each third party is and, to the extent possible, how each third party may process personal data." This goes beyond what laws like the VCDPA require, which ask only for categories of third parties without the detail about how they process data. In practice, "business partners" is not sufficient.

4. What happens to sensitive data if the consumer revokes consent?
Section 5(1)(d) requires the controller to provide a revocation mechanism at least as easy as the consent mechanism. After revocation, the controller must cease processing as soon as practicable, but not later than 15 days. This 15-day deadline is a differentiator of the OCPA. The Privacy Policy must inform consumers of this deadline so they know what to expect.

5. How does the elimination of the cure period affect the urgency of updating the Privacy Policy?
Before January 2026, the AG was required to notify the business and grant 30 days to cure violations. With that period eliminated by Section 11 of the OCPA, the AG may initiate action directly. An incomplete Privacy Policy that previously could have been corrected after notification now represents immediate risk of penalties of up to US$ 7,500 per violation. Each affected consumer can be counted as a separate violation.

Ready to build a Privacy Policy for your site that complies with the OCPA? Talk to our team.