Texas TDPSA and Cookies: All You Need to Know

João Bruno Soares

*On February 13, 2025, [Axeptio](https://www.axept.io), a leader in consent management solutions, announced the acquisition of [AdOpt](https://goadopt.io), one of the leading players in the Brazilian market. This strategic move is part of Axeptio's international expansion dynamics, which, after opening a branch in Canada, continues its development in new markets.*

![AdOpt_Axeptio_MA_photo.jpg](https://strapi.goadopt.io/uploads/Ad_Opt_Axeptio_MA_photo_6d36fa7bc7.jpg)

## Brazil: A Key Market for Consent Management  
With over 216 million inhabitants, **Brazil represents a vast market with a growing demand for consent management solutions**. LGPD - brazilian data protection law, inspired by the European GDPR, [imposes strict obligations](https://goadopt.io/en/blog/anpd-cookies-guidance-personal-data-protection-lgpd/) on companies in the collection and management of user consent. However, there is still a strategic space for European players to fully meet the expectations of the Brazilian market.

```"Rather than create a subsidiary ex nihilo, **we decided to join forces with AdOpt**, a company that shares our values and our desire to become the trusted partner that brings together the interests of users and companies on the web," — Romain Bessuges-Meusy, CEO of Axeptio.```

Axeptio, a pioneer in the compliance sector, **already helps companies worldwide** to comply with key data protection regulations: GDPR (Europe), nFADP (Switzerland), Law 25 (Quebec), and CCPA (California). Thus, entering the Brazilian market was a natural step to help businesses meet the requirements of LGPD.

### AdOpt: Market Leader in Brazil with International Ambitions  

Founded in the United States in 2021, the company expanded its operations in Brazil starting in 2023, with the opening of a local subsidiary. AdOpt is a consent solution that is currently present **on more than 50,000 websites worldwide**. Its positioning combines self-service with personalized and humanized support, serving influential clients such as Caixa Econômica, Nike, Reebok, LEGO, CROCS, Ajinomoto, Kipling...

```“Joining Axeptio is a fantastic opportunity to amplify our impact and extend our mission **beyond Brazil**. We share the same philosophy: putting users at the center of the consent experience, with **solutions that are both easy to use, friendly and powerful**. Together, we will continue to help businesses create positive consent experiences. ” — Adonis Batista, CEO of AdOpt.```

**AdOpt is not limited to Brazil**: in addition to LGPD, its solution covers the requirements of GDPR, CCPA, and other international regulations in over 30 countries and languages. **This global reach** makes AdOpt a strategic player for Axeptio, which aims to support the brand’s growth far beyond the Brazilian market.

![AdOpt Compliance Coverage.png](https://strapi.goadopt.io/uploads/Ad_Opt_Compliance_Coverage_a598465645.png)

```"In fact, when we arrived in Brazil, we went for a coffee and **the barista immediately recognized the logo on João Bruno’s T-shirt, COO of AdOpt**. This level of brand awareness is rare in our sector and proves that AdOpt has succeeded in creating a strong, identifiable and appreciated brand" — Romain Bessuges-Meusy, CEO of Axeptio.```

![Barista Convo Coffee.png](https://strapi.goadopt.io/uploads/Barista_Convo_Coffee_f5e25b2e73.png)

### AdOpt and Axeptio: Shaping the Future of Online Consent Together  

The partnership between Axeptio and AdOpt is based on a shared vision regarding consent management: meeting the **needs of businesses and users** to provide an **seamless and engaging consent experience**. Additionally, both companies share the same perspective: **focus on the user and design to make compliance ever more seamless and enjoyable**.

```"We're entering a maturing phase in the CMP market. In this context, synergies between players make sense, especially geographically. **AdOpt is a local champion in Brazil. Axeptio is a champion in Europe and Canada.** Together, we'll unite our brands around a common vision: to make the web a better place to live, placing at the heart of the user experience the ability and freedom to choose whether or not to share one's data, without it being a burden" — Romain Bessuges-Meusy, CEO of Axeptio.```

### What Are the Implications for AdOpt Customers?  

By partnering with Axeptio, a **Google CMP partner (Gold status) and certified by TCF of IAB Europe and IAB Canada**, AdOpt will benefit from its *expertise* and ability to integrate the latest technological innovations, such as **Consent Mode v2** and **TCF 2.2**.

Thanks to this alliance, AdOpt clients will have more flexibility, with the option to access advanced features and a broader range of services offered by Axeptio.

### Local and Global Synergies Driving Growth  

More than a simple acquisition, the alliance between Axeptio and AdOpt represents a commitment to deeply root itself in local ecosystems, leveraging the expertise and reputation of existing players.

By integrating a Brazilian leader into its growth dynamics, Axeptio **ensures infrastructures adapted to Brazil's regional specifics**, confirming its ability to build sustainable and multi-regional growth. This evolution opens up new opportunities and strategic alliances with companies that share the same vision for the future of the web.

## Media Coverage

The acquisition of AdOpt by Axeptio has generated significant media attention, highlighting the relevance of this move in strengthening Axeptio's presence in Latin America.

*For example, [Exchange Wire's article](https://www.exchangewire.com/blog/2025/02/13/axeptio-acquires-adopt-to-strengthen-global-expansion/) points out that Axeptio, a leading European CMP and Google Gold Partner, has acquired AdOpt, Brazil’s top consent management platform, strengthening its presence in Latin America. **This strategic move merges Axeptio’s global regulatory expertise (GDPR, LGPD, CCPA, etc.) with AdOpt’s deep understanding of the Brazilian market**. The acquisition reflects a shared commitment to user-centric, regulation-compliant consent experiences and highlights the growing importance of local integration in global data privacy strategies.

![Exchange Wire Article.png](https://strapi.goadopt.io/uploads/Exchange_Wire_Article_bc43962d78.png)

*In [Le Mag J&A's article](https://www.joffeassocies.com/en/axeptio-accelerates-its-international-expansion-with-the-acquisition-of-adopt/), Axeptio, an European leader in digital consent management, has acquired AdOpt, a prominent Brazilian CMP serving over 50,000 websites, including major brands like Nike and LEGO.

This move strengthens Axeptio’s expansion into Latin America, aligning with Brazil’s stringent LGPD framework. **The acquisition merges AdOpt’s local expertise with Axeptio’s global compliance and technology capabilities, aiming to deliver scalable, user-friendly consent solutions.** Backed by Joffe & Associés, the deal reflects a shared vision of transparent, adaptable consent experiences and reinforces Axeptio’s strategy to localize compliance infrastructure while pursuing international growth.

![J&A Article.png](https://strapi.goadopt.io/uploads/J_and_A_Article_740b01c7fe.png)

*According to the news portal [Isai](https://www.isai.vc/news/axeptio-a-leader-in-respectful-internet-user-consent-management-has-secured-a-35-million-euro-investment-from-isai-evolem-and-ovni-capital), **Axeptio, a leading European consent management platform, has raised €3.5 million from ISAI, Evolem, and Ovni Capital to accelerate its international expansion.** With over 50,000 websites using its user-centric solution, Axeptio stands out by addressing "consent fatigue" through a transparent, intuitive, and regulation-compliant platform.

The investment will support team growth and global market penetration, reinforcing Axeptio’s mission to make consent a trust-building opportunity rather than a legal burden. Founded in 2017, Axeptio continues to prioritize respectful user experiences while scaling compliance solutions across 40+ countries.

![Isai Article.png](https://strapi.goadopt.io/uploads/Isai_Article_a735b7c667.png)

___

> #tip **Discover how our solutions can simplify your business decisions regarding consent management. [Click here](https://meetings.hubspot.com/murilo-andrade/adopt-meeting1-murilo) and talk to one of our team experts!**


Axeptio Strengthens its International Expansion with the Acquisition of AdOpt

Montana MTCDPA: Privacy Policy

Every tracker you install on your site starts collecting data before the user makes any conscious decision about what they accept or reject.

This page covers one piece of the picture. For the full scope of the FDBR — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the FDBR and cookies](https://goadopt.io/en/blog/florida-fdbr-and-cookies-all-you-need-to-know/).

An advertising pixel registers the visit. An analytics cookie begins measuring behavior. A support chat already knows the visitor's origin before the first message.

The Florida Digital Bill of Rights (FDBR, §§ 501.701 to 501.721), in effect since July 1, 2024, has specific requirements for how these trackers operate and what must be documented about them.

This article focuses exclusively on what the FDBR requires from a Cookies Policy: what the document must contain, how tracker consent must work, and what the law's specific rights imply for your cookie strategy.

## Cookies Policy vs. cookie banner: the necessary distinction

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the visual consent element. It is what the visitor sees when they first access the site. It must be clear, offer real options, block non-essential trackers before they fire, and not use dark patterns.

The Cookies Policy is the detailed document. It is where the user finds complete information about every technology operating on the site: what it collects, what it is for, who receives the data, and how long it is stored.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible through a clear link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## What the FDBR specifically requires for cookies

### Specific purpose for each category

§ 501.71(2)(a) prohibits processing for purposes incompatible with those disclosed. And § 501.711(1)(b) requires the purpose of processing to be included in the privacy notice.

For cookies, each category needs a specific purpose description, not a generic one.

What does not work: "cookies to improve your experience." That is not a purpose. It is a vague description that provides no compliance and no protection.

What works:

"Analytics cookies: collect browsing behavior data including pages visited, session duration, and traffic source. Used to identify opportunities to improve site content and prioritize usability corrections."

"Advertising cookies: collect behavioral data across affiliated and non-affiliated websites over time to build interest profiles and display personalized ads. Include pixels from platforms such as Meta Ads, Google Ads, and programmatic DSPs."

### The categories of cookies present on the site

The Policy must list the categories of trackers operating on the site with a description of what each one does. The main categories:

**Necessary cookies:** essential for basic functionality. Authentication, session security. These do not require consent but must be documented.

**Analytics cookies:** measure browsing behavior. These generally require consent because they collect data that may identify users through cross-referencing.

**Advertising cookies:** feed ad pixels, build behavioral profiles, enable retargeting. These require explicit consent and the specific disclosure mandated by the FDBR.

**Functional cookies:** remember user preferences. May or may not require consent depending on the nature of the data.

**Third-party cookies:** fired by external services integrated into the site. [Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to document each one accurately.

### Targeted advertising: the FDBR's broader definition

The FDBR defines targeted advertising (§ 501.702(33)) as ads based on consumer activity data over time across **affiliated or non-affiliated** websites and online applications.

This is an important point of difference. The VCDPA, for example, covers only non-affiliated websites. The FDBR includes affiliated ones, meaning that trackers operating within the ecosystem of companies in the same corporate group may constitute targeted advertising under the FDBR.

§ 501.711(4) requires clear and conspicuous disclosure of any data sale or targeted advertising processing, along with the opt-out mechanism. This must be in the Cookies Policy.

### Sale of data: includes non-monetary consideration

§ 501.702(29) defines sale of personal data as sharing, disclosing, or transferring for monetary **or other valuable consideration**.

This is broader than the VCDPA, which mentions only monetary consideration. A company that exchanges user data with partners in return for services, technology, or other benefits may be conducting a "sale" under the FDBR. The Cookies Policy must assess whether site integrations fall under this definition.

### Categories of data shared with third parties via cookies

§ 501.711(1)(d) and (e) require the privacy notice to disclose which categories of data are shared with third parties and which categories of third parties receive them.

For cookies, this means clearly declaring:

If a Meta Pixel transfers behavioral data to Meta, it must be documented.

If Google Analytics sends session data to Google, it must be stated.

If CRM tools receive browsing data from the site, they must be identified.

Every data flow leaving the controller's environment via cookies must be categorized.

### Retention period: the 2-year limit

§ 501.719(3) requires adoption of a retention schedule that prohibits use or retention of personal data after the initial purpose is fulfilled, after the contract ends, or **2 years after the consumer's last interaction**.

For cookies, the Policy must document:

How long each cookie category remains active on the user's device.

How long data collected via cookies is retained in the business's systems.

How and when data is deleted, respecting the 2-year limit.

### The opt-out for sensitive data via cookies

The FDBR has a right that does not exist in other US state privacy laws: consumers may opt out of the **collection of sensitive data** (§ 501.705(2)(f)), including precise geolocation data.

If the site collects precise geolocation data (within 1,750 feet) via cookies or location scripts, this is sensitive data under the FDBR (§ 501.702(31)(d)). The consumer has the right to refuse this collection, and the opt-out mechanism must be accessible in the Cookies Policy.

### The opt-out for voice and facial recognition

The FDBR's seventh right (§ 501.705(2)(g)) guarantees consumers the opt-out of data collection via voice or facial recognition features.

If the site uses any voice recognition technology (voice chat, audio commands) or facial recognition (identity verification, camera filters), the Cookies Policy must mention these technologies, explain their purpose, and describe how the consumer can exercise the opt-out.

## What constitutes valid consent for cookies under the FDBR

§ 501.702(7) defines consent as a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement.

The correct standard: non-essential cookies off by default. The user chooses what to enable, not what to disable.

What is not valid consent:

Accepting general terms that contain cookie descriptions alongside other conditions.

Hovering over or closing a banner.

Any agreement obtained through dark patterns.

### Dark patterns prohibited by the FDBR

Dark patterns are defined in § 501.702(11) as interfaces designed with the substantial effect of subverting or impairing user autonomy, decision-making, or choice, including any practice the FTC refers to as a dark pattern.

In the context of cookies, common patterns the FDBR invalidates:

An "accept all" button prominently displayed with the reject option hard to find.

Non-essential cookies enabled by default.

Confusing language in the choice options.

Cookie walls blocking content until all cookies are accepted.

Banners that reappear repeatedly until the user accepts.

## Special protection for children's data via cookies

The FDBR defines "known child" as any individual under **18 years of age** of whose age the controller has actual knowledge or willfully disregards (§ 501.702(17)).

This is a much higher threshold than other US laws. For known children:

Between 13 and 18: their affirmative authorization is required to process sensitive data (§ 501.71(2)(d)).

Under 13: COPPA applies.

If the site may have users under 18 whose age the controller knows, the Cookies Policy must describe how their data is treated differently, including the prohibition on using dark patterns to obtain data beyond what is necessary.

Penalties for violations involving known children are **automatically tripled** under the FDBR (§ 501.72(1)(a)).

## Two or more opt-out channels: FDBR-exclusive requirement

§ 501.709 requires the controller to establish **two or more methods** for consumers to submit requests. This includes opt-out requests.

The Cookies Policy must describe at least two channels through which the consumer can exercise opt-outs for targeted advertising, data sale, sensitive data, and voice/facial recognition.

A [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) integrated into the site can be one of these channels. A DSAR form on the website can be another.

## When to update the Cookies Policy

§ 501.711(1) requires updates **at least annually**. Beyond the mandatory annual review, situations requiring immediate update include:

Adding a new advertising pixel.

A new analytics, heatmap, or session recording tool.

A new chat, support, or engagement plugin.

A new CRM or email marketing platform integration.

Any new technology that collects voice, video, or location data.

New partners receiving behavioral data from users.

Continuous [data mapping](https://goadopt.io/en/blog/data-mapping-or-data-inventory/) is what maintains synchronization between the tool inventory and the Cookies Policy.

## Enforcement: high and triplicable penalties

Violations of cookie-related requirements under the FDBR are treated as unfair trade practices, with penalties up to **US$ 50,000 per violation** (§ 501.72).

Penalties are triplicable (reaching US$ 150,000 per violation) when:

The violation involves a known Florida child.

The business continues to sell or share data after the consumer opts out.

There is a failure to delete data after an authenticated request.

The 45-day cure period is discretionary and does not apply to violations involving children.

## How AdOpt helps with the Cookies Policy under the FDBR

AdOpt's automatic scan identifies all technologies active on the site, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-essential trackers before acceptance, presents categories with clear descriptions, offers real choice options without dark patterns, and logs every interaction for audit purposes.

The system supports the configuration of FDBR-specific opt-outs, including sensitive data and voice/facial recognition.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the FDBR

**Visible link** in the site footer and within the cookie banner itself.

**Listing of cookie categories** with a description of what each one does on the site.

**Specific purpose for each category**, without vague descriptions (§ 501.711(1)(b)).

**Disclosure of targeted advertising**, including affiliated sites (§ 501.702(33)), with an accessible opt-out (§ 501.711(4)).

**Data sale declaration**, including non-monetary consideration if applicable (§ 501.702(29)).

**Notice of sensitive data sale** when applicable (§ 501.711(2)).

**Notice of biometric data sale** when applicable (§ 501.711(3)).

**Categories of data shared with third parties** via cookies (§ 501.711(1)(d)).

**Categories of third parties** that receive data via cookies (§ 501.711(1)(e)).

**Opt-out of sensitive data and geolocation** clearly described (§ 501.705(2)(f)).

**Opt-out of voice and facial recognition** described (§ 501.705(2)(g)).

**Retention period** for each category, including the 2-year limit (§ 501.719(3)).

**Non-essential cookies disabled by default**, without dark patterns (§ 501.702(11)).

**Special protection for known children** under 18 years of age (§ 501.702(17)).

**Two or more submission channels** described for opt-out requests (§ 501.709).

**Accessible language**, without legal jargon.

**No cookie walls**.

**Annual update** of the document at minimum.

## FAQ: FDBR and Cookies Policy

**1. Does the FDBR require a separate document called a "Cookies Policy"?**
Not by name. The disclosure requirements for trackers are distributed between the privacy notice (§ 501.711) and the controller's specific duties (§ 501.71). A dedicated Cookies Policy is the most organized way to meet all of these requirements in a user-accessible format.

**2. Is the FDBR's definition of targeted advertising different from other laws?**
Yes. The FDBR (§ 501.702(33)) includes ads based on activity data from affiliated or non-affiliated websites, while the VCDPA, for example, covers only non-affiliated websites. This broadens the scope of advertising practices requiring disclosure and opt-out. A retargeting campaign within the same corporate group's ecosystem may constitute targeted advertising under the FDBR.

**3. What changes for cookies when the user is a known child under 18?**
For known children between 13 and 18, their affirmative authorization is required to process sensitive data (§ 501.71(2)(d)). For children under 13, COPPA applies. A controller that willfully disregards a user's age is treated as having actual knowledge of it (§ 501.702(17)). Penalties for violations involving known children are automatically tripled.

**4. Does the FDBR require an opt-out for geolocation via cookies?**
Yes. Precise geolocation data is sensitive data under the FDBR (§ 501.702(31)(d)). The consumer has the right to opt out of the collection of sensitive data (§ 501.705(2)(f)). If the site uses location scripts that identify the user within a radius of 1,750 feet, the opt-out for this tracking must be available and described in the Cookies Policy.

**5. What are the specific penalties related to cookies under the FDBR?**
All violations can result in up to US$ 50,000 per violation (§ 501.72(1)). Penalties are triplicable for violations involving known children, continuation of sharing or selling data after consumer opt-out, and failure to delete data after an authenticated request. A cookie that continues tracking after opt-out can result in a tripled penalty for each affected consumer.

[Ready to build a Cookies Policy for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Florida FDBR: Cookies Policy

The Oregon Consumer Privacy Act (OCPA, ORS 646A.570 et seq.) has several particularities in the DSAR process that distinguish it from other US state laws.

This page covers one piece of the picture. For the full scope of the OCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the OCPA and cookies](https://goadopt.io/en/blog/oregon-ocpa-and-cookies-all-you-need-to-know/).

The most important: opt-out requests **do not require authentication**. And the right to list third parties that received personal data was the most frequently denied right in the first year of enforcement. The report from Attorney General Dan Rayfield (August 2025) showed businesses simply did not have that record structured.

This article covers everything: what a DSAR is under the OCPA, what rights are guaranteed under the L.O.C.K.E.D. system, specific deadlines, authentication rules, and how to build a Privacy Portal that works for Oregon law.

## What is a DSAR under the OCPA?

DSAR stands for Data Subject Access Request. It is any formal request made by an Oregon resident to exercise the rights the OCPA guarantees over their own data.

Under Section 4(1), consumers exercise their rights through means established by the controller and described in the privacy notice.

If you already know the [LGPD data subject portal](https://goadopt.io/en/blog/legal-bases-of-lgpd/), the structure is familiar. The OCPA adds specific rules about derived data, opt-out without authentication, and the role of universal opt-out signals via technology.

## What are consumer rights under the OCPA?

The **L.O.C.K.E.D.** system from the Oregon Department of Justice summarizes the rights of Section 3(1) of the OCPA:

### L: Right to list third parties

The consumer may request a list of the specific entities to which the controller has disclosed their personal data, or a list of any personal data disclosed (Section 3(1)(a)(B)).

The controller may choose to provide: (i) a list of specific third parties that received the individual consumer's data, or (ii) a list of any third party that received any personal data from the controller.

This was the most frequently denied right in the first year of enforcement. Businesses did not have the record of data sharing structured in a way that allowed them to respond to this request.

### K: Right to know and confirm

The consumer may obtain confirmation that the controller processes or has processed their personal data and which categories are involved (Section 3(1)(a)(A)).

### C: Right to copy

The consumer may obtain a copy of **all** personal data the controller has processed, in a portable format and readily usable where technically feasible (Section 3(1)(a)(C)).

This scope includes derived data. Marketing profiles, behavioral scores, and audience segment classifications created from the consumer's data are part of the copy that must be delivered.

The enforcement report identified that businesses were not including back-end data such as marketing profiles in responses to copy requests. This constitutes a direct violation of the law.

### E: Right to correction

The consumer may request correction of inaccuracies in personal data, taking into account the nature and purpose of processing (Section 3(1)(b)).

### D: Right to deletion

The consumer may request deletion of personal data, including (Section 3(1)(c)):

Data the consumer provided directly to the business.

Data the business obtained from other sources about the consumer.

Derived data created by the business from other data.

For data obtained from third parties, the OCPA provides an alternative. The controller may fulfill the deletion request by either deleting the data entirely, or opting the consumer out of processing their data for any purpose other than those exempt under Section 2(3) (Section 4(7)).

### O: Right to opt-out

The consumer may refuse processing of data for three specific purposes (Section 3(1)(d)):

Targeted advertising.

Sale of personal data.

Profiling in furtherance of decisions that produce legal effects or effects of similar significance (such as access to credit, housing, insurance, employment, or health care services).

## What are the response deadlines?

Under Section 4(5)(a):

**45 days** to respond from receipt of the request.

Extension of **+45 days** when reasonably necessary, considering complexity and volume of requests, with notification within the initial period.

**Appeal: 45 days** for a written response with decision and reasoning (Section 4(6)(d)).

**Free** once per 12-month period per consumer (Section 4(5)(c)). For subsequent requests, may charge a reasonable fee, except when verifying compliance with a prior correction or deletion.

A key distinction from Connecticut's CTDPA: the OCPA sets a 45-day appeal deadline, while the CTDPA sets 60 days. The OCPA is faster on appeals.

## The appeal process

Section 4(6) requires the controller to establish an appeal process that is conspicuously available and similar to the original submission process.

The process must:

Allow a reasonable period after the consumer receives the denial for them to appeal.

Be comparable to the original request submission process.

Result in a written response within **45 days** with the decision and reasoning.

If the appeal is denied, the notice must provide or specify information enabling the consumer to contact the Attorney General to submit a complaint (Section 4(6)(d)).

## Authentication: the special rule for opt-outs

Section 4(5)(e) of the OCPA has a different authentication rule for opt-outs:

For exercising access, correction, deletion, and portability rights: the controller may request additional information reasonably necessary to authenticate. If unable to authenticate, it is not required to comply, but must notify the consumer (Section 4(5)(d)).

For **opt-out requests**: the controller **cannot require authentication**. It may ask only for information necessary to identify who is making the opt-out request. If it has a good faith, reasonable, and documented belief that a request is fraudulent, it may deny, but must notify the requestor explaining why and that it will not comply.

This distinction matters for the Privacy Portal: the opt-out mechanism must work without authentication barriers.

## Authorized agents and opt-out signals

Section 4(4) allows consumers to designate another person as an authorized agent to exercise the opt-out on their behalf. This includes via technology: an internet link, browser setting, browser extension, or global device setting.

The controller must honor the opt-out received from an authorized agent if it can verify, with commercially reasonable effort, the identity of the consumer and the authority of the agent.

As of **January 1, 2026**, controllers processing for targeted advertising or selling data must accept opt-outs via signal sent with consumer consent (Section 5(5)(c)). This includes the Global Privacy Control (GPC).

## How the request submission channel must work

Sections 5(4)(i) and 5(5) require the controller to establish and describe in the privacy notice the method for submitting requests. This method must:

Consider how consumers normally interact with the controller.

Ensure security and reliability in communications.

Allow authentication of the consumer's identity.

Provide a clear and conspicuous link for opting out of targeted advertising.

The controller cannot require creation of a new account (Section 4(2)). It may require use of an existing account.

Additionally, Section 5(5)(b) specifically requires a clear and conspicuous link on the site to an opt-out page for targeted advertising and data sale.

As of **January 1, 2026**, the channel must also recognize and honor universal opt-out signals such as the GPC, per Section 5(5)(c).

A well-structured Privacy Portal offers:

A submission form with clear categories (list of third parties, access/copy, correction, deletion, opt-out from advertising/sale/profiling).

A proportionate and non-discriminatory identity verification process.

Automatic receipt confirmation with a tracking number.

A record of each request, action taken, and response sent.

An appeal channel for denied requests.

The [site consent mechanism](https://goadopt.io/en/blog/operation-of-cookie-banner/) and the Privacy Portal must be integrated so that consumer preferences are reflected across the business's operational systems.

## How to process each type of DSAR in practice

### List of third parties request

Receive and authenticate the consumer's identity.

Consult the data sharing record.

Decide whether to provide: (i) a list of specific third parties that received the consumer's data, or (ii) a list of any third party that received any personal data.

Prepare response within 45 days.

Without a structured sharing record, compliance is impossible. Building a data sharing map is a prerequisite.

### Access and copy request

Receive and authenticate.

Locate all personal data in systems, including derived data such as marketing profiles and behavioral scores.

Prepare response in portable format within 45 days.

### Deletion request

Receive and authenticate.

Check for a legal exemption (Section 2(3)).

For data provided by the consumer: delete from all relevant systems.

For data obtained from third parties: delete entirely or opt the consumer out of processing for non-exempt purposes (Section 4(7)).

Confirm to the consumer within 45 days.

### Opt-out from targeted advertising and sale

Receive the request (via Portal, site link, or opt-out signal such as the GPC from 2026).

**Authentication is not required** to process.

Monitor for fraud indicators. If there is documented reasonable suspicion: notify the requestor.

Otherwise: cease processing for the indicated purposes.

### Opt-out from profiling

Receive via Portal.

Identify whether the profiling in question is for decisions with legal effects or effects of similar significance.

If yes: cease using the data for those decisions.

Inform the consumer of the result within 45 days.

## What happens when the controller denies a request?

Under Section 4(5)(b), the controller that does not take action must inform the consumer without undue delay, but no later than 45 days, with:

The justification for not taking action.

Instructions on how to appeal the decision.

## Consent revocation: 15 days

If the consumer had consented to processing of sensitive data or other consent-based processing and then decides to revoke, Section 5(1)(d) requires:

A revocation mechanism at least as easy as the consent mechanism.

Cessation of processing as soon as practicable, but **not later than 15 days** after receiving the revocation.

This deadline must be built into consent management systems and Privacy Portal operational processes.

## Special protection for children and teenagers

Section 4(3) allows parents or legal guardians to exercise rights on behalf of children under 13.

Section 4(3) also allows guardians or conservators to exercise rights on behalf of consumers under guardianship, conservatorship, or other protective arrangement.

For teens aged 13 to 15: the controller cannot process data for targeted advertising or sale without those consumers' consent (Section 5(2)(c)).

As of January 2026: prohibition on selling data of minors under 16 and on using data of minors under 16 for targeted advertising.

## Protection against discrimination

Section 5(2)(d) prohibits discriminating against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs where the difference is reasonably related to the value the data provides (Section 5(3)(b)).

## The elimination of the cure period and DSARs

Through December 31, 2025, the AG was required to notify the business and grant 30 days to cure violations before initiating formal action.

**As of January 1, 2026, that period was eliminated.** The AG may act directly (Section 11 of the OCPA).

Businesses without a structured DSAR process cannot correct in 30 days what should have been implemented from the start. Without the cure period, the risk is even greater. Penalties can reach **US$ 7,500 per violation**, with each consumer whose right was violated potentially counting as a separate violation.

## How AdOpt helps with the Privacy Portal

AdOpt records every consent, opt-out, and revocation interaction with a timestamp and unique identifier. When the consumer exercises opt-out via the Portal or via a signal like the GPC from 2026, the system automatically updates the corresponding trackers.

The system processes consent revocations and ensures cessation within 15 days. AdOpt's auditable log serves as evidence of compliance for the Attorney General.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the OCPA

**Request submission channel** without requiring creation of a new account (Section 4(2)).

**Clear and conspicuous link** on the site for opt-out from targeted advertising and sale (Section 5(5)(b)).

**Opt-out preference signal** honored from January 2026 (Section 5(5)(c)).

**Coverage of all L.O.C.K.E.D. rights**: list of third parties, access/confirmation, copy (including derived data), correction, deletion, opt-out.

**Derived data included** in the scope of copy and deletion (Sections 3(1)(a)(C) and 3(1)(c)).

**Opt-out without mandatory authentication** for targeted advertising, sale, and profiling (Section 4(5)(e)).

**Fraud denial process** documented for opt-outs denied on suspicion of fraud.

**Authorized agents** accepted for opt-out, including via technology (Section 4(4)).

**Deadlines**: 45 days to respond (+45 ext.); **45 days** for appeal.

**Appeal mechanism** conspicuously available and similar to original process (Section 4(6)).

**Reference to the AG** provided when appeal is denied (Section 4(6)(d)).

**Free service** once per 12-month period per consumer (Section 4(5)(c)).

**15-day consent revocation** honored (Section 5(1)(d)).

**Documented record** of each request, action taken, and response sent.

**Parents/legal guardians** may exercise rights for children under 13 (Section 4(3)).

**Guardians/conservators** may exercise rights for consumers under protective arrangements (Section 4(3)).

**Teen protection 13-15**: consent process before processing for advertising/sale.

## Comparative: Privacy Portal deadlines under the OCPA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Access, list, copy, correction, deletion | 45 days | +45 days with notification |
| Opt-out (no authentication required) | No specific deadline | Immediate recommended |
| Appeal | 45 days | Not specified |
| Consent revocation | Max. 15 days | No extension |
| Cure period for violations | Eliminated (Jan 2026) | No guarantee |

## FAQ: OCPA and Privacy Portal

**1. Why does opt-out not require authentication under the OCPA?**
Section 4(5)(e) establishes that for opt-out requests from targeted advertising, sale, and profiling, the controller must comply without requiring authentication. The rationale is that opt-out is a basic right that should not have unnecessary barriers. The controller may deny only if it has a documented good-faith belief that the request is fraudulent, and must notify the requestor with the reason. Without that notification, the denial may be considered a violation.

**2. Why was the right to list third parties the most denied right in the first year?**
The report from AG Dan Rayfield (August 2025) identified that businesses simply did not have the structured record of who had received personal data. To comply with Section 3(1)(a)(B), the controller must know exactly which entities received data from a specific consumer, or which entities received any personal data from the controller. Without an updated data sharing map, it is impossible to respond to this request.

**3. What makes the deletion of derived data a key differentiator of the OCPA?**
The OCPA explicitly includes derived data in the personal data definition (Section 1(13)) and in the scope of the right to deletion (Section 3(1)(c)). When a consumer requests deletion, marketing profiles, propensity scores, and audience segment classifications created from their data must also be deleted. The enforcement report identified that businesses were not including this data in responses, which constituted a direct violation.

**4. Who may exercise rights on behalf of other consumers under the OCPA?**
Section 4(3) allows parents or legal guardians to exercise rights on behalf of children under 13, and guardians or conservators to exercise rights on behalf of consumers under protective arrangements. Section 4(4) allows any consumer to designate an authorized agent for opt-out, including via technology such as a browser extension or device setting.

**5. What happens if the controller does not have a DSAR process when the Attorney General investigates?**
As of January 2026, there is no longer a 30-day cure period. The AG may initiate action directly (Section 11 of the OCPA). If violations are identified, penalties of up to US$ 7,500 per violation may be sought. Each consumer whose right was violated can be counted as a separate violation, quickly escalating the financial exposure. The 2025 enforcement report showed that inaccessible or non-functional rights forms were among the most common problems found during investigations.

[Ready to build a Privacy Portal for your site that complies with the OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


All posts

Texas TDPSA and Cookies: All You Need to Know

Axeptio Strengthens its International Expansion with the Acquisition of AdOpt

Montana MTCDPA: Privacy Policy

Florida FDBR: Cookies Policy

Oregon OCPA: DSAR Privacy Portal