The Oregon Consumer Privacy Act (OCPA) has applied since 1 July 2024, and to nonprofits since 1 July 2025. Since 1 January 2026, businesses it covers must honour universal opt-out signals such as Global Privacy Control, may no longer sell precise geolocation data or the data of consumers under 16, and no longer get a 30-day chance to fix a violation before the Attorney General acts.
Who the Oregon law covers
The Oregon Consumer Privacy Act, passed as Senate Bill 619 in June 2023 and codified at ORS 646A.570 to 646A.589, took effect on 1 July 2024. It grants Oregon residents a set of privacy rights over their personal data and places corresponding obligations on businesses that collect or process that data.
According to the Oregon Department of Justice's FAQs for businesses, the law applies to any entity conducting business in Oregon or targeting Oregon residents that, during a calendar year, controls or processes personal data of 100,000 or more Oregon consumers, or of 25,000 or more consumers while deriving more than 25% of annual gross revenue from selling personal data.
Unlike many US state privacy laws, the OCPA covers nonprofit organisations, a provision that took effect on 1 July 2025. Colorado's law does too, as the Colorado Attorney General's guidance confirms. Since 26 September 2025, it has also applied to every auto manufacturer that collects personal data, whatever the number of Oregon consumers.
Consumer rights under the OCPA
Oregon residents can exercise the right to know, delete, correct and obtain a portable copy of their personal data. They can also get a list of the specific third parties that received their data. The OCPA also provides the right to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. These opt-out rights mirror those in several other state laws, but Oregon's enforcement has been notably active.
Controllers must respond to consumer requests within 45 days, with the option to extend by another 45 days if reasonably necessary.
Oregon's broad definition of sensitive data
The OCPA defines sensitive data more expansively than most US state privacy frameworks. Laws like the Virginia VCDPA and Connecticut CTDPA cover standard categories such as racial origin and health data. Oregon goes further.
Under the OCPA, sensitive data includes information revealing:
- Racial or ethnic background
- National origin
- Religious beliefs
- Mental or physical health condition or diagnosis
- Sexual orientation
- Status as transgender or non-binary
- Status as a victim of a crime
- Citizenship or immigration status
It also covers precise geolocation data (within a radius of 1,750 feet), genetic and biometric data used for identification, and the personal data of a known child.
Oregon names transgender or non-binary status and crime victim status as sensitive data, categories the Virginia law does not list. This matters for any website collecting demographic information or processing form submissions that might capture these details.
Opt-in consent required for sensitive data
Sensitive data under the OCPA requires affirmative opt-in consent before processing. Your cookie banner must obtain explicit permission before any cookies or scripts that process sensitive data categories fire.
If your site collects health-related browsing data, processes precise geolocation, or gathers any information touching the categories above, you must obtain consent first, not after.
Two sale bans that started on 1 January 2026
House Bill 2008, passed in 2025, turned two consent rules into outright bans. In its announcement of the OCPA's first-year report on 29 August 2025, the Oregon DOJ described what changed on 1 January 2026:
- Controllers may not sell precise geolocation data, whatever the consumer agrees to.
- Controllers may not sell the personal data of consumers under 16, or use it for targeted advertising and certain types of profiling.
For a website, that means a location-based ad partner or a data deal that includes precise location can no longer rely on a consent checkbox in Oregon. If your audience includes teenagers, an advertising pixel such as _fbp should not run for visitors you know to be under 16.
Universal opt-out signals in force since January 2026
Since 1 January 2026, controllers subject to the OCPA must recognise universal opt-out preference signals. The most widely adopted signal is Global Privacy Control (GPC), which sends a machine-readable signal from the browser indicating a preference to opt out of data sales and targeted advertising. The DOJ adds that businesses must still keep a clear and conspicuous opt-out link on their websites.
This aligns Oregon with states like Colorado and Texas, which also require GPC recognition. The Oregon DOJ highlighted the universal opt-out tool on Data Privacy Day in January 2025.
Your consent management platform (CMP) must detect the Sec-GPC HTTP header or the navigator.globalPrivacyControl JavaScript property and treat a positive signal as a valid opt-out. Kukie.io's banner can treat a GPC signal as an opt-out in regions where you use an opt-out or notice-only consent model.
How to implement GPC detection
When a GPC signal is detected, suppress any cookies categorised as targeting or advertising, such as _fbp, _gcl_au or ad network pixels, before they fire. A properly configured CMP handles this automatically. If you manage consent manually, you need logic to read the Sec-GPC: 1 header. A technical guide to honouring GPC signals covers the details.
Enforcement by the Oregon DOJ
The Oregon Attorney General holds exclusive enforcement authority under the OCPA. There is no private right of action, meaning consumers cannot sue businesses directly for violations. Violations can bring civil penalties of up to $7,500 each, according to the DOJ's FAQs for businesses.
From 1 July 2024 to 31 December 2025, the Attorney General had to issue a 30-day cure notice before pursuing enforcement of a curable violation. That cure provision ended on 1 January 2026.
Oregon's Privacy Unit has been active from day one. In the first year of enforcement, from July 2024 to June 2025, it received 214 complaints, most of them about online data brokers. It initiated and closed 38 matters after sending cure notices and broader information requests, and most companies updated their privacy notices or rights mechanisms quickly. The report's main points for businesses were:
- Tell consumers which third parties received their personal data, including through a sale
- Include "back-end" data, such as marketing profiles or shopping patterns, when consumers ask for a copy or deletion
- Keep the rights request form accessible, working and complete
With the cure period over, the next violation the unit finds no longer has to start with a cure notice. As of October 2026, the DOJ's most recent published enforcement report covers July to October 2025.
OCPA compared to other state privacy laws
The table below shows how the OCPA compares with other US state privacy laws.
| Provision | Oregon (OCPA) | California (CCPA/CPRA) | Colorado (CPA) | Virginia (VCDPA) |
|---|---|---|---|---|
| Effective date | 1 July 2024 | 1 January 2020 (CPRA 2023) | 1 July 2023 | 1 January 2023 |
| Covers nonprofits | Yes (from July 2025) | No | Yes | No |
| Universal opt-out signal | Required since 1 Jan 2026 | Required | Required since 1 Jul 2024 | Not required |
| Sensitive data consent | Opt-in | Opt-out (right to limit use) | Opt-in | Opt-in |
| Transgender or non-binary status as sensitive | Yes | No | No | No |
| Crime victim status as sensitive | Yes | No | No | No |
| Cure period | Ended 1 Jan 2026 | None guaranteed | Expired 1 Jan 2025 | 30 days (permanent) |
| Private right of action | No | Limited (data breaches) | No | No |
Practical steps for websites with Oregon visitors
If your website attracts visitors from Oregon, these steps will help.
Audit your data collection. Run a cookie scan to identify every cookie and tracker. Categorise each one and determine whether any process sensitive data as defined by the OCPA.
Update your privacy notice. The OCPA requires disclosure of data categories processed, purposes, third parties receiving data, and how consumers can exercise their rights. A generic privacy policy may not meet these specifics.
Honour GPC. Make sure your consent solution recognises GPC signals and keep the opt-out link on the site. Test with a browser or extension that sends the Sec-GPC header.
Obtain opt-in consent for sensitive data. If your site processes any of Oregon's sensitive data categories, you need affirmative consent before that processing begins. Precise geolocation and under-16 data cannot be sold at all.
Make rights requests easy. The Oregon DOJ flagged incomplete and broken request forms in its first-year report. Provide a clear method for consumers to submit access, deletion and opt-out requests.
Short answers on the Oregon privacy law
Does the Oregon Consumer Privacy Act apply to small businesses?
The OCPA applies to businesses that process the personal data of 100,000 or more Oregon consumers a year, or of 25,000 or more if they derive more than 25% of gross revenue from selling personal data. Small businesses below these thresholds are not covered, though they may still be subject to other privacy obligations.
When do Oregon websites need to honour GPC signals?
Since 1 January 2026. Controllers subject to the OCPA must recognise and honour universal opt-out preference signals such as Global Privacy Control as valid requests to opt out of sales and targeted advertising, and must still keep an opt-out link on their websites.
What makes Oregon's sensitive data definition different from other states?
Oregon lists transgender or non-binary status and status as a crime victim as sensitive data, alongside the usual categories such as health, religion, citizenship and precise geolocation. Since 1 January 2026, precise geolocation data and the data of consumers under 16 cannot be sold at all.
Can consumers sue businesses for OCPA violations?
No. The OCPA does not include a private right of action. Only the Oregon Attorney General can enforce the law. Consumers can file complaints with the Oregon Department of Justice.
Does the OCPA apply to nonprofit organisations?
Yes. Since 1 July 2025, nonprofit organisations that meet the processing thresholds are subject to the OCPA. Colorado, Delaware and New Jersey also cover nonprofits, while Virginia exempts them.
What changed when the OCPA cure period ended in January 2026?
Since 1 January 2026, the Oregon Attorney General no longer has to send a 30-day cure notice before taking enforcement action. A violation can lead straight to an enforcement action, with civil penalties of up to $7,500 per violation.
Find out which of your cookies Oregon cares about
If you are not sure which cookies your site sets or whether they touch Oregon's sensitive data rules, start with a free scan. Kukie.io finds and categorises every cookie, applies the consent model you set for each region, honours GPC signals and keeps a record of each choice.
