Key Facts
Overview
Oregon's OCPA is the first US state comprehensive privacy law to cover nonprofit organizations (effective July 2025). It also has the broadest sensitive data definition among US states, uniquely including transgender/nonbinary status and status as a victim of crime.
What This Means for Your Website
- Opt-in consent is required for all categories of sensitive data (broadest definition among US states)
- Nonprofits must comply from July 2025, the first US state to require this
- GPC signals must be honored from January 2026 (when the cure period also sunsets)
- Data of visitors under 16 cannot be sold or used for targeted advertising
- The 30-day cure period sunsets January 1, 2026
Key Requirements
The Oregon AG enforces the OCPA with penalties up to $7,500 per violation. Consumer requests must be fulfilled within 45 days. The broadest sensitive data definition captures categories unique to Oregon. Nonprofit coverage expands the law's reach significantly.
How ConsentStack Handles This
ConsentStack detects Oregon visitors and applies opt-in consent for sensitive data using Oregon's expanded definition. Enhanced protections block data sale and advertising for under-16 visitors.
Penalties
Up to $7,500 per violation.
Key Requirements
- Opt-in consent for all categories of sensitive data
- Honor GPC/universal opt-out signals from January 2026
- Consumer rights: access, correct, delete, portability, opt-out
- Data protection assessments for high-risk processing
- Nonprofit compliance from July 2025
Notable Provisions
- First US state to cover nonprofits
- Broadest sensitive data definition (transgender/nonbinary status, crime victim)
- Cure period sunsets January 2026
- Under 16 data cannot be sold/shared for targeted advertising
Data Subject Rights
Confirm whether a controller is processing or has processed your personal data, learn the categories of that data, and obtain a copy of all of it, free once in any 12-month period and without the controller having to reveal trade secrets.
Obtain a list of the specific third parties, other than natural persons, to which the controller has disclosed your personal data or, at the controller's option, any personal data.
Receive the copy of your personal data in a portable and, where technically feasible, readily usable format that lets you transmit it to another person without hindrance.
Require a controller to correct inaccuracies in your personal data, taking into account the nature of the data and the controller's purpose for processing it.
Require a controller to delete personal data about you, including data you provided, data it obtained from another source and derived data.
Opt out of the processing of your personal data for targeted advertising, without authentication and including through an opt-out preference signal controllers must honor from January 1, 2026; a controller may not target ads to a consumer it knows, or willfully disregards, is under 16.
Opt out of the sale of your personal data, without authentication and including through an opt-out preference signal controllers must honor from January 1, 2026; data of a consumer the controller knows, or willfully disregards, is under 16 and precise geolocation data may not be sold at all.
Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, such as decisions on financial or lending services, housing, insurance, education, criminal justice, employment, health care or access to essential goods and services.
Designate an authorized agent, including through an internet link, browser setting, browser extension or global device setting, to opt out of targeted advertising, sale or profiling on your behalf; this agent right covers opt-outs only.
Appeal a controller's refusal to act on your request, within a reasonable period after receiving the refusal, through a process that is conspicuously available and similar to the request process, with a written decision and reasons.
If a controller denies your appeal, its written notice must give you information that enables you to contact the Oregon Attorney General to submit a complaint.
Revoke consent you gave, for example to the processing of sensitive data, through a means at least as easy as the one used to give it, after which the controller must stop the processing.
A controller may not discriminate against you for exercising your rights, including by denying goods or services, charging different prices or rates or providing a different level of quality or selection, except for bona fide loyalty, rewards, premium features, discount or club card programs.
US State Specifics
Other North America Regulations
Frequently Asked Questions
OCPA requires you to recognize an opt-out preference signal such as Global Privacy Control. Check whether GPC is working on your site to confirm the signal reaches you and that trackers actually stop firing when it does.
Stay compliant with OCPA
ConsentStack helps you implement Opt-out consent for Oregon, United States automatically.