Oregon Consumer Privacy Act (OCPA) Reference Guide

The OCPA generally covers a person doing business in Oregon or providing products or services to Oregon residents who, in a calendar year, processes personal data of at least 100,000 Oregon consumers, apart from data used solely to complete a payment transaction. It also covers a person handling at least 25,000 consumers’ data while deriving 25% or more of annual gross revenue from selling personal data. Both parts of the second test must be met. Oregon Legislature: SB 619, section 2

A consumer is an Oregon resident acting outside an employment or commercial context. Covered nonprofits became subject to the Act on July 1, 2025. Since September 2025, specified motor-vehicle manufacturers and affiliates are covered for data from vehicle use regardless of the ordinary consumer-volume threshold. Processors also have duties when handling covered data for controllers. Oregon DOJ: Business FAQs Oregon DOJ: One-year report

The law distinguishes entity exemptions from exclusions for particular categories of data. Government bodies, certain financial institutions, and certain insurers have entity exemptions; some data governed by federal health, financial, credit, and research laws may also be excluded. Whether an exclusion applies to a given processing activity belongs with counsel. Oregon DOJ: Business FAQs

The 2025 amendment extends coverage to motor-vehicle manufacturers and certain affiliates handling data from an Oregon consumer’s use of a vehicle, regardless of consumer count. Do not assume the general threshold answers this separate applicability question. Oregon Legislature: HB 3875

Alongside access, correction, deletion, portability, and applicable opt-outs, Oregon consumers can request a list of the specific third parties to which a controller disclosed their data or any consumers’ data. Keep an accurate record of website vendors and downstream recipients; the privacy team owns the rights-response process. Oregon DOJ: Business FAQs

Oregon’s personal-data definition includes information linked or reasonably linkable to a consumer or a device linked to a household. A sale can involve money or other valuable consideration, subject to statutory exclusions. Targeted advertising is tied to activities over time across unaffiliated sites or apps; contextual ads and processing solely to measure an ad’s performance are excluded from that definition. Neither every analytics request nor every ad request can be classified from its vendor name alone. Oregon Legislature: SB 619, section 1

Tags may be loaded from site code, a tag manager, embedded forms, or third-party widgets. A banner may show a rejection while another script continues sending identifiers. Oregon DOJ says a cookie banner might suffice for some entities but not all; the opt-out must work for the relevant data flow. Oregon DOJ: Business FAQs

Since January 1, 2026, covered controllers must recognize qualifying user-selected universal opt-out mechanisms for personal-data sales and targeted advertising. Oregon DOJ identifies Global Privacy Control (GPC) as an example. A universal signal is not a general deletion request or a replacement for every other rights process. Oregon DOJ: Consumer Privacy Oregon DOJ: 2026 announcement

The technical question is whether the browser signal reaches the site’s preference state, tag-manager rules, direct scripts, and downstream vendors. Merely mentioning GPC in a notice does not change a tag.

The Oregon Attorney General has sole enforcement authority under the OCPA. Civil penalties can reach $7,500 per violation; the Act does not create a private right of action. Since January 1, 2026, the Attorney General need not issue a notice offering a 30-day cure before taking action. Oregon DOJ: Business FAQs

Separate 2026 rules prohibit selling personal data about a consumer under 16 and selling precise geolocation data about an Oregon consumer. Targeted advertising and specified profiling involving people under 16 are also restricted. These rules require attention to data, age knowledge, and recipients; a generic opt-out is not enough to assess them. Oregon Legislature: HB 2008 Oregon DOJ: Business FAQs

Counsel and the privacy team decide how Oregon’s rules apply to each activity. The technical team implements and tests the website behavior that follows from those decisions. Both workstreams need a shared inventory of vendors, purposes, and opt-out states.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, privacy notices, vendor contracts, rights-request procedures, sensitive-data obligations, and organizational governance should be handled by qualified privacy counsel.

This guide uses enacted Oregon laws and Oregon DOJ guidance. Statutory text controls where guidance simplifies a rule. The original law says 25% or more of annual gross revenue from sales of personal data; the DOJ FAQ summarizes it as ‘over 25%’. We use the statutory wording. Secondary summaries are not authority for the legal claims on this page.

Prepared by Etalon Editorial Team. Last reviewed September 27, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website tracking: visitor choice, browser privacy signals, cookies, scripts, tags, and network requests. Your legal and privacy team remains responsible for interpretation, applicability, exemptions, vendor relationships, notices, minors’ and location data, contracts, rights requests, assessments, security, and organizational governance.