Oregon Privacy Law (OCPA): Compliance Guide
The Oregon Consumer Privacy Act, effective July 1, 2024, is a full-featured opt-out law with the complete modern rights package — access, correction, deletion, portability, and opt-out of sale, targeted advertising, and profiling. Its sleeper obligation arrived later: since January 1, 2026, covered businesses must honor universal opt-out signals such as Global Privacy Control. Businesses that tracked only the 2024 effective date and missed the 2026 milestone are now exposed.
- Effective
- July 1, 2024
- GPC / universal opt-out
- Required since January 1, 2026
- Required link text
- “Your Privacy Choices”
Last reviewed July 19, 2026 · Oregon Consumer Privacy Act (OCPA)
Applicability
Who must comply with the OCPA
The Oregon Consumer Privacy Act applies to businesses that meet the following criteria:
- Conducts business in Oregon, and:
- Controls or processes the personal data of 100,000 or more Oregon consumers, or
- Controls or processes the personal data of 25,000 or more Oregon consumers and derives 25% or more of gross revenue from the sale of personal data
Consumer rights
What Oregon consumers can demand
- Right to access personal data
- Right to correct inaccuracies
- Right to delete personal data
- Right to data portability
- Right to opt out of the sale of personal data, targeted advertising, and profiling
Opt-out mechanics
Oregon opt-out & GPC requirements
Like every US state privacy law, the OCPA uses an opt-out model: you do not need a GDPR-style cookie banner, but you must provide a clear and conspicuous opt-out link. The accepted text for Oregon is “Your Privacy Choices”.
Global Privacy Control: Required since January 1, 2026
Oregon requires covered businesses to recognize and honor universal opt-out signals such as Global Privacy Control. The requirement took effect January 1, 2026 — about eighteen months after the law itself.
Enforcement
OCPA penalties & enforcement
- Enforced at the state level (standard state enforcement)
Cure period: Our reference lists no specific cure period for Oregon; enforcement is handled at the state level.
State quirks
What makes Oregon different
Oregon's trap is timing. The law took effect July 1, 2024, but its universal opt-out requirement only kicked in on January 1, 2026 — an eighteen-month phase-in that businesses with a “we handled Oregon in 2024” mindset missed. Oregon also writes usability into the law: opt-out mechanisms must be genuinely user-friendly, not buried dark patterns. The 25% revenue-from-sales trigger on the 25,000-consumer prong is lower than most states' 50%.
Universal opt-out from 2026
Universal opt-out signals must be honored starting January 1, 2026 — a delayed obligation that caught businesses tracking only the 2024 effective date.
User-friendly opt-out mechanics
Opt-out mechanisms must be genuinely usable, not just present — an explicit usability standard for the privacy choices interface.
Comprehensive consumer control
The full modern rights package, including opt-out of profiling alongside sale and targeted advertising.
Automation
How ConsentKit handles Oregon
- ConsentKit's widget is served from Cloudflare's edge and receives the visitor's US state server-side, so Oregon visitors are identified before any consent UI renders — no client-side geo-lookup delay.
- Oregon visitors see a persistent “Your Privacy Choices” link — the exact statutory text — available to new and returning visitors alike.
- Because Oregon requires universal opt-out signals, ConsentKit automatically honors Global Privacy Control for Oregon visitors: when the browser broadcasts GPC, the widget applies the opt-out and denies analytics and marketing categories with no click required.
- Every opt-out is recorded server-side with a timestamp and jurisdiction metadata, reviewable and exportable (CSV) from the dashboard — the audit trail regulators ask for.
- Google Consent Mode v2 stays in sync: analytics and advertising tags update the moment a Oregon visitor makes a choice.
Oregon's universal-opt-out milestone (January 1, 2026) is already handled: ConsentKit honors the signal for Oregon visitors and records the opt-out server-side.
FAQ
Oregon OCPA FAQ
Does the OCPA apply to my business?
It applies to businesses operating in Oregon that control or process the personal data of 100,000 or more Oregon consumers, or 25,000 or more while deriving 25% or more of gross revenue from selling personal data.
When did Oregon's universal opt-out requirement start?
January 1, 2026 — about eighteen months after the law itself took effect in July 2024. From that date, covered businesses must recognize and honor signals like Global Privacy Control for Oregon visitors.
What rights do Oregon consumers have?
Oregon consumers can access, correct, delete, and obtain a portable copy of their personal data, and can opt out of the sale of personal data, targeted advertising, and profiling — the full modern rights package.
How is the OCPA enforced?
Enforcement is handled at the state level, and the law explicitly requires user-friendly opt-out mechanisms — a buried or confusing opt-out flow is itself a compliance problem. Our reference lists no specific per-violation dollar figure.
This guide is for informational purposes and is not legal advice. Work with qualified counsel to confirm your obligations under the OCPA.
Comply with Oregon's OCPA — and the other 19 state laws
ConsentKit detects each visitor's state at the Cloudflare edge, renders the exact opt-out link their law requires, honors GPC automatically where mandated, and records every choice for your audit trail.