OCPA

Introduction

The use of cookies and similar technologies allows websites to retain preferences, perform performance analysis, track user behavior, and serve advertisements. These technologies might involve the collection or disclosure of personal information, hence the duty to provide privacy protection. The Oregon Consumer Privacy Act (OCPA), ORS 646A.570 – 646A.589, grants Oregon residents certain rights regarding their personal data and places obligations on covered controllers and processors. The law came into force on July 1, 2024. It does not include any general obligation to seek consent to all cookies and similar technologies; consent would depend on the personal data collected and the nature of its processing. Instead, businesses must assess the data collected, the purpose of processing, disclosures to third parties and the rights that apply.

Who Must Comply with the OCPA?

Generally, the OCPA applies to persons that conduct business in Oregon or provide products or services to Oregon residents and, during a calendar year, control or process personal data of at least 100,000 consumers, or control or process personal data of 25,000 or more consumers and derive 25 percent or more of their annual gross revenue from the sale of personal data, subject to the statute’s applicable exclusions and exemptions.. Personal data controlled or processed exclusively to complete a payment transaction is excluded from the 100,000-consumer threshold.

The Act also provides entity and data exceptions. Companies should refer to ORS 646A.572 instead of believing that all websites are governed by the Act. The Act recognizes that controllers make decisions about how data will be processed, whereas processors act according to a controller’s instructions.

How Does OCPA Apply to Cookies?

OCPA concerns the processing of personal data and not cookies as a technological device. Cookies, pixels, advertising identifiers, and other similar tools might be relevant when the data collected or associated with it is personal data, which is any information related to or reasonably capable of being associated with an identified or identifiable natural person. For example, using an advertising identifier together with online activity may result in profiling or targeted advertising Session cookies used to maintain shopping-cart functionality may be necessary to provide a service requested by the consumer. However, website owners should assess the personal data collected and the actual purpose of each cookie rather than assume that every session cookie is exempt from the OCPA.

Popular categories of cookies include “essential,” which refers to authentication and security cookies; “analytics,” which covers cookies used to measure website usage; “advertising,” which concerns cookies used to conduct targeting; and “third party,” which refers to cookies or pixels transmitting information to third parties. These are just convenient classification and do not create statutory exceptions. Just labeling cookies as “essential” or “analytics” does not automatically make their use legal. Companies should trace what kind of data each tool collects, to whom, how long it retains, and what purpose it serves.

When Is Consent Required?

Under ORS 646A.578, controllers must obtain the consumer’s consent before processing sensitive data and before processing personal data for purposes that are neither reasonably necessary to nor compatible with the purposes disclosed to the consumer, subject to the statute’s applicable provisions. Examples of sensitive information are race or ethnicity, national origin, religious beliefs, mental or physical health condition or diagnosis, sexual orientation, citizenship or immigration status, transgender or non-binary status, victim of crime status, genetic information, biometric information uniquely identifying an individual, a child’s information, and precise geolocation information.

For example, if a website collects precise geolocation information, the controller should determine whether the information constitutes sensitive data under the OCPA and, where required, obtain consent before processing the information. If a website says that it uses certain data for fulfilling orders but plans later to use this data for advertising in an incompatible manner, then it would be required to obtain consent. According to the OCPA, there is no requirement to have an opt-in banner for each ordinary cookie.

Opt-Out Rights and Targeted Advertising

Consumers may opt out of the processing of their personal data for targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal effects or similarly significant effects. The data covered includes that collected using advertising cookies, pixels, and identifiers. In this case, the controller must provide an effective method for consumers to exercise their opt-out rights. Depending on the processing activity, this mechanism may involve methods other than a cookie banner.

Universal Opt-Out Signals and Global Privacy Control

On or after January 1, 2026, covered controllers are obligated to identify qualifying universal opt-out signals. One example of a universal opt-out signal is the Global Privacy Control (GPC) signal that indicates the customer’s preference concerning the sale of personal information and use of personal information for targeted advertising purposes. The signal should meet certain requirements; therefore, businesses cannot be sure that any browser setting would qualify as an opt-out signal.

Covered websites should test whether their consent management technology and advertising technology get the signal and execute the opt-out in connection with the processing of personal information. If a business should comply with the signal, it should not exclusively depend on the banner.

Cookie Governance and Vendor Management

To comply with the OCPA, organizations should maintain a complete inventory of cookies, pixels, tags, SDKs, and similar tracking technologies deployed on their websites and applications.

For each technology, organizations should document:

• Name of the technology.
• Vendor or service provider.
• Purpose of processing.
• Categories of personal data collected.
• Whether data is shared with a third party.
• Whether the technology is used for targeted advertising.
• Applicable retention periods.
• Whether consumer consent is required.
• Whether opt-out rights apply.

Organizations should periodically review their tracking technologies to confirm that actual data collection practices remain consistent with privacy notices, consent mechanisms, consumer rights obligations, and contractual commitments with vendors.

Privacy Notices, Data Minimisation and Assessments

ORS 646A.578 requires that a covered controller provide a “meaningful privacy notice.” This must contain the following information: categories of personal data collected, reasons for processing, the process by which consumers may exercise their rights, data transferred to third parties and categories of such third parties, and any additional information specified in the statute. The cookie notice should accurately reflect actual collection, use, disclosure, and retention practices. Generic or inaccurate disclosures may not provide consumers with meaningful information regarding the processing of their personal data.

The controller is also supposed to collect no more personal data than is necessary for the purpose. The controller must have reasonable safeguards for data security. A data protection assessment needs to be done prior to any processing likely to result in increased harm (e.g., targeted advertising, sale, some kinds of profiling, and sensitive data).

Children’s Data and Precise Location

Under the OCPA, a child's personal data is classified as sensitive data. When a controller knows that a consumer is a child, the processing of that data must comply with the Children's Online Privacy Protection Act (COPPA) and applicable regulations. Organizations should carefully review the OCPA provisions applicable to consumers under 16 years of age, including restrictions related to targeted advertising, profiling, and the sale of personal data that became effective on January 1, 2026. Beginning January 1, 2026, Oregon law places significant restrictions on the sale of precise geolocation information. Organizations collecting or using precise location information should carefully review the statutory requirements and applicable exceptions before processing or disclosing such data.

Enforcement and Compliance Checklist

Enforcement of the OCPA falls under the authority of the Oregon Attorney General, with civil penalties up to $7,500 per violation and other forms of relief (injunctions, restitution, disgorgement). No pre-enforcement notice-and-cure period shall be required before enforcing violations of the OCPA as of January 1, 2026. There is no private right of action created by the OCPA for consumers.

• List all the tools that are employed for gathering/distributing personal information (cookies, pixels, SDKs, and more).
• Document the purpose of the use of the tool, category of the data, recipient, and retention period.
• Identify sensitive data processing and processing for secondary purposes where consent is required.
• Implement notices and opt-outs where applicable.
• Identify universal opt-out signals (including GPC where applicable).
• Evaluate children’s data, precise location data, vendor contracts, and data protection assessments.
• Ensure opt-outs significantly limit the processing of the data.

Conclusion

The Oregon Consumer Privacy Act places cookie compliance within the larger context of the need for transparency and lawful handling of personal data. Consent is not required for all cookies; there are some instances when organizations are required to seek consent, honor opt-out requests, recognize certain universal opt-outs, and provide accurate disclosure. Compliance needs to be based on the actual use of technology and the way the data is used.

Official Legal Sources

• Oregon Revised Statutes, Chapter 646A (including ORS 646A.570–646A.589): https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html
• Oregon Department of Justice, Privacy Law FAQs for Businesses: https://www.doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-for-businesses/
• Oregon Department of Justice, Consumer Privacy: https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/
• Oregon Department of Justice, Privacy Law FAQs for Consumers: https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/privacy-law-faqs-for-consumers/