Oregon Consumer Privacy Act: cookie rules for Oregon visitors

What is the Oregon Consumer Privacy Act?

The Oregon Consumer Privacy Act (OCPA), Senate Bill 619, was passed in June 2023 after work by the Attorney General's Consumer Privacy Task Force, and is codified at ORS 646A.570 to 646A.589. It took effect for most organizations on 1 July 2024 and for non-profits on 1 July 2025. The Privacy Unit of the Oregon Department of Justice enforces it and publishes regular enforcement reports, which makes Oregon one of the more transparent states about what it checks.

Three amendments from the 2025 legislative session changed the picture: House Bill 3875, in effect since September 2025, extends the Act to vehicle manufacturers regardless of size; House Bill 2008, in effect since 1 January 2026, bans the sale of two categories of data; and the universal opt-out provision written into the original Act also took effect on 1 January 2026. For a comparison with the other states, see US state privacy laws.

Who does the OCPA apply to?

The Act applies to any person that conducts business in Oregon or provides products or services to Oregon residents and that, during a calendar year, controls or processes the personal data of:

• at least 100,000 consumers, or
• at least 25,000 consumers while deriving over 25% of annual gross revenue from selling personal data.

Unlike Virginia and Texas, Oregon has no general exemption for non-profits, which have been covered since 1 July 2025. Vehicle manufacturers and some of their affiliates are covered whatever their numbers. The Department of Justice warns that related companies, such as a parent and its subsidiaries, may have to add their consumer counts together. Governments, financial institutions as defined in Oregon law and certain insurers are excluded, and data covered by laws such as HIPAA is exempt. Employee and job applicant data are outside the Act.

What does the OCPA require for cookies and trackers?

Personal data under the OCPA includes information linked or reasonably linkable to a person or to a device, so cookie identifiers and device IDs are covered. For websites, the obligations are:

• Opt-out of targeted advertising, sale and profiling. Targeted advertising covers ads selected from a consumer's activity across non-affiliated websites and apps, which is what retargeting pixels and ad network cookies do. A sale is an exchange of personal data for monetary or other valuable consideration; the Department of Justice gives the example of trading customer lists with another company.
• A clear and conspicuous opt-out link on the website, which the Department says must remain even now that opt-out signals are honored.
• Consent for sensitive data: data revealing racial or ethnic background, national origin, religious beliefs, mental or physical health, sexual orientation, citizenship or immigration status, transgender or nonbinary status, or status as a crime victim, genetic or biometric data, the data of a child under 13, and precise past or present location.
• Consent for secondary purposes. Using data for a purpose not reasonably necessary for, and compatible with, the purposes in the privacy notice requires consent. The Department's example is a restaurant website that collects data to complete orders and cannot sell it to advertisers without consent.

Sales banned since 1 January 2026. House Bill 2008 makes it unlawful to sell any consumer's precise geolocation data (within a radius of 1,750 feet) and to sell the personal data of a consumer under 16. Controllers also may not process the data of anyone under 16 for targeted advertising or profiling.

A list of specific third parties. Oregon gives consumers the right to obtain a list of the specific third parties, not just categories, to which their data was disclosed. The Department's one-year report reminds companies that they must offer this right, including for data that was sold.

First-party analytics for the site's own measurement is not targeted advertising or a sale, and needs only to be described in the privacy notice.

Must I honor Global Privacy Control in Oregon?

Yes, since 1 January 2026. Covered businesses and non-profits must treat opt-out preference signals that meet the Act's technical requirements as valid requests to opt out of the sale of personal data and targeted advertising. The Department of Justice names Global Privacy Control as an example and explains to consumers that once the signal is on, businesses may still collect and keep data but may not sell it or use it for targeted advertising. The Global Privacy Control guide covers detection and logging.

Enforcement and penalties

The Attorney General has sole enforcement power, and there is no private right of action. Until 31 December 2025 the Department of Justice had to give 30 days to cure a violation before taking action. That period has ended: the Department can now go directly to a civil investigative demand or a lawsuit. Penalties are up to $7,500 per violation, and the Attorney General can also seek injunctions, restitution and disgorgement.

Enforcement so far has used cure letters rather than fines. In its first year the Privacy Unit received 214 complaints, mostly about online data brokers and refused deletion requests, and opened and closed 38 matters after notices of violation and information requests; by 30 September 2025 complaints had reached 265. Its quarterly report of October 2025 tells businesses to expect civil investigative demands once the cure period ends, and notes that Oregon coordinates with other states through the Consortium of Privacy Regulators.

How Cookiequiet handles Oregon

With geo-targeting, included on every plan including Free, Cookiequiet can show Oregon visitors an opt-out notice with a "Do not sell or share my personal information" link, while EU and UK visitors see the opt-in banner, and it honors Global Privacy Control as an opt-out. The banner is set up with one script tag in about five minutes; see pricing. The policy templates are written for the CCPA/CPRA and do not produce Oregon's list of specific third parties, so prepare that list yourself.