Oregon Consumer Privacy Act Compliance with ConsentX

The Oregon Consumer Privacy Act (OCPA) is Oregon's comprehensive consumer privacy law. It became effective on July 1, 2024 and gives Oregon consumers rights over their personal data while establishing obligations for covered businesses.

Oregon consumers generally have the right to know what personal data a controller has collected, obtain confirmation that their personal data is being processed, obtain a copy of their personal data, request correction of inaccurate personal data, request deletion of their personal data, obtain information about certain third parties that received their data, opt out of targeted advertising, opt out of the sale of personal data and opt out of profiling that produces legal effects or similarly significant effects. Oregon's Department of Justice summarizes these rights through its L.O.C.K.E.D. framework: List, Opt-out, Copy, Know, Edit, and Delete.

Not for all personal-data processing. However, controllers must obtain consent before processing sensitive data. The OCPA also requires an effective mechanism for consumers to revoke consent, and the withdrawal mechanism must be at least as easy to use as the mechanism through which consent was provided.

Sensitive data includes certain information revealing racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, transgender or nonbinary status, victim-of-crime status, citizenship or immigration status, as well as genetic or biometric data, certain precise location data, and children's personal data. Personal data of children under 13 is specifically treated as sensitive data.

Yes. Oregon consumers have the right to opt out of the processing of their personal data for targeted advertising.

Yes. Consumers have the right to opt out of the sale of their personal data. The OCPA also provides mechanisms through which an authorized agent may exercise certain opt-out rights on a consumer's behalf.

Yes. Consumers can opt out of profiling when the profiling is used in furtherance of decisions that produce legal effects or effects of similar significance.

The OCPA requires covered controllers to provide a mechanism through which consumers or authorized agents can communicate opt-out preferences using qualifying technology or mechanisms. The mechanism must require an affirmative, voluntary, and unambiguous choice rather than relying on a default setting. Organizations should assess Oregon's requirements alongside universal opt-out requirements under other state privacy laws.

The OCPA regulates personal-data processing rather than cookies as a standalone technology. Cookies, pixels, advertising tags, SDKs, and other tracking technologies may nevertheless collect or process personal data or support targeted advertising. For this reason, tracker discovery, privacy preference management, and enforcement of consumer choices can be important components of an OCPA compliance program.

Yes. Controllers must provide a reasonably accessible, clear, and meaningful privacy notice describing categories of personal data processed, purposes of processing, applicable consumer rights, categories of data shared with third parties, relevant third-party categories, and methods for submitting consumer requests.

Yes. Controllers must conduct and document data protection assessments for processing activities that present a heightened risk of harm to consumers. These can include targeted advertising, sensitive-data processing, selling personal data, and certain profiling activities.

Controllers generally must respond to a consumer request without undue delay and no later than 45 days after receiving the request. The period may generally be extended by an additional 45 days when reasonably necessary, provided the controller notifies the consumer within the initial response period and explains the reason for the extension.

Yes. Controllers must establish a process through which consumers can appeal a refusal to take action on a privacy request. The controller generally must decide the appeal within 45 days and provide information enabling the consumer to contact the Oregon Attorney General if the appeal is denied.

Yes. Consumers can designate an authorized agent to exercise certain opt-out rights on their behalf. The OCPA also allows opt-out requests through mechanisms such as internet links, browser settings, browser extensions, global device settings, or other qualifying technology.

Yes. The OCPA provides heightened protections for children's data. Personal data of children under 13 is treated as sensitive data, while the law also contains additional protections relating to consumers under 16, including restrictions concerning targeted advertising, profiling, and certain sales of personal data.

The OCPA is enforced by the Oregon Attorney General, through the Oregon Department of Justice. Oregon has published consumer and business guidance explaining the law and its enforcement framework.

ConsentX can help operationalize important privacy controls such as consent management, tracker discovery, prior-script blocking, consumer opt-out management, rights-request workflows, and audit evidence. However, no software can independently guarantee legal compliance. Organizations should assess their complete privacy program against the OCPA and all other applicable laws.