Open workspace

Guide · US state law

OCPA: the Oregon law explained for people with ads

Oregon also covers nonprofits, gives visitors the right to know exactly which companies received their data and, since 2026, requires honoring the browser's automatic opt-out signal. Here is what changes for a site with ads.

Audit my site for OregonRead the guide
  • ✓Based on the law and on Oregon Department of Justice statements
  • ✓Examples designed for sites with AdSense and Ad Manager
  • ✓Read-only scan, no changes to the site
100,000Oregon consumers per year: the main threshold for the law to apply
16age below which the sale of data and targeted advertising have been prohibited since 2026
214complaints received by the state's privacy unit in the law's first year
$7,500maximum civil penalty per violation

What it is

A law with transparency about who receives the data

The Oregon Consumer Privacy Act, or OCPA, was passed in 2023 and took effect on July 1, 2024 for most businesses. For nonprofits, it has applied since July 1, 2025, a point that sets it apart from several other states.

The structure follows the Virginia and Colorado model: consumer rights, opt-out of targeted advertising and sale, consent for sensitive data and data protection assessments.

What is unique to Oregon is the right to ask for the list of the specific companies that received the person's data. For a site with ads, this means knowing exactly which partners receive visitors' data.

Since January 1, 2026, three changes weigh most: the site must honor the universal opt-out signal, the 30-day cure period before action has ended and people under 16 have gained full protection against sale and targeted advertising.

Checklist

What you need to meet

If the site exceeds the OCPA thresholds, this is the basic list, from most urgent to least.

  1. Have a clear, visible opt-out link

    The site needs a clear, visible link for the visitor to opt out of targeted advertising, sale and profiling. The Department of Justice warns that a cookie banner may not be enough.

    Example

    Footer link: Do Not Sell or Share My Personal Information, leading to an opt-out screen.

  2. Respect the universal opt-out signal

    Since January 1, 2026, the site must respect preference signals sent by the browser, such as Global Privacy Control.

    Example

    Visitor with GPC turned on: stop the sale and targeted ads for them, without asking for anything else.

  3. Protect anyone under 16

    Since 2026, the law prohibits selling data of anyone under 16 and using that data for targeted advertising or profiling.

    Example

    In a teen area of the site, show only non-personalized ads.

  4. Ask for consent for sensitive data

    Health, precise location and data of children under 13 only with consent. Since 2026, selling precise location is prohibited for anyone.

  5. Publish a complete privacy notice

    The notice describes the data processed, the purposes, whether it is passed to third parties and how to exercise rights. Anyone who passes data lists the categories of data and of third parties.

    Example

    Categories of third parties: ad companies, data analytics companies, data brokers.

  6. Respond to requests within 45 days

    Respond within 45 days, with one extension of another 45 if you explain the reason. The visitor can also ask for the list of the specific third parties that received their data.

    Example

    Have ready the list of ad partners that receive data, with the name of each company.

  7. Do the data protection assessment

    Before using data for targeted advertising, sale, profiling or sensitive data, the company assesses the risks in writing.

  8. Pass the opt-out to Google

    Google does not require a CMP for US states. Use the US state regulations message, in Privacy & messaging, or turn on restricted data processing, RDP, in the tag for people who opted out. With GPP, Google reads the US National section for Oregon.

    Example

    AdSense or Ad Manager: Privacy & messaging, US state regulations card, Create. Then choose the sites and publish.

    // Só para o visitante que recusou
googletag.pubads().setPrivacySettings({
  restrictDataProcessing: true,
});

In practice

Right and wrong

Official tools

Certified CMPs and official links

Google does not require a certified CMP or GPP for US state laws. You can use Google's own message or turn on RDP in the tag.

Who it applies to

Visitor volume, for-profit or not

The OCPA applies to anyone who does business in Oregon or offers products and services to residents of the state and reaches one of the thresholds below in a year.

100,000 consumers

Controlling or processing data of at least 100,000 Oregon consumers, not counting data used only to complete a payment.

25,000 and a quarter of revenue

Processing data of at least 25,000 consumers and getting 25% or more of annual gross revenue from selling personal data.

Nonprofits

Since July 1, 2025, nonprofit organizations that pass the thresholds must also comply with the law.

Automakers

Since September 2025, all vehicle manufacturers are covered by the law, regardless of the number of Oregon consumers.

Definitions

The terms that matter for people who sell ads

Oregon has a broad list of sensitive data and defines sale to include exchanges without money.

Personal data

Information linked, or reasonably linkable, to a person or to a device linked to them. De-identified and public data are left out.

Sensitive data

Racial or ethnic origin, national origin, religion, health, sexual orientation, transgender or nonbinary identity, status as a crime victim, immigration status, children's data, genetic and biometric data and location within a 1,750-foot radius.

Sale

The exchange of personal data for money or other value with a third party. Transfers to contracted processors and at the consumer's request are left out.

Targeted advertising

An ad chosen based on data about the person's activities over time on other companies' sites and apps. Contextual ads and reach measurement do not count.

Rights

What an Oregon visitor can ask for

The visitor can confirm whether the business processes their data, access that data, correct it, delete it and receive a copy in a format they can take to another service. They can also refuse targeted advertising, sale of data and profiling used in important decisions.

The right unique to Oregon is to ask for the list of specific companies, and not just categories, to which the business passed their data. On a site with ads, this list can include Google, header bidding networks, video platforms and social media pixels.

The business must verify the identity of the requester and respond within 45 days. Deletion requests must also be honored within 45 days, with some exceptions.

In the first-year report, the Department of Justice said the right to delete was the one residents most often reported being denied.

Site obligations

Privacy notice, universal opt-out and minors

The privacy notice must explain what data is processed, what for, who it is passed to and how to exercise rights. If the site sells data or does targeted advertising, it must say so clearly and show how to opt out.

Since January 1, 2026, the site must also honor universal opt-out mechanisms, such as a browser setting or an extension that sends the signal, like the Global Privacy Control. Anyone with the signal on must be treated as having opted out, with no extra click.

Sensitive data can only be processed with consent. For children under 13, the federal COPPA law applies. Since January 1, 2026, the law prohibits selling data of consumers under 16 and using their data for targeted advertising or profiling. On the same date, the ban on selling precise location of any consumer took effect.

Targeted advertising, sale of data, sensitive data and risky profiling require a documented data protection assessment, which the attorney general can request in an investigation.

Timeline

Oregon law dates

Dates confirmed in Oregon Department of Justice statements.

  1. 2023

    Law passed

    Oregon passes the OCPA, with its own rules for nonprofits.

  2. July 1, 2024

    Entry into force

    The rights, opt-out, list of third parties and the 30-day cure period take effect.

  3. July 1, 2025

    Nonprofits

    Nonprofits that pass the thresholds now comply with the law.

  4. August 29, 2025

    First-year report

    The Department of Justice reports 214 complaints and 38 cases opened and closed after violation notices.

  5. January 1, 2026

    Universal opt-out and end of the cure period

    Honoring the universal signal, the ban on selling data of under-16s and precise location take effect, and the mandatory 30-day cure period ends.

Enforcement and fines

Attorney general, privacy unit and fine per violation

The Oregon attorney general has exclusive authority to enforce the law, with a dedicated privacy unit in the Department of Justice. He can investigate, demand documents, seek a court order and collect a civil penalty of up to $7,500 per violation. Individuals cannot sue the business under the OCPA.

Until January 1, 2026, the business received a notice and had 30 days to fix the problem before action. That period has ended, and the state can act without prior notice.

In the first year, most complaints involved data brokers, such as sites that sell background reports. Even so, the lessons apply to any site: say which third parties receive data, include marketing profiles in access and deletion requests, and keep rights forms accessible and working.

According to the state, most of the businesses notified fixed their privacy notice or request mechanisms soon after contact.

AdSense and Ad Manager

How Google treats the Oregon visitor

The IAB Tech Lab has an Oregon section in the GPP string, but Google does not list it among the sections AdSense accepts. For Oregon, Google reads the US National section.

When the US National section indicates an opt-out of sale, sharing or targeted advertising, Google turns on restricted data processing, RDP, and shows only non-personalized ads. The US National section also has fields for minors' consent, which Google uses to turn on RDP.

The US states privacy message, in AdSense and Ad Manager, includes Oregon and saves the choice in the US National section. With another CMP, check that it sends the US National section for Oregon visitors and marks the opt-out when the universal signal is on.

To answer the third-party list request, keep an up-to-date inventory of the ad, header bidding, video and pixel partners that receive data on the site.

In practice

What is and is not allowed in Oregon

Examples for a site with ads that is covered by the law.

Allowed

  • Show personalized ads to adults without asking permission first, with a visible opt-out link
  • Treat the GPC as an automatic opt-out since January 2026
  • Give the visitor the list of ad partners that received their data
  • Show contextual ads to minors and to people who opted out
  • Record the opt-out in the US National section of the GPP

Not allowed

  • Use data of under-16s for targeted advertising or profiling
  • Sell the precise location of any visitor
  • Answer the third-party list request with only generic categories
  • Wait for a cure notice that is no longer mandatory
  • Keep a rights form that does not send or never gets a response

Common errors

Where sites usually go wrong with Oregon

The first-year lessons and the 2026 changes point to the same issues.

Not knowing who receives data

The site has no inventory of partners and cannot build the list of third parties the visitor asked for.

GPC ignored in Oregon

The CMP honors the GPC in California and Colorado, but was not updated for Oregon in 2026.

Incomplete deletion

The deletion request erases the registration but keeps marketing profiles and audience lists.

State section without US National

The CMP sends only the Oregon section, which AdSense does not accept, and Google keeps personalizing.

In ConsentMode

What the audit checks about the OCPA

  • Opens the site as an Oregon visitor with the GPC off and on and compares the ad requests.
  • Reads the GPP string and shows whether the US National section is present and indicates the opt-out.
  • Lists the ad, header bidding, video and pixel domains loaded, which helps build the third-party list.
  • Identifies the CMP and checks that the tags wait for its response.
  • Reads the privacy policy and points out whether third parties, rights and the way to opt out are missing.
Run an auditSee everything that is checked

Frequently asked questions about the Oregon law

Does my nonprofit association need to comply with the OCPA?

Since July 1, 2025, yes, if it passes one of the thresholds, such as 100,000 Oregon consumers per year.

Do I need a consent banner for Oregon?

For personalized ads to adults, no. The law asks for an opt-out. Consent is required for sensitive data, and for under-16s the sale and targeted advertising are prohibited.

Is the GPC mandatory in Oregon?

Yes, since January 1, 2026. The Department of Justice highlighted this tool on Data Privacy Day 2026.

What do I answer when they ask for the list of third parties?

The names of the specific companies that received the person's data, such as ad networks and video platforms, and not just generic categories.

Does ConsentMode build that list for me?

ConsentMode shows which third-party domains load on the site during the visit, which helps build the inventory. The response to the visitor remains the business's responsibility.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

See whether your site is already ready for 2026

The audit opens the site as an Oregon visitor, with and without GPC, and shows what to fix without changing anything.

Start the audit