← ALL REGULATIONS
Oregon Consumer Privacy Act cookie rules, and the GPC signal.
Oregon lets sites set advertising cookies without opt-in consent, but consumers must be able to opt out of targeted advertising, the sale of their data and some profiling. Since 1 January 2026, a universal opt-out signal such as Global Privacy Control (GPC) has to be honoured as an opt-out of targeted advertising and sale.
OCPA at a glanceOpt-out, opt-in for some data
- Applies to
- Businesses, and since July 2025 nonprofits, that process data of 100,000+ Oregon consumers a year, or 25,000+ while earning over 25% of revenue from selling it
- In force
- July 2024, with universal opt-out signals required since January 2026
- Enforced by
- Oregon Attorney General (Department of Justice)
- Penalties
- Up to $7,500 per violation; the period to cure ended on 1 January 2026
WHAT OCPA REQUIRES
What Oregon asks of a site that uses advertising cookies.
THE RULEHonour universal opt-out signalsSince 1 January 2026, controllers must accept opt-out requests sent through a universal opt-out mechanism, and the Department of Justice names Global Privacy Control as an example.
WITH KATLAKatla honours Global Privacy Control: a visitor whose browser sends it is recorded as opted out, unless they have already made a choice.
THE RULEA clear opt-out linkSites need a clear and conspicuous link to opt out. The Department of Justice says a cookie banner may be enough for some businesses but not for all, depending on what data they collect and how they use it.
WITH KATLAIn US State Laws (CCPA) mode, the banner’s main button is "Do Not Sell or Share My Personal Information", and the marketing category is labelled as the sale or sharing of personal information. The wording follows California’s law; there is no Oregon-specific label.
THE RULEConsent for sensitive data, and limits for under-16sProcessing sensitive data needs consent. Since 1 January 2026, a controller may not sell the data of a consumer under 16 or use it for targeted advertising or profiling, and may not sell anyone’s precise geolocation.
WITH KATLAKatla has no age-specific flow, and its categories describe what cookies are for, not which data types they carry. A site that processes sensitive data or serves under-16s can run Katla in GDPR mode, so nothing non-essential is set before an opt-in.
THE RULEA privacy notice, and a list of third partiesThe notice must cover the categories of data processed and shared, and the categories of third parties. Consumers can also ask for a list of the specific third parties that received their data.
WITH KATLAKatla’s scan lists every cookie it finds with its domain, and the generated cookie policy is built from that list. The privacy notice itself, and answering requests for the list of third parties, are outside what a consent tool does.
OCPA questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Is Global Privacy Control mandatory in Oregon?
- Yes. Since 1 January 2026, controllers must accept opt-out requests sent through a universal opt-out mechanism, and the Department of Justice gives Global Privacy Control as an example.
- Does the Oregon law apply to nonprofits?
- Yes. It has applied to nonprofits since 1 July 2025, with the same thresholds and requirements as businesses.
- Is there still a cure period?
- No. Since 1 January 2026 the Attorney General no longer has to give notice and a chance to cure before taking action.
- Is a cookie banner enough in Oregon?
- Sometimes. The Department of Justice says a cookie banner might be sufficient for some businesses to handle opt-outs but not for all, depending on the data they collect and how they use it.
- How does Katla treat Oregon visitors?
- Auto mode reads the visitor’s timezone, and US timezones get the CCPA banner with its opt-out and GPC handling. You can also set the site to US State Laws (CCPA) mode for everyone.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.