iQ Cookie State Law Series
Cookie & Privacy Law in Oregon
Educational purposes only — not legal advice. This guide is intended to help you understand Oregon’s data privacy law as it relates to cookie consent and website compliance. Laws change, and your specific situation may vary. Always consult a qualified legal professional before making compliance decisions. iQ Cookie is a technology tool, not a law firm.
The short version
Oregon’s OCPA took effect July 1, 2024 for most businesses, but nonprofits got an extra year — their compliance deadline was July 1, 2025. That is the headline feature: Oregon is one of only a handful of states whose privacy law reaches nonprofit organizations at all. Its 30-day cure period expired January 1, 2026, so enforcement is now immediate.
Oregon does not have a separate cookie law. Cookie compliance flows from the OCPA itself — its opt-out and sensitive-data rules apply directly to cookies and tracking technology.
Who does it apply to?
The OCPA covers businesses that conduct business in Oregon or target Oregon residents, and meet at least one of these thresholds:
Controls or processes personal data of 100,000 or more Oregon consumers during a calendar year.
Controls or processes data of 25,000 or more consumers AND derives 25% or more of gross revenue from selling personal data.
No minimum revenue floor exists (unlike California), and nonprofits are covered as of July 1, 2025 with only narrow exceptions for insurance-fraud-detection organizations and noncommercial radio/TV programming providers.
Consumer rights
Oregon residents whose data is covered by the OCPA can:
Businesses must respond within 45 days, extendable once by 45 more. There is no private right of action — only the Attorney General can enforce.
What makes Oregon different
Nonprofits are covered — with a delayed start. Oregon is one of the few states whose privacy law reaches nonprofits at all. Their compliance deadline was pushed a year out to July 1, 2025, but the exceptions are narrow: insurance-fraud-detection organizations and noncommercial radio/TV programming providers only.
Two sensitive data categories not found elsewhere in this series. Oregon explicitly adds transgender or nonbinary status and crime victim status to its sensitive data list — categories most peer states do not call out separately.
GPC came late but with a fast response clock. Universal opt-out recognition wasn’t required until January 1, 2026 — later than most peer states — but once required, businesses must respond to GPC signals within 15 days.
A real data broker registry with teeth. Data brokers have had to register annually with the state and pay a $600 fee since January 1, 2024 — ahead of the OCPA’s own general effective date.
Enforcement is not hypothetical. The Oregon DOJ’s first-year enforcement report (Jul 2024–Jun 2025) logged 214 complaints and closed 38 matters — among the most actively documented enforcement records of any state in this series.
Sensitive data & children
Processing sensitive data requires opt-in consent before any collection begins. Sensitive data includes:
Under-13 data requires opt-in consent by default. For ages 13–15, enhanced consent is required for targeted ads and data sales. As of September 26, 2025 (HB 2008), sale of personal data, precise geolocation tracking, and certain profiling are prohibited outright for any known consumer under 16 — a ban rather than an opt-in requirement.
What this means for your cookies
| Cookie / data type | Requirement | What to do |
|---|---|---|
| Sensitive data cookies (health, biometric, geolocation) | Opt-in required | Gate these behind affirmative consent before they fire. |
| Sale / targeted advertising cookies | Opt-out required | Provide a clear opt-out mechanism. |
| GPC / universal opt-out signals | Required since Jan 1, 2026 | Confirm your consent tool honors GPC within 15 days of a signal. |
| Sale / geolocation / profiling cookies — under 16 | Banned outright | Block these entirely for known consumers under 16, per HB 2008. |
| Any cookies — users 13–15 | Enhanced consent required | No targeted-ad or sale cookies without heightened consent. |
Enforcement
The Oregon Attorney General has exclusive enforcement authority, with penalties up to $7,500 per violation — and each affected consumer can count as a separate violation, which compounds quickly. The DOJ has already shown it acts on complaints, having closed 38 matters in the law’s first year alone.
Your action checklist
With no cure period left and active enforcement underway, these need to be handled now:
Check your thresholds — nonprofits included. If you’re a nonprofit processing data on 100,000+ Oregon consumers, or 25,000+ while earning a quarter of revenue from data sales, you’ve been in scope since July 2025.
Confirm GPC recognition is live and fast. Required since January 1, 2026, with a 15-day response clock for honoring signals.
Block sale, geolocation, and profiling for under-16 users outright. This is a ban, not an opt-in workaround, under HB 2008.
Audit sensitive data cookies for Oregon-specific categories. Confirm your consent gating covers transgender/nonbinary status and crime victim status, not just the standard list.
Register as a data broker if applicable. Annual registration and a $600 fee are required if that classification applies to your business.
Update your privacy policy. Cover data categories, processing purposes, third-party recipients, and how to exercise every right, including the appeal process.
Review vendor contracts. Any processor handling Oregon resident data must be covered by a written agreement specifying processing instructions and confidentiality obligations.
iQ Cookie scans your site for compliance gaps and deploys a lightweight US-built consent banner.
iQ Cookie State Law Series · Guide 17 of 25 · Next: Rhode Island →