Oregon Consumer Privacy Act (OCPA)
The Oregon Consumer Privacy Act (OCPA), effective July 1, 2024, gives Oregon residents rights to access, correct, delete, and obtain a copy of their data, plus opt-outs of targeted advertising, sale, and profiling. It stands out for letting consumers request a list of the specific third parties to which a controller disclosed their personal data — a stronger transparency right than most peers. Ad-linked analytics is the main contact point. This is educational, not legal advice.
What this means
The OCPA applies to persons conducting business in Oregon or targeting Oregon residents above defined thresholds. It grants the now-standard suite of consumer rights — access, correction, deletion, portability — and opt-outs of targeted advertising, sale of personal data, and profiling with significant effects, alongside consent requirements for sensitive data. It uses controller and processor roles consistent with other state laws.
The third-party transparency right
A distinctive OCPA feature lets a consumer ask a controller for a list of the specific third parties to which it has disclosed the consumer's personal data (with some scope nuances), rather than only categories of recipients. This raises the bar on knowing where data goes. The OCPA also requires honouring universal opt-out signals. For analytics, the cleanest posture is keeping data first-party so there is little third-party disclosure to enumerate.
- Standard access, correct, delete, and opt-out rights
- Right to a list of specific third-party recipients
- Honour universal opt-out preference signals
How it appears in analytics and logs
If analytics shares Oregon residents' data, the OCPA grants opt-outs and a right to learn the specific third parties that received it.
Diagnostic use case
Check whether analytics discloses Oregon residents' data to third parties or feeds targeted advertising, since the OCPA adds rights over both.
What WebmasterID can help detect
WebmasterID is first-party and does not disclose identifiers to advertising third parties, simplifying the OCPA's third-party transparency expectations.
Common mistakes
- Tracking only recipient categories when specific third parties may be requested.
- Ignoring universal opt-out signal recognition.
- Overlooking sensitive-data consent requirements.
Privacy and accuracy notes
This page is educational, not legal advice. First-party, non-shared analytics keeps you away from the OCPA's third-party disclosure and targeted-ad rights.
Related pages
- US state privacy laws overview
In the absence of a single federal privacy statute, several US states have enacted comprehensive consumer privacy laws with overlapping but non-identical rules. Most grant access, deletion, and correction rights and require opt-outs for targeted advertising and 'sale'. This page gives an educational overview of the common pattern and how it touches analytics.
- Data subject access requests (DSAR)
Under the GDPR's right of access (Article 15), a person can ask a controller to confirm whether it processes their personal data and to receive a copy. Analytics datasets can fall in scope when they contain identifiers tied to an individual. This page explains the right and why data minimisation shrinks what a DSAR can reach.
- Montana Consumer Data Privacy Act
The Montana Consumer Data Privacy Act (MCDPA), effective October 1, 2024, grants Montana residents rights to access, correct, delete, and port their data, plus opt-outs of targeted advertising, sale, and profiling. It closely follows the Virginia template but sets comparatively low applicability thresholds, reflecting Montana's smaller population. Universal opt-out signal recognition is required. Ad-linked analytics is the main contact point. This is educational, not legal advice.
- Privacy-first analytics
First-party measurement leaves little third-party disclosure.
Sources and verification notes
- Oregon DOJ — Oregon Consumer Privacy ActOfficial state guidance. Educational, not legal advice.
Last reviewed 2026-06-24. Facts are checked against primary/official sources where available; uncertain specifics are marked “Data not yet verified” rather than guessed.