Privacy & Cybersecurity Law Blog

On January 28, 2026, during Oregon’s Data Privacy Day, Oregon Attorney General Dan Rayfield spotlighted a major advance in consumer data protection in the state: the Universal Opt-Out tool, now available to all Oregon residents under the Oregon Consumer Privacy Act (“OCPA”).

Effective since January 1, 2026, the Universal Opt-Out allows Oregon residents to use a simple browser setting or extension to signal “Do Not Sell My Data” across multiple websites automatically. Instead of manually opting out on each site, consumers can send a universal browser signal to opt out of sales or sharing of their personal data and its use for targeted advertising. The OCPA’s expanded protections apply to home addresses, browsing history, and financial information, and now cover both for-profits and nonprofits conducting business in Oregon.

For businesses and nonprofits operating in Oregon or serving Oregon consumers, this development marks a significant shift in privacy compliance obligations to honor these signals.

In addition to Universal Opt-Out, the OCPA includes several key changes:

• Children’s Data: Sale of personal data for individuals under 16 is prohibited.
• Geolocation Data: Sale of precise geolocation data for all Oregon residents is prohibited.
• Cure Period Expiration: The law’s “cure period” has expired, which means that businesses and nonprofits are now fully responsible for complying with the law.

For more information on the OCPA, read our earlier coverage here. To learn more about Universal Opt-Out and other privacy protections, visit the Oregon DOJ’s Consumer Privacy Page.