Does Oregon require businesses to honor a universal opt-out signal?

Oregon spent 18 months treating browser opt-out signals as optional. That ended on January 1, 2026. The Oregon Department of Justice is direct about it: controllers are required to accept opt-out requests through universal opt-out mechanisms starting on that date, and before then they could, but did not have to.

Where the requirement lives

The duty is not in a standalone universal opt-out section. It sits inside the list of methods a controller has to give consumers for submitting requests, at ORS 646A.578(5)(c), as amended by HB 2008.

Those methods must allow a consumer or an authorized agent to send a signal to the controller indicating the consumer's preference to opt out of the sale of personal data or targeted advertising under ORS 646A.574(1)(d).

Putting the duty inside the request-methods list has a practical consequence that is easy to miss: a universal opt-out signal is not a separate, lesser channel. It is one of the ways a consumer exercises an opt-out right, and it carries the same weight as a form submission.

The five conditions the mechanism has to meet

The statute does not name a product. It describes a test, and any platform, technology, or mechanism has to pass all of it. The mechanism must:

• not unfairly disadvantage another controller;
• not use a default setting, and instead require the consumer or authorized agent to make an affirmative, voluntary, and unambiguous choice to opt out;
• be consumer friendly and easy for an average consumer to use;
• be as consistent as possible with similar platforms, technologies, or mechanisms required under other federal or state laws or regulations; and
• enable the controller to accurately determine whether the consumer is an Oregon resident and has made a legitimate opt-out request.

The second condition is the one with teeth. A signal that is on by default for everyone does not meet the Oregon test, which is why the specification work behind Global Privacy Control put so much weight on the choice being deliberate.

The fourth condition is the reason a single implementation can serve several states. Oregon explicitly wants consistency with what other laws require rather than an Oregon-specific mechanism.

The link is a separate obligation

The same subsection requires the controller's request method to provide a clear and conspicuous link to a webpage where the consumer or an authorized agent may opt out. Only if the controller lacks the capacity to link to a webpage may it offer another method instead.

So the signal does not replace the link, and the link does not replace the signal. A business that added a "Do Not Sell or Share" link in 2024 and stopped there is now half compliant.

What happens when a signal conflicts with a loyalty program

The statute handles this case directly. If the opt-out conflicts with a consumer's voluntary participation in a bona fide reward, club card, loyalty, premium features, or discount program, the controller may either comply with the opt-out or notify the consumer of the conflict and ask them to affirm that they intend to withdraw from the program. If the consumer affirms, the controller has to comply with the opt-out.

Note the shape of that rule: the default is to honor the signal. Asking is the option, not the requirement, and the conversation can only ever end in the opt-out being honored or the consumer knowingly staying in the program.

Why this matters more in Oregon than it did last year

Oregon removed its 30-day right to cure on the same date the universal opt-out duty began. Before 2026, a controller that ignored the signal could expect a notice and a chance to fix it. Now the Attorney General can go straight to a civil investigative demand or a lawsuit, with civil penalties of up to $7,500 per violation.

Next step

If you sell personal data or run targeted advertising, this is now a build item and not a policy item. The free 2-minute Obligation Scan tells you which state opt-out rules apply to your business and what each one requires. See universal opt-out signals by state for the full map, the Oregon Consumer Privacy Act overview for who is covered, and Oregon fines and penalties for what getting it wrong now costs.