To get consent under the Oregon Consumer Privacy Act (OCPA), you need to clearly explain what data you’re collecting, why you’re collecting it, and how it will be used. Use simple, easy-to-understand language, and make sure individuals actively agree, such as by checking a box or clicking a button. For sensitive data, like health or biometric information, you must get opt-in consent before collecting or using it. Pre-checked boxes or assuming consent are not allowed. If you’re dealing with children’s data, you must get permission from a parent or guardian. Make it easy for people to change their minds and withdraw consent at any time.

The Oregon Consumer Privacy Act (OCPA) is enforced by the Oregon Attorney General, who is responsible for investigating violations. If a business is found to be non-compliant, the Attorney General typically provides a 30-day cure period during which the business can address and fix the issues. If the violations are not resolved within this timeframe, the Attorney General can impose penalties, including fines of up to $7,500 per violation.

Consumers cannot directly sue businesses under the OCPA, but they can report complaints to the Attorney General, who will determine whether enforcement action is necessary.

Start by checking if the law applies to you, like processing data for 100,000 Oregon residents or earning money from selling data. Create a clear privacy policy that explains what data you collect, why you use it, and how consumers can access or control their data. Set up a system to handle requests from customers, like deleting or correcting their data, and always get clear permission (opt-in consent) before using sensitive data like health or location information. For children’s data, make sure you get consent from their parents.

Shopify merchants can use tools like Consentmo to simplify compliance, as it provides automated solutions for cookie consent management, privacy notices, and handling data subject requests.