B2B website visitor identification for Oregon-based sites

The OCPA defines a 'consumer' as an Oregon resident acting only in an individual or household context, and it explicitly excludes a person acting in a commercial or employment capacity — as an employee, owner, director, officer or contractor communicating on behalf of a business. That means data collected in a purely business-to-business context, such as a work email address tied to a job function, generally sits outside the consumer-rights provisions the OCPA creates. This is the same structural approach most US state privacy laws outside California take, and it differs sharply from California, where the CCPA/CPRA's temporary B2B and employee exemptions expired on 1 January 2023, pulling business contact data into scope there. Whether a specific data element your site collects falls inside or outside that B2B carve-out under Oregon's current statutory language and guidance is a determination your own counsel should make, since the facts of each data flow matter.

The OCPA defines personal data unusually broadly as data linked or reasonably linkable to a consumer, or to a device linked or reasonably linkable to a consumer, which is wider than statutes tied strictly to an identified natural person. lead.box resolves a visiting organisation from network-level signals — primarily IP ranges associated with companies — into a company name, industry and size band, without identifying a named individual, without setting advertising identifiers, and without building a cross-site profile of a person. Whether that specific activity falls inside or outside the OCPA's broad personal-data definition, and inside or outside its individual-context consumer definition, depends on exactly what your deployment stores and how it's configured, which is a legal question for your own counsel rather than something lead.box can certify on your behalf. lead.box operates as a processor under a data processing agreement and documents its data flows to support that review.

The OCPA gives Oregon consumers a right, on request, to obtain a list of the specific third parties to which a controller has disclosed their personal data — a broader disclosure right than most comparable state laws, which typically only require a description of categories of recipients. That obligation applies to controllers handling covered consumer personal data, and it is one reason Oregon-based buyers tend to ask vendors for a precise, named sub-processor list rather than a vague category description during procurement. lead.box publishes its sub-processor list and can support a controller's own response to that kind of request, but whether a given website's use of lead.box triggers the obligation at all depends on whether the underlying data is covered personal data about a consumer as the OCPA defines that term — again a determination for your counsel, not a default assumption.

The OCPA applies to a controller that conducts business in Oregon or targets Oregon residents and that, during a calendar year, controls or processes the personal data of 100,000 or more Oregon consumers, excluding data processed solely to complete a payment transaction, or of 25,000 or more consumers while deriving 25% or more of annual gross revenue from selling personal data. There is no separate revenue-only trigger independent of those consumer-count thresholds, so a small site with modest Oregon traffic and no data-sale revenue stream may sit below both thresholds entirely, regardless of overall company size. Counting consumers correctly — including whether visitor identification data even counts toward that number given the B2B exclusion — is a fact-specific exercise, and your own counsel should confirm where your organisation lands before you rely on being under or over the line.

Starting 1 January 2026, the OCPA requires controllers to recognise a universal opt-out mechanism — an opt-out preference signal sent by a consumer's browser, extension or device — as a valid method of exercising certain consumer rights, similar to signals used under some other state laws. That requirement is directed at consumer-facing data uses covered by the statute, such as targeted advertising or sale of personal data about individuals in their personal capacity; it is a separate question from company-level identification of a business visitor, which does not target an individual consumer or rely on advertising identifiers. Oregon buyers are increasingly asking vendors how they'll handle universal opt-out signals well ahead of the 2026 date, and it's worth having a documented, current answer ready even where your own legal analysis concludes the underlying activity falls outside OCPA's consumer scope.

Enforcement authority for the OCPA sits exclusively with the Oregon Department of Justice, acting through the Attorney General; the statute does not give individual Oregon consumers a private right of action to sue directly. Controllers currently have the benefit of a 30-day cure period, during which the Attorney General must give notice of a suspected violation and allow it to be corrected before pursuing further action, but that cure period is set to sunset on 1 January 2026, after which the Attorney General can act without that mandatory notice-and-fix window. That approaching deadline is a reasonable prompt to get documentation and vendor review in order sooner rather than later, but the specific compliance steps that matter for your organisation depend on your own data practices and should be confirmed with counsel.

Oregon's OCPA excludes a person acting in a commercial or employment context from its definition of a protected consumer, so purely business-to-business contact data collected by an Oregon company largely sits outside the statute's individual-rights machinery. California draws that line very differently: the CCPA/CPRA's temporary B2B and employee-data exemptions expired on 1 January 2023, so California's law now covers business contact data in a way Oregon's does not. A Portland-based company selling nationally has to track both frameworks separately for its own compliance posture — narrower B2B treatment at home, broader coverage for California visitors and customers — rather than assuming one state's rule applies everywhere its site is viewed. This kind of state-by-state variation is exactly why a written legal review specific to each state you do business in matters more than a single blanket policy.

Yes, in the sense that OCPA applicability is only one part of a normal vendor review, and it's worth treating them as separate questions rather than assuming a favourable OCPA analysis closes the file. lead.box identifies the visiting organisation, not a named person, processes data as a processor under a written data processing agreement, keeps processing in ISO-certified EU data centres, and publishes its sub-processor list for exactly this kind of review. None of that constitutes legal advice or a compliance certification, and it doesn't substitute for your own counsel confirming how the OCPA's consumer definition, personal-data scope, and upcoming universal opt-out requirement apply to your specific website and data flows. Treating this page as background context for that review, rather than as the review itself, is the right way to use it.