Privacy & Consent

The current site loads several tracking tags: analytics, advertising pixels, measurement scripts. Like most sites of their era, none of them ask visitors before they start collecting. That was normal for a long time. It isn't anymore, and the rebuild is the right moment to get this right instead of retrofitting it later.

This page covers what the site tracks today, what the law expects, how we recommend handling consent on the new site, and how the mechanics actually work for anyone who wants the detail.

What the site collects today

These tags carry over from the current site (see What's Carrying Over):

Analytics tells us how the site is doing. The Meta Pixel and Trade Desk tags go further: they're advertising trackers that follow visitors across sites. That second category is what privacy law cares most about.

What the law expects

Oregon. The Oregon Consumer Privacy Act took effect July 2024 and has applied to nonprofits since July 2025. Oregon is one of the few states that didn't exempt them. It gives Oregonians the right to opt out of targeted advertising, and since January 2026 sites are expected to honor browser-level opt-out signals like Global Privacy Control automatically. The law technically applies above certain audience thresholds that MOWP may or may not meet, but building to it is cheap insurance and the right thing to do for donors either way.

Washington. MOWP serves Clark County, so Washington visitors are part of the audience. Washington's My Health My Data Act defines health data broadly, and meal request forms ask about dietary needs and health conditions. That's form data, not cookies, but it's a reason to keep those forms lean, secure and out of any advertising tooling.

Health-adjacent information is also where both states flip from opt-out to opt-in: Oregon treats health details as sensitive data requiring consent before processing, and Washington requires affirmative consent to collect health data at all. So the meal request form carries its own short consent line at the point of submission ("I agree to MOWP using this information to provide services") rather than leaning on the site-wide banner.

Consent isn't the whole law. Oregonians can also ask to see, correct, or delete the personal data an organization holds about them. What that looks like in practice is covered in When someone asks about their data below.

Beyond the letter of the law. This is a nonprofit that older adults and their families trust with sensitive situations. A clear, honest answer to "what do you track?" is part of that trust, the same instinct as publishing financials.

Our recommendation

A lightweight consent banner built into the site, wired to Google Consent Mode:

• Two choices, plainly worded. Accept all, or essential only. No dark patterns (design tricks that nudge people toward accepting), no wall of toggles, no "we value your privacy" theater.
• Tags gated through GTM. Analytics and advertising tags stay silent until the visitor consents. Essential cookies (the ones that make the site work) don't need consent and don't get a toggle.
• Global Privacy Control honored. Visitors with GPC enabled in their browser are opted out of advertising tags without having to do anything else. They aren't even asked.
• Changeable later. A "Cookie preferences" link in the footer reopens the choice.
• Accessible like everything else. Large readable text, keyboard operable, screen-reader friendly, no motion. The banner is often the first thing a visitor interacts with, so it should meet the same bar as the rest of the site (see Accessibility).
• Styled to the brand. It's part of the site, not a third-party widget bolted on top.

Because it's built in, there's no consent-platform subscription, no extra vendor script slowing the first page load, and minimal upkeep for staff. Hosted consent platforms (OneTrust, Osano, CookieYes) exist and work, but for a site this size they add cost and weight for flexibility we don't need. If the team prefers a managed tool we can wire one in instead; the tag-gating approach is the same either way.

How it actually works

For those curious about the mechanics. You don't need any of this to use the site or the CMS.

Cookies. A cookie is a small piece of data a website stores in your browser. First-party cookies are set by the site you're on (mowp.org) and do things like keep you logged in. Third-party cookies are set by someone else's domain riding along on the page (an ad network, for example) and are what enable tracking across sites. Modern tracking doesn't stop at cookies either, which is why consent has to gate the tracking scripts themselves, not just the cookies they set.

Everything starts denied. Here's the sequence on every page load:

When someone declines. Google Analytics falls back to anonymous, cookieless pings and models the gap. The Meta Pixel and Trade Desk tags simply don't load. There's no half-consent where an ad tracker runs in a reduced mode; it's on with permission or off entirely.

What counts as essential. Session state, security tokens and the consent record itself. These make the site function, don't track anyone across sites and don't require consent. This category is small on purpose — "essential" is not a loophole.

What this means for analytics

Consent gating means some visitors won't be counted in analytics. That's the honest cost of asking. Two things soften it:

• Consent Mode keeps the signal usable. As covered above, declined visitors still produce anonymous pings that Google models, so traffic and conversion reporting stay directionally reliable rather than going dark.
• What's measured is real. The numbers that remain reflect people who agreed to be counted — a firmer foundation for reporting to the board and to funders than inflated pre-consent counts.

When someone asks about their data

Anyone can ask what personal information MOWP holds about them, ask for it to be corrected, or ask for it to be deleted. The site's job is to make asking easy; answering is a process on MOWP's side. Here's the practical shape of it:

• How requests come in. The privacy policy page lists a dedicated contact: an email address like [email protected] is enough. No special portal needed at this scale.
• What the site actually holds. Browsing alone doesn't create a personal record; the site only collects personal information when someone submits a form. Those mirror the current site's set: contact messages, meal requests, and volunteer sign-ups (see What's Carrying Over). Beyond form submissions, the site keeps just the visitor's consent choice, which records no identity. Everything else lives in the connected systems (donor records in Blackbaud, email lists in Constant Contact).
• What a response involves. Confirm the person is who they say they are, check each system, and respond within the law's window (45 days under Oregon's law, with an extension available for complicated cases). A deletion request means removing the person from each system it applies to, not just the website.
• Keep a simple log. Date, what was asked, what was done. If a request is ever disputed, the log is the answer.

Open questions

More background reading on all of this lives in Further Reading & Resources.