Privacy & Consent
Cookie consent, tracking, and privacy law. What the site needs and how we'll handle it
The legacy site loads several tracking tags — analytics, advertising pixels, measurement scripts — and none of them ask visitors before they start collecting. The rebuild is the moment to fix that rather than retrofit later.
This page covers what the legacy site tracks today, what the law expects, how we recommend handling consent, and how the mechanics work.
What the site collects today
These tags carry over from the legacy site (see What's Carrying Over):
| Tag | What it does | Sets cookies / tracks |
|---|---|---|
| Google Analytics (via Google Tag Manager) | Site traffic and behavior | Yes |
| Meta Pixel | Ad measurement and retargeting on Facebook/Instagram | Yes |
| The Trade Desk | Advertising measurement. Still firing on every legacy page | Yes |
| Google Tag Manager | Container that loads the tags above | Indirectly |
Analytics tells us how the site is doing. The Meta Pixel and Trade Desk tags are advertising trackers that follow visitors across sites, which is the category privacy law cares most about.
The Donate page adds more, and none of it is ours to configure. Blackbaud's donation form brings its own suppliers: Stripe for the card details, plus Google reCAPTCHA, Double the Donation and Blackbaud's own analytics. They load with the form rather than through the tag manager, so the consent banner doesn't gate them. Third-Party Services has the detail.
What the law expects
We're builders, not lawyers. This section reflects our working understanding and is the basis for what we build. The privacy policy and final compliance posture deserve a review by MOWP's counsel.
Oregon. The Oregon Consumer Privacy Act took effect July 2024 and has applied to nonprofits since July 2025 — Oregon is one of the few states that didn't exempt them. It gives Oregonians the right to opt out of targeted advertising, and since January 2026 sites are expected to honor browser-level opt-out signals like Global Privacy Control automatically. It applies above audience thresholds MOWP may not meet, but building to it is cheap insurance.
Washington. MOWP serves Clark County, so Washington visitors are part of the audience. Washington's My Health My Data Act defines health data broadly, and meal request forms ask about dietary needs and health conditions. That's form data rather than cookies, and a reason to keep those forms lean, secure and out of any advertising tooling.
Health-adjacent information is where both states flip from opt-out to opt-in: Oregon treats health details as sensitive data requiring consent before processing, Washington requires affirmative consent to collect it at all. So the meal request form carries its own consent line at the point of submission ("I agree that Meals on Wheels People can use this information to arrange my meal service") rather than leaning on the site-wide banner.
Consent isn't the whole law. Oregonians can also ask to see, correct, or delete the personal data an organization holds about them. See When someone asks about their data below.
Beyond the letter of the law: this is a nonprofit that older adults and their families trust with sensitive situations. A clear, honest answer to "what do you track?" is part of that trust.
Our recommendation
A lightweight consent banner built into the site, wired to Google Consent Mode:
- Two choices, plainly worded. Accept all, or essential only. No dark patterns, no wall of toggles, no "we value your privacy" theater.
- Tags gated through GTM. Analytics and advertising tags stay silent until the visitor consents. Essential cookies don't need consent and don't get a toggle.
- Global Privacy Control honored. Visitors with GPC enabled are opted out of advertising tags without being asked.
- Changeable later. A "Cookie preferences" link in the footer reopens the choice.
- Accessible like everything else. Large readable text, keyboard operable, screen-reader friendly, no motion. See Accessibility.
- Styled to the brand. It's part of the site, not a third-party widget bolted on top.
Built in means no consent-platform subscription, no extra vendor script slowing the first page load, and minimal upkeep for staff.
Hosted platforms (OneTrust, Osano, CookieYes) work fine but add cost and weight at this size. If the team prefers one, we can wire it in; the tag-gating approach is the same either way.
How it works
For the curious. None of this is needed to use the site or the CMS.
Cookies. A cookie is a small piece of data a website stores in your browser. First-party cookies come from the site you're on and do things like keep you logged in; third-party cookies come from someone else's domain riding along on the page, and are what enable tracking across sites. Modern tracking doesn't stop at cookies, which is why consent gates the scripts themselves.
Everything starts denied. Consent Mode's four signals — analytics storage, ad storage, ad user data and ad personalization — are all set to denied before anything loads. If the visitor has Global Privacy Control enabled, advertising consent stays denied and they're never prompted for it. Otherwise the banner asks, their choice updates the signals, and GTM releases each tag or keeps holding it by category. The choice is stored in a first-party cookie that records nothing else, and the footer link reopens it anytime.
When someone declines. Google Analytics falls back to anonymous, cookieless pings and models the gap. The Meta Pixel and Trade Desk tags don't load at all. There's no half-consent where an ad tracker runs in a reduced mode.
What counts as essential. Session state, security tokens and the consent record itself. The category is kept small; "essential" is not a loophole.
What this means for analytics
Some visitors won't be counted. That's the cost of asking, and two things soften it: declined visitors still produce anonymous pings that Google models, so reporting stays directionally reliable rather than going dark, and the numbers that remain reflect people who agreed to be counted — a defensible basis for reporting to the board and to funders.
When someone asks about their data
Anyone can ask what personal information MOWP holds about them, ask for it to be corrected, or ask for it to be deleted. The site's job is to make asking easy; answering is a process on MOWP's side.
- How requests come in. The privacy policy page lists a dedicated contact. An email address like [email protected] is enough at this scale.
- What the site holds. Browsing alone creates no personal record. The site collects personal information only when someone submits one of its own forms: contact messages, meal requests, and Meals 4 Kids referrals (see What's Carrying Over). Beyond those it keeps the visitor's consent choice, which records no identity. Everything else lives in the connected systems, and a request may have to reach several: donor records in Blackbaud, email lists in Constant Contact, volunteer records in VolunteerHub, job applications in Paycom. Third-Party Services is the list.
- What a response involves. Confirm the person is who they say they are, check each system, and respond within 45 days under Oregon's law, with an extension available for complicated cases. A deletion request means removing the person from each system it applies to, not just the website.
- Keep a simple log. Date, what was asked, what was done.
At MOWP's scale these requests will be rare, a few a year at most. The goal is a documented process someone can follow when one arrives, not a system nobody remembers exists.
Open questions
Who's reviewing the privacy policy and donor privacy policy copy? Both pages exist on the site and need current, reviewed content.
Who owns privacy policy updates going forward? It should have an owner the same way financial documents do.
More background reading on all of this lives in Further Reading & Resources.