Effective December 1, 2025

The Orange County Transportation Authority (“Authority” or “OCTA”) is committed to protecting your privacy and the confidentiality of any personal data you may provide while interacting with the Authority online or through its services. This Privacy Notice (“Notice”) outlines how we collect, use, disclose, and safeguard your personal data in connection with OCTA websites, programs, and digital services.

In this Privacy Notice, “Privacy Notice” means a public statement describing how OCTA collects, uses, shares, and protects personal data, as distinct from an internal privacy policy governing OCTA’s internal procedures. “Personal data” includes what is also known as personally identifiable information (PII). The OCTA limits the collection of personal data to what is necessary to carry out its operational responsibilities and to administer optional programs in which you choose to participate. Personal data maintained by OCTA is protected in accordance with applicable California state and U.S. federal laws governing data privacy and security.

By continuing to use our website and services, you acknowledge and accept the terms of this Privacy Notice; our Conditions of Use and Accessibility; our Marketing, Cookies, and Tracking; and the practices described herein. We encourage you to review this Notice periodically. If material changes are made, we will provide notice by posting an update on the OCTA website homepage and, when feasible, through other means such as email or mail.

This Privacy Notice applies specifically to the use of OCTA’s main website, www.octa.net. Other OCTA programs or digital services, such as fare systems or tolling platforms, may have separate privacy notices tailored to those services. Please visit the OCTA homepage to access links to additional privacy policies that may apply to specific programs or services.

As used in this Notice, "the Authority", “we”, and “our” refer to OCTA.

Personal Data We Collect

The OCTA values both your use of this site and the feedback you provide. If you participate in a survey or send us an e-mail, your e-mail address and the other information you volunteer may be collected. In addition, visitors who request services through this site may be required to furnish additional information to identify you as the account holder or to enable us to provide the desired assistance. The additional information collected will be no more specific than if you were requesting the service by any other means, including by telephone or an in-person visit to an OCTA facility. We may share this information with other public agencies or organizations if such action is required to provide the assistance you are requesting.

Instances where OCTA may collect information from you include, but are not limited to:

• Bus Passes: Information that you provide to purchase a bus pass from OCTA at passales.octa.net. This may include information such as your name, address, telephone number, email address, and credit card number.
• Forms and Surveys: Information that you provide to OCTA voluntarily such as filling out forms on our website, submitting Public Records Act requests, filling out surveys or other correspondence to OCTA, and participating in promotional programs such as sweepstakes. This may include information such as your name, address, telephone number, and email address.
• Projects and Services: Information that you provide to stay informed of OCTA projects and services such as your name, address, telephone number, and email address.
• Emails: Information that you provide when submitting an email to OCTA or an OCTA staff member, which may include your name, email address, telephone number, and address, in addition to other personal data that you provide.
• Social Media: Publicly available personal data on OCTA social media pages or on pages where OCTA is noted. Examples of such sites include Instagram, X, and Facebook.
• Wave: Information you provide when registering for or using the Wave system (OCTA’s automated transit fare collection system), such as your name, address, email, phone number, payment information (processed by third-party vendors), and usage data such as trip history and device information. In the case of fare discounts, OCTA may also ask for additional identification such as a driver’s license to validate your eligibility for participation in any such program.
• Text4Next (SMS Messaging Service): When you text a bus stop number to OCTA’s Text4Next service at short code 628246, OCTA replies with real-time bus arrival times and relevant service alerts (such as stop closures). OCTA does not send unsolicited messages, and no phone numbers are stored beyond the transient technical processing necessary to deliver a response. The service does not involve subscription or marketing messaging. Standard “STOP” and “HELP” keywords are supported to comply with industry requirements, although OCTA only sends messages directly in response to your request. The third-party provider supporting this service does not sell, share, or retain phone numbers. Message and data rates may apply according to your mobile carrier.

Notice, Choice, and Consent

Prior to the collection of any personal data from you, we will provide clear notice at the point of collection, specify what personal data is being gathered, the purpose for its collection, and how it will be used. By using this website and related services, you acknowledge and agree to the terms of this Privacy Notice. You may withdraw your consent from the collection or use of your personal information at any time, subject to applicable laws and OCTA’s established procedures. This ensures transparency and allows you to make informed decisions about sharing your data. Our commitment to notice and consent reflects our dedication to transparency and ensures you have the opportunity to make informed decisions regarding the processing of your personal data.

Collection of Personal Data

The Authority does not collect personally identifiable information from visitors who simply browse the site or download information, except for IP addresses. IP addresses are logged to assist in website management but are not shared with third parties unless required by law. These logs primarily contain non-personally identifiable data, such as domain names, browser types, operating systems, visit dates and times, and accessed pages. Authority staff may analyze this information to enhance the website and its functionality.

Children’s Privacy

The OCTA does not solicit or knowingly collect personal data from children under 13 who browse this site or download information from it. Anyone who uses the website for the purposes set forth herein and voluntarily provides personal data is subject to the terms of this Privacy Notice. If you are a parent or guardian and have questions about information that may be collected in association with your child, please contact the Authority using the contact information provided at the end of this Notice.

On a voluntary basis, we may use this website to collect information from minors which is related to youth education programs and other activities. Any information collected by the OCTA website from children under 13, is on a voluntary basis, adheres to the controls within the Authority's general Privacy Notice as well as the following guidelines:

• The Authority will obtain verifiable parental consent before collecting, using, or disclosing personal data about any child under the age of 13 if the age of the child is known to the Authority.
• If the OCTA substantially changes its practices regarding the collection, use, or disclosure of information collected from children, parents will be informed of the changes and new parental consent will be obtained. Examples of substantive changes include what material is collected, how the information may be used, and third-party access to that information. Upon verification of a parent's identity by the Authority, the parent will be able to review the personal data collected from their child upon request.
• Parents may revoke their consent, and the OCTA will delete information collected from or for their children upon request. When consent is revoked, the website will stop collecting, using, or disclosing information from or for that child. Revocation may end a child's participation in an activity if the information collected was necessary for participation in a particular activity on the website.

Electronic Commerce

Users choosing to engage in electronic commerce with the Authority via this website are provided with reasonable security measures. OCTA e-commerce transactions are performed only under tightly controlled circumstances where there are appropriate safeguards in place to reasonably protect more sensitive forms of personal data. While e-commerce transaction systems supported on the OCTA's website are intended to ensure that financial data remains secure at all times, the Authority does not represent that the system is fail-proof.

All credit card transactions are processed by third-party providers on behalf of OCTA and are required to comply with the Payment Card Industry Data Security Standard (PCI-DSS).

Site Security

To protect our website and its users, we actively monitor network traffic to detect and prevent unauthorized attempts to alter information, upload malicious content, or cause harm. By using the Authority’s website, you expressly consent to this monitoring.

In line with applicable laws and leading practices, the OCTA employs industry and national standards specific to the physical, technical, and administrative safeguards necessary to protect personal data from loss, misuse, alteration, theft, unauthorized access, and disclosure. However, as with any online platform, absolute security cannot be guaranteed.

You as the user of OCTA services are responsible for the safeguarding of your own credentials, identification numbers, or other sensitive information related to access to or your use of OCTA’s services.

Do Not Sell

With the importance of protecting user personal data in mind, we do not rent, sell or give away any information identifying you individually to third parties for marketing or mailing list purposes without your permission. When permission is granted and data is provided, the third parties are contractually bound to only use the information provided for purpose(s) specified in the consent.

Public Records

As a special district agency, OCTA is governed by the California Public Records Act (California Government Code section 7920.000 et seq.). As such, most business you conduct with the OCTA becomes a public record and is open for public inspection. Public records may be posted on the website for electronic access. Records posted on the website are also available for public inspection by requests made online, in person, by mail or by telephone to the OCTA Clerk of the Board. This page and every page on OCTA.net are for general public information only. Should you require a response from the agency or wish to request agency services, you must go to OCTA.net or call the agency at (714) 560-6282. Please also be aware that, under certain circumstances, content appearing on this page may be subject to the California Public Records Act and subject to disclosure by OCTA if requested. This may include information about you that you may make available through your privacy settings on your own pages.

Sending E-Mail

If you send the Authority an e-mail that includes personal data, we may use the information to respond to your message. Or if required, we may forward your e-mail to another agency if we believe that agency is better prepared to answer your question. If you e-mail the Authority, we will keep a record of that correspondence in accordance with our records retention policy. We do not use information received in e-mails to create personal profiles, and we do not give or sell e-mail information to others for commercial purposes.

Any e-mails that you send are governed by the California Public Records Act (California Government Code section 7920.000 et seq.) and may become open for public inspection. If you send us a threat or a message that describes or promotes unlawful activity, we will forward the e-mail to the appropriate law enforcement authorities.

Links to Other Sites

The OCTA may provide links to web pages that are not part of the OCTA website. The privacy policies and procedures described here do not necessarily apply to those sites. In these cases you should review the published privacy notices or policies prior to providing any personal data on these sites.

Social Media

The purpose of official OCTA social media pages is to serve as a mechanism for communication between OCTA and members of the public. OCTA routinely monitors these sites and reserves the right to monitor, filter, and remove any content (text, links, video, etc.) that is deemed inappropriate, including but not limited to:

1. Content not related to the purpose of the particular social media site or article commented on. If user content is positive or negative and related to the topic, then it will be allowed to remain regardless of whether it is favorable or unfavorable to OCTA;
2. Content that contains private information about another person or that violates a person’s privacy;
3. Content that includes profanity, vulgarity, obscenity, racism, hatred, slander, threats and/or violence;
4. Content that defames, abuses, harasses, stalks, threatens or violates the legal rights of others;
5. Content that promotes, fosters, or perpetuates discrimination or personal attacks based on race, creed, color, age, religion, gender, marital status, status with regard to public assistance, national origin, physical or mental disability or sexual orientation;
6. Sexual content or links to sexual content;
7. Commercial solicitations;
8. Text or links encouraging any kind of illegal activity or spam;
9. Information that may tend to compromise the safety or security of the public or public system;
10. Comments about OCTA employees, which will be forwarded to customer relations staff for processing according to established protocols for verification; or
11. Content that violates ownership rights from any other party.

OCTA will apply these reasonable restrictions in a manner that is viewpoint neutral.

Contact Us

We take reasonable steps to ensure that all personal data we collect is maintained as submitted to you by us, so that our records reflect your information for its intended purposes, which may include customer correspondence, compliance and legal considerations, auditing, security and fraud prevention, and preserving or defending our rights.

If you have questions about the Privacy Notice or wish to update, correct, and/or request to remove your personal data, please contact the Authority at:

• Email: customers@octa.net
• Mail: Orange County Transportation Authority, P.O. Box 14184, Orange, CA 92863-1584