Law / Oregon

Oregon

age

Oregon has no adult content age verification law. A bill that would have required age verification for websites where a substantial share of content is sexual material harmful to minors (HB 2032) died when the 2025 session adjourned on June 27, 2025, and an app store age verification bill (HB 3696) died in House committee at the same adjournment; the short 2026 session, which adjourned March 6, 2026, enacted nothing in the four tracked families.

Oregon has no social media specific minor access law. Its age gating protection instead runs through its comprehensive privacy law: a 2025 amendment to the Oregon Consumer Privacy Act (HB 2008) bars selling the personal data of, serving targeted advertising to, or profiling a consumer the controller knows or willfully disregards is under 16, in effect since January 1, 2026.

privacy

The Oregon Consumer Privacy Act (OCPA), ORS 646A.570 to 646A.589, is Oregon's comprehensive consumer-privacy regime, enacted as S.B. 619 (2023), effective July 1, 2024 for most controllers, with nonprofits exempt until January 1, 2026. Every citation in this document is re-sourced to the official Oregon State Legislature site (oregonlegislature.gov); the earlier draft cited oregon.public.law throughout, a private republisher, which fails source-quality rule 1.

'Oregon Consumer Privacy Act' is the popular name for S.B. 619; the codified sections carry no short-title or caption naming the Act, so privacy_regime is recorded here as free text and left unpinned rather than pinned to text that does not exist. Two 2025 amendments (H.B. 2008, H.B. 3875), effective January 1, 2026, added a precise-geolocation sale ban, a strict under-16 processing prohibition, and removed motor-vehicle manufacturers from the small-controller exemption.

Genetic or biometric data is one of OCPA's enumerated sensitive-data categories, unqualified by an identification-purpose clause, confirming the carried seed's sensitive_biometric_restriction value of True on that separate question.

Oregon's biometric-data definition also carries the most explicit clawback in this batch: it separately and by name brings facial mapping or facial geometry back into 'biometric data' whenever generated or used to identify a specific consumer, in addition to the general photo, audio, or video-derived-data clawback. A separate chapter, ORS 646A.604, governs breach notification, requiring notice to the Attorney General only once the number of affected consumers exceeds 250.

The Attorney General has exclusive enforcement authority, with a discretionary cure option from the outset of the Act; there is no private right of action.

13 instruments named 6 researched in detail As of 2026-08-27

Instruments

Each one links to its LexLint note, which carries what it requires and what it flags on.

Age-appropriate design code

HB 2008, Oregon Consumer Privacy Act minors and geolocation amendments

cite Or. Rev. Stat. section 646A.578 (2025 Or. Laws ch. 251) stage RECENT in force 8 months effective 2026-01-01 source official Oregon Legislative Information System enrolled bill and session law chapter

Bars a controller that has actual knowledge that, or willfully disregards whether, a consumer is under 16 from selling that consumer's personal data, using it for targeted advertising, or profiling in furtherance of decisions with legal or similarly significant effects, with no consent exception, and separately bars selling personal data that identifies a consumer's location within a 1,750 foot radius. Signed by Governor Kotek on June 3, 2025.

Note and primary source →

Breach notification

Notice of breach of security

cite ORS 646A.604 stage IMMINENT commencement not set source official Oregon statute text, ORS 646A.604, Oregon Consumer Identity Theft Protection Act

A covered entity subject to a breach of security, or that receives notice of one from a vendor, must give notice of the breach to each affected Oregon consumer, and must also notify the Attorney General once the number of Oregon consumers notified exceeds 250. This provision is in force under the current codified text; the underlying research did not establish a dated original commencement, so no effective_date is recorded here.

What it asks of an app →

Comprehensive regime

Oregon Consumer Privacy Act (OCPA), general applicability and controller duties

cite ORS 646A.570, 646A.578 stage IN FORCE in force since 2024-07-01 source official Oregon statute text, ORS 646A.570 to 646A.589, Oregon Revised Statutes

OCPA governs private-sector processing of Oregon consumers' personal data. Enacted as S.B. 619 (2023 Regular Session), Or. Laws 2023, ch. 369, effective July 1, 2024 for most controllers; nonprofits were exempt from OCPA duties until January 1, 2026.

Two 2025 amendments, both effective January 1, 2026, are already reflected in the current codified text: H.B. 2008 added a precise-geolocation sale ban and a strict under-16 processing prohibition for targeted advertising, sale, and profiling; H.B. 3875 removed motor-vehicle manufacturers from the small-controller exemption.

What it asks of an app →

Data subject rights

Oregon Consumer Privacy Act, consumer rights

cite ORS 646A.574, 646A.576, 646A.578 stage IN FORCE in force since 2024-07-01 source official Oregon statute text, ORS 646A.570 to 646A.589, Oregon Revised Statutes

OCPA gives an Oregon consumer the right to confirm processing, obtain a categories disclosure, receive a portable copy, correct, delete, and opt out of targeted advertising, sale, and profiling for decisions with legal or similarly significant effects.

A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available; an appeal of a refusal must be decided within 45 days; and consent revocation must be honored no later than 15 days after receipt.

What it asks of an app →

Enforcement supervision

Oregon Consumer Privacy Act, Attorney General enforcement

cite ORS 646A.589 stage IN FORCE in force since 2024-07-01 source official Oregon statute text, ORS 646A.570 to 646A.589, Oregon Revised Statutes

The Oregon Attorney General has exclusive authority to enforce OCPA; no other Oregon law creates a private right of action for a violation. Civil penalties run up to $7,500 per violation, and the statute of limitations is five years from the last violative act.

The cure opportunity was discretionary from the outset: the Attorney General may notify a controller of a violation only if the Attorney General determines the violation can be cured, and, per secondary reporting, that discretionary practice tightened further as of January 1, 2026.

What it asks of an app →

Sensitive categories

Oregon Consumer Privacy Act, sensitive data and biometric data definitions

cite ORS 646A.570(3), (18) stage IN FORCE in force since 2024-07-01 source official Oregon statute text, ORS 646A.570 to 646A.589, Oregon Revised Statutes

OCPA lists genetic or biometric data independently as sensitive data, not qualified by a for-the-purpose-of-uniquely-identifying clause the way several peer states phrase it, alongside data revealing racial or ethnic background, national origin, religious beliefs, mental or physical condition, sexual orientation, transgender or nonbinary status, victim-of-crime status, citizenship or immigration status, a child's data, and precise geolocation data.

'Biometric data' means data from automatic measurement of biological characteristics used to identify a consumer, and Oregon's clawback is the most explicit of any state in this batch: it separately and by name brings facial mapping or facial geometry back into biometric data whenever generated or used to identify a specific consumer, in addition to the general photo, audio, or video-derived-data clawback.

What it asks of an app →

This summary covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted above and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.