Deploys a chatbot, in Oregon

ORS 646A.622 (2007 c.759 sec. 12; amended 2015 c.357 sec. 3; 2018 c.10 sec. 6; 2019 c.180 sec. 4) · Read the law's page

• Develop, implement and maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personal information, including its secure disposal.
• Satisfy this duty either by already being subject to and complying with Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or another state or federal law providing greater protection, or by implementing an information security program with a designated coordinator, a periodic risk assessment, employee training, vetted service-provider contracts, network and software risk assessment and patch management, attack detection and testing, and secure destruction of records when the information is no longer needed.
• A small business may scale its program's administrative, technical and physical safeguards to its own size, complexity and the sensitivity of the personal information it collects.
• This binds a covered entity, any person, including a public body, that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses an Oregon consumer's personal information in the course of business, vocation, occupation or volunteer activity, and a vendor the covered entity contracts with to hold that information on its behalf; a person who acts solely as a vendor is not itself a covered entity.
• The Director of the Department of Consumer and Business Services enforces this duty by investigation, subpoena and a cease-and-desist order, with a civil penalty of up to $1,000 per violation and up to $500,000 for any one occurrence; the sections name no private right of action of their own.

ORS 678.027 · Read the law's page

• Do not have a nonhuman entity, including an AI-powered agent, use the title or abbreviation of Advanced Practice Registered Nurse, certified registered nurse anesthetist, clinical nurse specialist, licensed practical nurse, registered nurse, nurse practitioner, certified medication aide or certified nursing assistant.

ORS 165.535, 165.540, 165.543, 165.545 · Read the law's page

• Do not obtain, or attempt to obtain, the whole or any part of a telecommunication or radio communication to which you are not a participant, unless at least one participant has consented.
• Do not obtain any part of an in-person conversation or a conversation occurring through a video conferencing program by means of a recording device unless every participant is specifically informed that the conversation is being obtained, whether or not you are yourself a participant.
• The specific-notice duty does not apply to a public or semipublic meeting, hearing, trial, press conference, rally or similar event recorded with an unconcealed device or held over a video conferencing program, to a regularly scheduled class, or to a private meeting or conference where all others involved knew or reasonably should have known the recording was being made.
• Do not obtain a conversation, telecommunication or radio communication from another person while knowing or having good reason to believe it was first obtained in a way the section prohibits, and do not use or divulge one obtained by prohibited means, unless you took no part in first obtaining it and it concerns a matter of public concern.

Or. Senate Bill 1546, 2026 Regular Session · Read the law's page

• Give users a clear and conspicuous notice that they are interacting with artificially generated output, if a reasonable person could otherwise believe they were talking to a natural person.
• Maintain a protocol using evidence-based methods to detect suicidal or self-harm ideation, refer the user to the 988 crisis lifeline or to a youth-specific lifeline for a user you identify as under 25, and publish the details of that protocol.
• Where you know or have reason to believe a user is a minor, prevent the companion from claiming to be sentient or human, simulating emotional dependence or romantic interest, role-playing a romantic relationship with a minor, or producing sexually explicit content or suggestions, and add periodic reminders that the output is artificially generated.
• Post an annual public report disclosing how many times you referred a user to crisis resources and the details of your detection protocol, without including information that identifies an individual.