Serves under-18s, in Oregon

ORS 646A.622 (2007 c.759 sec. 12; amended 2015 c.357 sec. 3; 2018 c.10 sec. 6; 2019 c.180 sec. 4) · Read the law's page

• Develop, implement and maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personal information, including its secure disposal.
• Satisfy this duty either by already being subject to and complying with Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or another state or federal law providing greater protection, or by implementing an information security program with a designated coordinator, a periodic risk assessment, employee training, vetted service-provider contracts, network and software risk assessment and patch management, attack detection and testing, and secure destruction of records when the information is no longer needed.
• A small business may scale its program's administrative, technical and physical safeguards to its own size, complexity and the sensitivity of the personal information it collects.
• This binds a covered entity, any person, including a public body, that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses an Oregon consumer's personal information in the course of business, vocation, occupation or volunteer activity, and a vendor the covered entity contracts with to hold that information on its behalf; a person who acts solely as a vendor is not itself a covered entity.
• The Director of the Department of Consumer and Business Services enforces this duty by investigation, subpoena and a cease-and-desist order, with a civil penalty of up to $1,000 per violation and up to $500,000 for any one occurrence; the sections name no private right of action of their own.

Or. Rev. Stat. section 646A.578 (2025 Or. Laws ch. 251) · Read the law's page

• Applies to controllers subject to the Oregon Consumer Privacy Act that have actual knowledge that, or willfully disregard whether, a consumer is under 16.
• Do not sell such a consumer's personal data, use it for targeted advertising, or profile the consumer in furtherance of decisions with legal or similarly significant effects; there is no consent exception.
• Do not sell personal data that identifies a consumer's location within a 1,750 foot radius.

Or. Senate Bill 1546, 2026 Regular Session · Read the law's page

• Give users a clear and conspicuous notice that they are interacting with artificially generated output, if a reasonable person could otherwise believe they were talking to a natural person.
• Maintain a protocol using evidence-based methods to detect suicidal or self-harm ideation, refer the user to the 988 crisis lifeline or to a youth-specific lifeline for a user you identify as under 25, and publish the details of that protocol.
• Where you know or have reason to believe a user is a minor, prevent the companion from claiming to be sentient or human, simulating emotional dependence or romantic interest, role-playing a romantic relationship with a minor, or producing sexually explicit content or suggestions, and add periodic reminders that the output is artificially generated.
• Post an annual public report disclosing how many times you referred a user to crisis resources and the details of your detection protocol, without including information that identifies an individual.