Law / United States / 
Oregon
HB 2008, Oregon Consumer Privacy Act minors and geolocation amendments
Or. Rev. Stat. section 646A.578 (2025 Or. Laws ch. 251)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force 9 months, effective 1 January 2026.
An age-appropriate design code rule binding private bodies.
As of 15 July 2026.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Bars a controller that has actual knowledge that, or willfully disregards whether, a consumer is under 16 from selling that consumer's personal data, using it for targeted advertising, or profiling in furtherance of decisions with legal or similarly significant effects, with no consent exception, and separately bars selling personal data that identifies a consumer's location within a 1,750 foot radius. Signed by Governor Kotek on June 3, 2025.
If you get it wrong
Private right of actionNo
Penalties
Enforced exclusively by the Attorney General under ORS 646A.589, with civil penalties of up to $7,500 per violation; the statute expressly creates no private right of action, and its 30 day cure period sunset on January 1, 2026
Who enforces it
Enforcement body
Oregon Department of Justice
What it reaches
Age threshold
16
Covered services
Controllers subject to the Oregon Consumer Privacy Act processing data of a consumer known, or willfully disregarded, to be under 16
When LexLint raises it
serves_minors
Read the law
official Oregon Legislative Information System enrolled bill and session law chapter
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.