Law / United States / 
Oregon
HB 2008, Oregon Consumer Privacy Act minors and geolocation amendments
Or. Rev. Stat. section 646A.578 (2025 Or. Laws ch. 251)
In force since .
An age-appropriate design code rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to controllers subject to the Oregon Consumer Privacy Act that have actual knowledge that, or willfully disregard whether, a consumer is under 16.
- Do not sell such a consumer's personal data, use it for targeted advertising, or profile the consumer in furtherance of decisions with legal or similarly significant effects; there is no consent exception.
- Do not sell personal data that identifies a consumer's location within a 1,750 foot radius.
These lines are LexLint's reading of the law's text. Also read by: Oregon Department of Justice (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Enforced exclusively by the Attorney General under ORS 646A.589, with civil penalties of up to $7,500 per violation; the statute expressly creates no private right of action, and its 30 day cure period sunset on
Who enforces it
Enforcement body
Oregon Department of Justice
Settledness
- As of
- Guidance link
- https://www.doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-for-businesses/
- Guidance body
- Oregon Department of Justice
- Open questions
- Does the bar on selling the personal data of a consumer under 16 reach a controller that merely should have known the consumer's age, as the Oregon Department of Justice's enforcement report says, when HB 2008 limits it to a controller with actual knowledge that, or that willfully disregards whether, the consumer is under 16?
What it reaches
Age threshold
16
Covered services
Controllers subject to the Oregon Consumer Privacy Act processing data of a consumer known, or willfully disregarded, to be under 16
What it makes you log
Logging duty
Section 1 of HB 2008 amends ORS 646A.578 only. The amended text bars selling a known or willfully disregarded under-16 consumer's data and selling location data within a 1,750 foot radius; it states no log, record, retention period, audit or regulator access to a record, and its subsection (1)(c) safeguards duty is a security duty rather than a record duty. Other sections of the Oregon Consumer Privacy Act are not part of this instrument. The amended section names no territorial hook in these paragraphs.
- Kind
- None
- As of
What this law does
Bars a controller that has actual knowledge that, or willfully disregards whether, a consumer is under 16 from selling that consumer's personal data, using it for targeted advertising, or profiling in furtherance of decisions with legal or similarly significant effects, with no consent exception, and separately bars selling personal data that identifies a consumer's location within a 1,750 foot radius. Signed by Governor Kotek on .
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .