Oregon

Oregon's crime of unlawfully disseminating an intimate image, previously limited to a photograph, film or other visual reproduction, now also reaches a digitally created, manipulated or altered depiction that is reasonably realistic, so a deepfake or AI-generated nude or sexual image of a real, identifiable person falls within the same crime as an authentic one.

The person must have caused the disclosure with intent to harass, humiliate or injure someone who did not consent, and a reasonable person must be harassed, humiliated or injured by it. A first offense is a Class A misdemeanor; a second or later offense is a Class C felony.

Law enforcement activity, legitimate medical, scientific or educational activity, legal proceedings, reporting to law enforcement, and images the depicted person voluntarily displayed publicly or that were created commercially with consent are excluded.

A nonhuman entity, including but not limited to an agent powered by artificial intelligence, may not use the title or abbreviation of Advanced Practice Registered Nurse, certified registered nurse anesthetist, clinical nurse specialist, licensed practical nurse, registered nurse, nurse practitioner, certified medication aide or certified nursing assistant.

The chapter carrying this section exempts only the employment of nurses in institutions or agencies of the federal government; a state or local government entity is otherwise bound the same as a private one, so an AI system interacting with patients in a state, local or private health care setting may not present itself under any of these titles.

An operator of an artificial intelligence companion or companion platform, software designed to simulate a sustained human-like platonic, intimate or romantic relationship by retaining information across sessions, asking unprompted emotional questions and sustaining personal dialogue, must give users a clear and conspicuous notice that they are interacting with artificially generated output whenever a reasonable person could otherwise believe they were talking to a natural person.

An operator must maintain an evidence-based protocol for detecting suicidal or self-harm ideation that refers a user to the 988 crisis lifeline, or to a youth-specific lifeline where the operator identifies the user as under 25, and must publish its protocol and an annual incident report.

Where an operator knows or has reason to believe a user is a minor, it must prevent the companion from claiming to be sentient or human, simulating emotional dependence or romantic interest, role-playing a romantic relationship with a minor, or producing sexually explicit content, and must add periodic reminders that the output is artificially generated.

An individual who suffers an ascertainable loss because of a violation may sue for the greater of actual or statutory damages of $1,000 per violation, plus an injunction and, if they prevail, attorney fees. Customer-service, productivity, video-game and voice-assistant software are excluded, as are stand-alone voice-command devices. Passed by the Legislative Assembly in the 2026 regular session and assigned chapter 85. The chaptered law gives its effective date as January 1, 2027.

A campaign communication that includes synthetic media, an image, audio or video recording of a candidate's appearance, speech or conduct intentionally manipulated with artificial intelligence or similar digital technology to create a realistic but false depiction, must include a disclosure that the recording has been manipulated.

The Secretary of State, and in specified cases the Attorney General, may sue to enjoin a violation, and a court may impose a civil penalty of up to $10,000, which the statute makes the exclusive remedy. Interactive computer services, bona fide news coverage, paid broadcasters, periodicals that carry a corrective statement, and satire or parody are excluded.

A covered entity subject to a breach of security, or that receives notice of one from a vendor, must give notice of the breach to each affected Oregon consumer, and must also notify the Attorney General once the number of Oregon consumers notified exceeds 250. The sections this entry groups came into force on different days.

OCPA governs private-sector processing of Oregon consumers' personal data. Enacted as S.B. 619 (2023 Regular Session), Or. Laws 2023, ch. 369, effective July 1, 2024 for most controllers. Organizations described in section 501(c)(3) of the Internal Revenue Code were exempt from it until July 1, 2025. Two 2025 amendments are already reflected in the current codified text. House Bill 2008 added a ban on selling precise geolocation data.

House Bill 2008 barred a controller from processing a consumer's personal data for targeted advertising or for profiling toward decisions with legal or similar effects, and from selling a consumer's personal data, if the controller knows or willfully disregards that the consumer is under 16 years of age. House Bill 2008 took effect on January 1, 2026.

House Bill 3875 made the Act apply to a motor vehicle manufacturer and its affiliates that control or process personal data obtained from a consumer's use of a motor vehicle or a component of one, whatever the consumer-count thresholds. House Bill 3875 took effect on September 26, 2025.

A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, which includes targeted advertising, processing sensitive data, selling personal data and some profiling. The Attorney General may require a controller to provide any data protection assessment that is relevant to an investigation the Attorney General conducts under ORS 646A.589.

A controller must retain all of its data protection assessments for at least five years. A data protection assessment is confidential and is not subject to disclosure under Oregon's public records law. The assessment requirements apply only to processing activities that occur on and after July 1, 2024, and are not retroactive.

A data broker is a business entity or part of a business entity that collects and sells or licenses brokered personal data to another person. Brokered personal data is computerized data about a resident individual that is categorized or organized for sale or licensing, including the individual's name, address, date or place of birth, biometric information and Social Security number.

A data broker may not collect, sell or license brokered personal data within Oregon unless it first registers with the Department of Consumer and Business Services. A data broker need not register if its collection, sale or licensing involves only a listed category, including publicly available information related to a resident individual's business or profession and information lawfully available from government records.

The definition of data broker excludes a business entity that collects information about a resident individual who is or was its customer, subscriber or user, its employee or agent or in a contractual relationship with it, its investor or donor, or in another relationship with it of a similar nature. The definition also excludes a business entity that performs services for, acts on behalf of or acts as an agent of a business entity that holds such a relationship with the individual.

The definition also excludes a consumer reporting agency, a person that furnishes information to one and a user of a consumer report, each to the extent the federal Fair Credit Reporting Act regulates its activities, and a financial institution, an affiliate or a nonaffiliated third party, each to the extent Title V of the Gramm-Leach-Bliley Act regulates its activities.

To register, a data broker submits its name, street address, telephone number, primary website and email address, pays a fee the department sets by rule, and declares whether and how a resident individual may opt out of its collection, sale or licensing. A registration is valid until December 31 of the year in which the department approves it. The department makes the information that business entities submit for registration publicly available on or by means of its website.

The department may impose a civil penalty of up to $500 for each violation, or $500 for each day of a continuing violation, and the total imposed on a data broker may not exceed $10,000 in a calendar year. Section 1 of House Bill 2052 of 2023 became operative on January 1, 2024.

OCPA gives an Oregon consumer the right to confirm processing, obtain a categories disclosure, receive a portable copy, correct, delete, and opt out of targeted advertising, sale, and profiling for decisions with legal or similarly significant effects.

A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available; an appeal of a refusal must be decided within 45 days; and consent revocation must be honored no later than 15 days after receipt.

The purpose of ORS 746.600 to 746.690 is to establish standards for the collection, use and disclosure of personal information gathered in connection with insurance transactions by insurers, insurance producers or insurance-support organizations.

The obligations of ORS 746.600 to 746.690 apply to insurers, insurance producers and insurance-support organizations that, for life or health insurance, collect, receive or maintain personal information about Oregon residents or engage in insurance transactions with Oregon residents, and, for other kinds of insurance, collect, receive or maintain personal information in connection with, or engage in, insurance transactions involving policies or certificates delivered, issued for delivery or renewed in Oregon, except as ORS 746.606 to 746.609 provide.

An insurance transaction is a transaction that involves insurance primarily for personal, family or household needs rather than business or professional needs and that entails the determination of an individual's eligibility for coverage, benefit or payment or the servicing of an insurance application, policy or certificate.

A licensee must provide a clear and conspicuous notice of personal information practices to a consumer who becomes a customer, not later than the date the licensee establishes a continuing relationship under which it provides insurance products or services used primarily for personal, family or household purposes. A licensee must give a customer a clear and conspicuous notice that accurately reflects its privacy policies and practices not less than annually during the relationship.

The privacy notice must be in writing and clear and conspicuous, and it must include the categories of personal information the licensee collects. An insurer, insurance producer or insurance-support organization may not use or authorize the use of pretext interviews to obtain personal information in connection with an insurance transaction.

A licensee or insurance-support organization may not use a disclosure authorization form unless it is clear and conspicuous and states the identity of the individual, the categories of information, the parties to whom it is disclosed and why, the individual's signature and date, how long it is valid, that the individual may revoke it and how.

An insurer, insurance producer or insurance-support organization must, within 30 business days of a written request for access to reasonably locatable recorded personal information, inform the individual of its nature and substance, let the individual see and copy it, disclose to whom it has been disclosed, and summarize the correction procedures.

Within 30 business days of a written request to correct, amend or delete recorded personal information, an insurer, insurance producer or insurance-support organization must either do so or notify the individual of its refusal, the reasons and the right to file a statement.

After an adverse underwriting decision, the insurer or insurance producer responsible must either give the consumer the specific reasons in writing or advise that the reasons are available on written request, and give a summary of the consumer's rights under ORS 746.650, 746.640 and 746.645.

A licensee or insurance-support organization may not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure meets one of the conditions ORS 746.665(1) lists. ORS 746.607 and 746.608 establish standards for health insurers that are subject to the information privacy provisions of both the federal Health Insurance Portability and Accountability Act and the federal Gramm-Leach-Bliley Act.

ORS 746.620, 746.630, 746.640, 746.645 and 746.665 do not apply to health insurers. A health insurer may use or disclose personal information of an individual in a manner consistent with an authorization from the individual or a personal representative.

The Director of the Department of Consumer and Business Services may examine and investigate the affairs of any insurer or insurance producer transacting insurance in Oregon, and of an insurance-support organization acting on behalf of one, to determine whether it has engaged in conduct in violation of ORS 746.600 to 746.690. A person whose rights under ORS 746.607(7), 746.640, 746.645 or 746.650 are violated may apply to a court for appropriate equitable relief.

A licensee or insurance-support organization that discloses information in violation of ORS 746.665, or a health insurer that uses or discloses information in violation of ORS 746.607(1) or (2), is liable for the actual damages the individual sustains. Except as ORS 746.680 provides, no remedy or recovery is available to individuals, in law or in equity, for a violation of any provision of ORS 746.600 to 746.690.

No person may knowingly and willfully obtain information about an individual from an insurer, insurance producer or insurance-support organization under false pretenses. The history note of ORS 746.610 lists section 3 of chapter 649, Oregon Laws 1981, and later amendments through chapter 364, Oregon Laws 2003. ORS chapters 731, 732, 733, 734, 735, 737, 742, 743, 743A, 743B, 744, 746, 748 and 750 may be cited as the Insurance Code.

A person that violates any provision of the Insurance Code is subject to a civil penalty the Director of the Department of Consumer and Business Services determines that does not exceed $10,000 for each offense. A violation of any provision of the Insurance Code for which no greater penalty is provided is a Class A misdemeanor. The sections this entry groups came into force on different days.

The Oregon Attorney General has exclusive authority to enforce OCPA; no other Oregon law creates a private right of action for a violation. Civil penalties run up to $7,500 per violation, and the statute of limitations is five years from the last violative act. Until January 1, 2026 the Attorney General had to notify a controller of a violation that the Attorney General determined the controller could cure, and the controller had 30 days to cure it before the Attorney General could sue.

Since January 1, 2026 the Attorney General is no longer required to give controllers notice and an opportunity to cure. The notice duty that section 5 of chapter 417, Oregon Laws 2025, kept for certain noncommercial educational broadcast stations was repealed on July 1, 2026.

OCPA defines sensitive data as personal data that reveals a consumer's racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, status as transgender or nonbinary, status as a victim of crime or citizenship or immigration status; is a child's personal data; accurately identifies within a radius of 1,750 feet a consumer's present or past location, or the present or past location of a device that links or is linkable to a consumer; or is genetic or biometric data, which it lists independently and does not qualify with a for-the-purpose-of-uniquely-identifying clause the way several peer states phrase it.

'Biometric data' means data from automatic measurement of biological characteristics used to identify a consumer, and Oregon's clawback is the most explicit of any state in this batch: it separately and by name brings facial mapping or facial geometry back into biometric data whenever generated or used to identify a specific consumer, in addition to the general photo, audio, or video-derived-data clawback.

ORS 336.184 may be cited as the Oregon Student Information Protection Act. An operator is the operator of an Internet website, online service, online application or mobile application with actual knowledge that it is used primarily for kindergarten through grade 12 school purposes and was designed and marketed for those purposes, to the extent it is operating in that capacity.

Covered information is personally identifiable information or materials that regard a student in Oregon and that the student or a parent provides to an operator, that a school employee or agent provides for kindergarten through grade 12 purposes, or that an operator gathers and that identify the student or are linked to information that does.

An operator may not knowingly engage in targeted advertising, target advertising on another site based on information acquired through the school use, amass a profile about a student except in furtherance of kindergarten through grade 12 school purposes, sell a student's information, or disclose covered information except as ORS 336.184(3)(a)(E) allows.

An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information and must delete a student's covered information within a reasonable time if the school or school district requests deletion of data under its control. ORS 336.184 does not apply to general audience Internet websites, online services, online applications or mobile applications, even if login credentials created for an operator's site may be used to access them.

A violation of ORS 336.184 is an unlawful practice under ORS 646.607. The history note of ORS 336.184 lists section 2 of chapter 528, Oregon Laws 2015. Section 5 of Enrolled Senate Bill 187 (2015) provides that the Act takes effect July 1, 2016. Section 4 of Enrolled Senate Bill 187 (2015) provides that the new operator section first applies to data created, provided or gathered on or after the effective date of the Act.

A court that finds a person willfully used a practice declared unlawful by ORS 646.607 may, on the prosecuting attorney's petition, set a civil penalty not exceeding $25,000 per violation. A prosecuting attorney who has probable cause to believe that a person is engaging in an unlawful trade practice may bring suit in the name of the State of Oregon to restrain the practice.

Except as ORS 659A.300 provides, it is an unlawful employment practice for any employer to subject, directly or indirectly, any employee or prospective employee to a genetic test, among other listed tests. For ORS 659A.300, genetic test has the meaning given in ORS 192.531.

ORS 659A.300(1) does not prohibit a genetic test if the individual or the individual's representative grants informed consent in the manner ORS 192.535 provides and the test is administered solely to determine a bona fide occupational qualification. A person claiming to be aggrieved by an unlawful practice that ORS 659A.885(2) specifies, which includes a violation of ORS 659A.300, may file a civil action in circuit court, and the court may order injunctive and other equitable relief.

After a hearing the commissioner issues an appropriate cease and desist order against a respondent found to have engaged in an unlawful practice, and the order may require the respondent to pay an award of actual damages suffered by the complainant. No record stating the day on which the section came into force has been located.

It is an unlawful employment practice for an employer to seek to obtain, to obtain or to use genetic information of an employee or a prospective employee, or of a blood relative of either, to distinguish between or discriminate against or restrict any right or benefit otherwise due or available to an employee or a prospective employee. For ORS 659A.303, blood relative, genetic information and obtain genetic information have the meanings given in ORS 192.531.

An employer is any person who in Oregon, directly or through an agent, engages or uses the personal service of one or more employees, reserving the right to control the means by which the service is performed. A person includes a public body as defined in ORS 30.260. The history note of ORS 659A.303 lists former ORS 659.036 and section 4 of chapter 210, Oregon Laws 2011.

A person claiming to be aggrieved by an unlawful practice may file with the Commissioner of the Bureau of Labor and Industries a verified written complaint. After a hearing the commissioner issues an appropriate cease and desist order against a respondent found to have engaged in an unlawful practice, and the order may require the respondent to pay an award of actual damages suffered by the complainant. No record stating the day on which the section came into force has been located.

ORS 192.535 bars a person from obtaining genetic information from an individual, or from an individual's DNA sample, without first obtaining the informed consent of the individual or the individual's representative, unless an exception applies. Genetic information is information about an individual or the individual's blood relatives obtained from a genetic test. To obtain genetic information is to perform or get the results of a genetic test.

ORS 192.537 requires any person authorized by law or by an individual to obtain, retain or use an individual's genetic information or DNA sample to maintain its confidentiality and to protect it from unauthorized disclosure or misuse. ORS 192.537 bars a person from retaining another individual's genetic information or DNA sample without first obtaining authorization from the individual or the individual's representative, unless an exception applies.

ORS 192.537 requires the DNA sample of an individual from which genetic information has been obtained to be destroyed promptly on the specific request of the individual or the individual's representative, unless an exception applies. ORS 192.537 lets an individual or the individual's representative, promptly on request, inspect, request correction of and obtain genetic information from the records of the individual.

ORS 192.539 bars a person from disclosing, or being compelled by subpoena or any other means to disclose, the identity of an individual on whom a genetic test has been performed, or genetic information about the individual in a manner that permits identification, unless an exception applies.

A health care provider that is a covered entity and obtains an individual's biological specimen or clinical individually identifiable health information must notify the individual that it may be disclosed or retained by the provider for anonymous research or coded research. The history note of ORS 192.531 lists former ORS 659.700, section 1 of chapter 333, Oregon Laws 2003, section 1 of chapter 678, Oregon Laws 2005, and section 6 of chapter 800, Oregon Laws 2007.

ORS 192.531 defines the genetic privacy statutes as ORS 192.531 to 192.549, 659A.303 and 746.135 and the provisions of ORS 659A.300 relating to genetic testing. An individual or the individual's blood relative, representative or estate may bring a civil action against any person who violates ORS 192.535, 192.537, 192.539 or 192.547.

For a violation of ORS 192.535 or 192.539 the court awards the greater of actual damages or an amount from $1,000 for an inadvertent violation to $250,000 for a knowing violation committed with intent to sell, transfer or use for commercial advantage, personal gain or malicious harm.

For a violation of ORS 192.537 or 192.547 the court awards the greater of actual damages or an amount from $100 for an inadvertent violation to $25,000 for a knowing violation committed with intent to sell, transfer or use for commercial advantage, personal gain or malicious harm. Unlawfully obtaining, retaining or disclosing genetic information in violation of ORS 192.531 to 192.549 is a Class A misdemeanor.

The Attorney General or a district attorney may bring an action against a person who violates ORS 192.535, 192.537, 192.539 or 192.547, and the court awards the costs of the investigation.

If a person asks an applicant for insurance to take a genetic test in connection with an application, the use of the test must be revealed to the applicant and the person must obtain the applicant's specific authorization on a form the Director of the Department of Consumer and Business Services adopts by rule. A person may not use favorable genetic information to induce the purchase of insurance.

A person may not use genetic information to reject, deny, limit, cancel, refuse to renew, increase the rates of, affect the terms and conditions of or otherwise affect any policy for hospital or medical expenses. A person may not use genetic information about a blood relative to reject, deny, limit, cancel, refuse to renew, increase the rates of, affect the terms and conditions of or otherwise affect any policy of insurance.

The history note of ORS 746.135 lists section 8 of chapter 680, Oregon Laws 1995, and section 17 of chapter 588, Oregon Laws 2001. ORS chapters 731, 732, 733, 734, 735, 737, 742, 743, 743A, 743B, 744, 746, 748 and 750 may be cited as the Insurance Code. A person that violates any provision of the Insurance Code is subject to a civil penalty the Director of the Department of Consumer and Business Services determines that does not exceed $10,000 for each offense.

The civil penalty for individual insurance producers, adjusters or insurance consultants may not exceed $1,000 for each offense, and each violation is a separate offense. A violation of any provision of the Insurance Code for which no greater penalty is provided is a Class A misdemeanor. No record stating the day on which the section came into force has been located.

ORS 646A.620(1) bars a person, except as otherwise specifically provided by law, from printing a consumer's Social Security number on unrequested mail or on documentation of a requested transaction or service unless it is redacted, from printing it on a card required to access products or services, and from publicly posting or displaying it unless it is redacted.

ORS 646A.620 does not prevent the collection, use or release of a Social Security number as required by state or federal law or court rule, or its use or printing for internal verification or administrative purposes or to enforce a judgment or court order. The history note of ORS 646A.620 lists section 11 of chapter 759, Oregon Laws 2007, and section 1 of chapter 254, Oregon Laws 2017.

Chapter 254, Oregon Laws 2017 (Senate Bill 769), relates to disposing of material that displays Social Security numbers and amends ORS 646A.620. A person who violates or who procures, aids or abets in the violation of ORS 646A.600 to 646A.628 is subject to a penalty of not more than $1,000 for every violation, and the maximum penalty for any occurrence does not exceed $500,000.

If the Director of the Department of Consumer and Business Services has reason to believe that a person is violating ORS 646A.600 to 646A.628, the director may issue a cease and desist order or require the person to pay compensation to injured consumers. ORS 646.607 lists a violation of a provision of ORS 646A.600 to 646A.628 among the unlawful trade practices.

A prosecuting attorney who has probable cause to believe that a person is engaging in an unlawful trade practice may bring suit in the name of the State of Oregon to restrain the practice. A court that finds a person willfully used a practice declared unlawful by ORS 646.607 may, on the prosecuting attorney's petition, set a civil penalty not exceeding $25,000 per violation.

ORS 192.553 states the policy of the State of Oregon that an individual has the right to have protected health information safeguarded from unlawful use or disclosure and the right to access and review it. A covered entity is a state health plan, a health insurer, a health care provider that transmits health information in electronic form in connection with a transaction covered by ORS 192.553 to 192.581, or a health care clearinghouse.

Protected health information is individually identifiable health information that is maintained or transmitted in any form of electronic or other medium by a covered entity. Protected health information does not include individually identifiable health information in education records covered by the federal Family Educational Rights and Privacy Act or in employment records held by a covered entity in its role as employer.

A health care provider or state health plan may use or disclose protected health information consistent with an authorization, and without one for its own treatment, payment or health care operations or as otherwise permitted or required by state or federal law or by order of the court.

An authorization is a document written in plain language that contains the description of the information, the persons authorized to disclose and receive it, each purpose, an expiration date or event, the signature and date, the authority of any personal representative, and statements on revocation, conditioning of treatment and redisclosure.

A health care provider or state health plan that receives an authorization to disclose protected health information may charge no more than $30 for copying 10 or fewer pages, no more than 50 cents per page for pages 11 through 50 and no more than 25 cents for each additional page. Any disclosure of protected health information under ORS 192.567 must be limited to the minimum necessary to accomplish the purpose of the disclosure.

A covered entity must, on request of an individual appealing the denial of Social Security disability benefits, provide one copy of the individual's health information free of charge. A health care provider that participates in a coordinated care organization must disclose protected health information to the other participating providers for treatment and to the organization for health care operations and payment.

Nothing in ORS 192.556 or 192.558 may be construed to create a new private right of action against a health care provider or a state health plan. A health care facility, meaning a hospital or a federally qualified health center, may not disclose for the purpose of law enforcement information concerning a person's citizenship or immigration status or country of birth unless state or federal law or a court order requires the disclosure. That bar took effect on June 5, 2026. The sections this entry groups came into force on different days.

Subsection (4) makes it a Class A misdemeanor to knowingly and without authorization use, access or attempt to access any computer, computer system, computer network, or any computer software, program, documentation or data contained in one.

Subsection (3) makes it a Class C felony to knowingly and without authorization alter, damage or destroy a computer, computer system, computer network, or its software, program, documentation or data, and subsection (2) makes it a Class C felony to knowingly access, attempt to access or use a computer, computer system or computer network for the purpose of devising or executing a scheme to defraud, obtaining money, property or services by false or fraudulent pretenses, representations or promises, or committing theft, including theft of proprietary information or of an intimate image.

Subsection (1) defines to access as to instruct, communicate with, store data in, retrieve data from or otherwise make use of any resources of a computer, computer system or computer network, and it does not define authorization.

Any violation of the section relating to a computer, network, program, software, system or data owned or operated by the Oregon State Lottery, or by another person or entity under contract to or at the direction of the Oregon State Lottery Commission, is a Class C felony.

OCPA applies to a person conducting business in Oregon, or providing products or services to Oregon residents, that during a calendar year controls or processes the personal data of 100,000 or more consumers, other than data processed solely to complete a payment transaction, or of 25,000 or more consumers while deriving 25 percent or more of gross revenue from selling personal data, with no separate dollar-revenue threshold of its own.

Sensitive data is defined to include a consumer's precise present or past location, accurate within a 1,750-foot radius, and genetic or biometric data, and a controller may not process sensitive data about a consumer without first obtaining the consumer's consent.

OCPA's own 'personal data' definition does carry a publicly-available-information exemption, and 'sensitive data' is itself defined as a subset of personal data, so the same exemption applies upstream to it: personal data does not include data that is lawfully available through federal, state, or local government records or through widely distributed media, or that a controller reasonably has understood to have been lawfully made available to the public by the consumer (ORS 646A.570(13)(b)).

This is narrower than a blanket public-availability exemption, since it does not cover data merely observable online that a scraper, rather than the consumer or a distributed-media outlet, is the one making public; scraped sensitive or personal data of unclear provenance should still be treated as covered unless one of those two specific showings applies.

Oregon amended OCPA in 2025 (HB 2008, Oregon Laws 2025, chapter 251, ORS 646A.578(2)(d)) to bar a controller from selling personal data that accurately identifies, within a radius of 1,750 feet, a consumer's present or past location, and the text carries no consent exception; it also bars selling the personal data of a consumer the controller knows, or willfully disregards, is under 16.

Enforcement is by the Attorney General only, with a civil penalty of up to $7,500 per violation; before bringing an action the Attorney General must give a controller 30 days to cure a violation that can be cured, a duty that Oregon Laws 2025, chapter 417, section 5, applies to every controller until January 1, 2026 and after that only to certain noncommercial educational broadcast stations, and that section 6 repeals on July 1, 2026. OCPA carries no private right of action.

A manufacturer, a person that makes a connected device and sells or offers to sell it in Oregon, must equip the device with reasonable security features: a preprogrammed authentication credential unique to each unit, or a requirement that the user generate new credentials before first use, or compliance with an applicable federal security requirement for connected devices.

A connected device is limited, under the section's own definition, to a physical object used primarily for personal, family or household purposes that connects to the Internet or is assigned an address for a short-range wireless connection.

The section expressly imposes no duty on the manufacturer for software, firmware or peripheral devices that another manufacturer makes and a consumer later installs or adds, so it does not by itself reach a developer who ships only software or an app with no connected device of its own. It also exempts a device already regulated as to the relevant activity under Health Insurance Portability and Accountability Act (HIPAA), or already subject to Food and Drug Administration medical-device requirements.

It imposes no verification duty on an app store or marketplace. A violation is declared an unlawful trade practice under ORS 646.607, enforceable only by the Attorney General or a district attorney by injunction and a civil penalty of up to $25,000 per willful violation. Oregon's general private right of action for unlawful trade practices, ORS 646.638, reaches only a practice declared unlawful under the separate ORS 646.608, so a violation of this section carries no private remedy of its own. The enacting 2019 Act, chapter 193, carries its own printed effective date of January 1, 2020.

Rule 836-081-0101(3) requires each licensee to establish and implement an information security program, including appropriate policies and systems. The rules establish standards for developing and implementing administrative, technical and physical safeguards to protect the security, confidentiality and integrity of customer information, pursuant to Sections 501, 505(b), and 507 of the Gramm-Leach-Bliley Act.

The safeguards apply to nonpublic personal information, including financial information and health information.

Rule 836-081-0116 requires a licensee's information security program to be designed to ensure the security and confidentiality of customer information, to protect against any anticipated threats or hazards to the security or integrity of the information, and to protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to any customer.

Customer information means personal information as defined in ORS 746.600 about a customer, whether in paper, electronic or other form, that is maintained by or on behalf of the licensee. A licensee is a licensee as defined in ORS 746.600, except that the term does not include a purchasing group or an unauthorized insurer in regard to surplus lines business conducted pursuant to ORS 735.400 to 735.495.

The rules are adopted by the Director of the Department of Consumer and Business Services under the authority of ORS 731.244 to implement ORS 746.240 and ORS 746.670, and do not name ORS 646A.622 as a statute they implement. ORS 646A.622(2)(b) treats a covered entity or vendor as complying with the safeguards duty in ORS 646A.622(1) if it complies with regulations promulgated under Title V of the Gramm-Leach-Bliley Act, where its personal information is also subject to that Act.

ORS 646A.622(2)(a) likewise treats a covered entity or vendor as complying if it complies with a state or federal law that provides greater protection to personal information than the section provides. Rule 836-081-0116 took effect on March 17, 2003.

All state agencies must cooperate with the office of Enterprise Information Services in the implementation of a continuing statewide agency-by-agency risk-based information technology security assessment and remediation program. All state agencies must cooperate in the development of, and follow, the plans, rules, policies and standards adopted by the State Chief Information Officer with regard to the unification of agency information technology security functions in the state.

All state agencies must conduct and document the completion of annual information technology security awareness training for all agency employees. All state agencies must report security metrics using methodologies developed by the office of Enterprise Information Services. All state agencies must participate in activities the office of Enterprise Information Services coordinates to better understand and address security incidents and critical cybersecurity threats to the state.

A state agency in this section is an agency, as defined in ORS 183.310, in the executive department, and the executive department excludes the Secretary of State, the State Treasurer, the Attorney General, the Oregon State Lottery and the public universities listed in ORS 352.002.

A covered entity and a vendor must develop, implement and maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personal information, including safeguards for its disposal.

A covered entity is any person, defined to include a public body, that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses personal information in the course of the person's business, vocation, occupation or volunteer activities. A vendor is a person a covered entity contracts with to maintain, store, manage, process or otherwise access personal information on the covered entity's behalf.

A covered entity or vendor complies either by already being subject to and complying with Gramm-Leach-Bliley Act Title V regulations, Health Insurance Portability and Accountability Act (HIPAA) and HITECH regulations, or another state or federal law providing greater protection, or by implementing an information security program with the administrative safeguards (a designated coordinator, periodic risk assessment, employee training, vetted service-provider contracts), technical safeguards (network and software risk assessment, security patch management, attack detection and testing) and physical safeguards (collection and disposal risk assessment, intrusion monitoring, and secure destruction of records) the statute lists.

A small business may instead scale its program to its own size, complexity and the sensitivity of the personal information it collects. The Director of the Department of Consumer and Business Services enforces the duty by investigation, subpoena, and a cease-and-desist order or, only where enforcement by private civil action would be impractical, an order that the violator compensate injured consumers, with a civil penalty of up to $1,000 per violation and up to $500,000 for any one occurrence.

The sections name no private right of action of their own. The safeguards duty was enacted as section 12 of the 2007 Act, chapter 759, whose own text set that section operative on January 1, 2008; it has since been amended three times, most recently in 2019.

A state agency must promptly notify the Legislative Fiscal Office of an information security incident and describe the actions the agency has taken or must reasonably take to prevent, mitigate or recover from damage to, unauthorized access to, unauthorized modifications or deletions of or other impairments of the integrity of its information system or information resources.

An information security incident is an incident that creates a risk of harm to a state agency or its operations and in which sensitive, protected or confidential information is accessed or used without the agency's authorization, a failure of compliance with its security or acceptable use policies results in unauthorized access, or its information system or information resources, or a third party information service to which it subscribes, become unavailable in a reliable and timely manner to authorized individuals or organizations, or are modified or deleted in circumstances the agency does not intend, plan or initiate.

Each state agency must periodically conduct or contract for an information security assessment of its information system and information resources and must notify the Legislative Fiscal Office of the assessment after it receives the results.

A state agency is an officer, board, commission, department, agency or institute of state government as defined in ORS 174.111, other than the public universities listed in ORS 352.002 and the Oregon State Lottery and the entities with which the Lottery has a contract or agreement with respect to its gaming systems or networks.

The Legislative Fiscal Office may use the notifications it receives solely to support the Joint Legislative Committee on Information Management and Technology, the Joint Committee on Ways and Means and the Joint Legislative Audit Committee.

If a person receives unsolicited and unwanted advertising material for the sale of real estate, goods or services on a facsimile machine, that person may give the sender written notice to stop, and once given, the sender may not fax unsolicited advertising material to that person for one calendar year.

A violation is an unlawful trade practice, letting a person who suffers an ascertainable loss from a willful violation sue under ORS 646.638 for actual damages or $200, whichever is greater, plus attorney fees, in addition to the Attorney General's own enforcement powers. The codified text names no enacting act, and no day on which the section came into force has been located.

No person may install or use a pen register or trap and trace device except as the listed court-order and interception statutes and ORS 165.657 to 165.673 allow.

A pen register is a device that records or decodes impulses identifying the numbers dialed or otherwise transmitted on the telephone line it is attached to, but not a device a provider, or a customer of a provider, uses for billing or recording incident to billing, or for cost accounting or similar purposes in the ordinary course of its business. A trap and trace device is a device that captures the originating number of an incoming communication.

A provider of wire or electronic communication service may use such a device in operating, maintaining, testing or protecting its service, its rights or property or its users, to record that a communication was initiated or completed to protect against fraudulent, unlawful or abusive use, or where the consent of the user of that service has been obtained; all three are provider exceptions.

The sections state no penalty, and ORS 161.555(3) provides that an offense defined by statute without a stated classification or penalty is a Class A misdemeanor. The general misdemeanor sentencing statutes cap a Class A misdemeanor at 364 days' imprisonment. They separately cap its fine at $6,250. The sections name no private civil action, and ORS 165.669(4) bars an action against a provider that assists under a court order. No day on which these sections came into force has been located.

Oregon bars a person from obtaining or attempting to obtain the whole or part of a telecommunication or radio communication to which the person is not a participant unless at least one participant has consented, so a participant to a phone call may record it under this clause without telling the other participants, while a stranger to the call needs only one participant's consent.

A separate clause bars obtaining any part of a conversation unless all participants are specifically informed that their conversation is being obtained, a duty that binds a participant to an in-person or video-conferencing conversation as much as a stranger to it. A conversation for this purpose is an oral communication that is not a telecommunication or radio communication, and it includes a communication occurring through a video conferencing program.

One exception to the conversation rule reaches a person recording during a felony that endangers human life. Another reaches a public or semipublic meeting such as a hearing, trial, press conference or class if recorded with an unconcealed device or through a video conferencing program. A third reaches a private meeting or conference if all others involved knew or reasonably should have known that the recording was being made.

Separate exceptions cover an open recording of an on-duty law enforcement officer made from a place the recorder may lawfully be, an officer's own body-worn or vehicle camera, and certain custodial interview recordings.

A person who, intending to capture alleged unlawful activity, records a video-conferencing conversation as a participant or with one participant's consent is also exempt from the notice rule if the person is coordinating with law enforcement, an attorney or an enforcement or regulatory body, or reasonably believes the recording may be used as evidence.

Subscribers and their family members recording in their own homes, and a telecommunication or radio company's own employees acting to construct, maintain or operate its service, are also exempt from the participant-consent and specific-notice provisions. It is also barred to obtain a conversation or communication from another person while knowing or having good reason to believe it was first obtained in a prohibited way, or to use or divulge one obtained by prohibited means.

Neither of those two bars reaches a person who took no part in first obtaining the conversation or communication where it concerns a matter of public concern. A related section separately makes it a Class A misdemeanor for a person who is not a party to a wire or oral communication to willfully intercept it, or procure its interception, where none of the parties has consented. A willful violation of these sections is a Class A misdemeanor.

The general misdemeanor sentencing statutes cap a Class A misdemeanor at 364 days' imprisonment. They separately cap its fine at $6,250. The civil damages action at ORS 133.739 reaches a communication intercepted, disclosed or used in violation of ORS 133.724 or 133.737, the court-order interception and law-enforcement disclosure sections. ORS 133.739(3) nonetheless preserves whatever other private civil remedy for invasion of privacy the common law otherwise gives. The sections this entry groups came into force on different days.

House Bill 3865 (Oregon Laws 2025, chapter 580) amended this statute, effective January 1, 2026.

As amended, a caller may not use an automatic dialing and announcing device, a device that selects and dials numbers and disseminates a prerecorded or synthesized voice or text message, to call a subscriber by telephone unless the device disconnects within 10 seconds after the subscriber ends the call and, within the first 10 seconds, offers a one-touch or one-digit method for the subscriber to opt out of future calls; the opt-out duty does not reach a collection agency, debt buyer or debt collector, a public safety or law enforcement representative, or a caller with an established business relationship with the subscriber.

The device may not dial a number for a fire, law enforcement or other emergency agency, a hospital, health care facility, physician's office, poison control center, or suicide-prevention or domestic-violence counseling service, or a subscriber who used the opt-out (unless the caller is a collection agency, debt buyer or debt collector, a public safety or law enforcement representative, or has an established business relationship), and, when dialing randomly or sequentially, a subscriber on an official government do-not-call list (unless the caller has an established business relationship, is a debt buyer or subject to the Fair Debt Collection Practices Act, is a public safety or law enforcement representative, or is a school district or school calling its employees, students or their families).

It may be used to call a subscriber only between 8 a.m. and 8 p.m. and no more than three times in 24 hours, with the same exceptions as the government-list rule plus a caller responding directly to the subscriber's own message, and a caller may rely on a mobile number's area code to decide whether the subscriber is in Oregon.

A caller using such a device may not misrepresent or falsify, in speaking with the subscriber, in the prerecorded or synthesized message or in any text message, the caller's own or a represented person's identity, the caller's telephone number, the caller's location, or the purpose of the call.

Separately, a caller, a term that section does not limit to a user of such a device, may not intentionally alter, misrepresent or falsify the information a caller identification service would ordinarily provide.

A person who knowingly, or while consciously avoiding knowledge, provides substantial assistance for a misrepresentation or caller-ID violation, including carrying or facilitating the calls, is liable to the same extent as the caller, except a common carrier or a network operator on whose network the call merely terminates.

A violation of the misrepresentation and caller-ID duties is an unlawful trade practice, letting a person who suffers an ascertainable loss from a willful violation sue under ORS 646.638 for actual damages or $200, whichever is greater, plus attorney fees.

A violation of the usage limits is an unlawful trade practice subject to Attorney General investigation and enforcement with a civil penalty of up to $5,000 for each violation, and ORS 646.608, whose list the private action under ORS 646.638 depends on, names ORS 646A.374 but not ORS 646A.372.

A telephonic seller is defined narrowly to reach a person who causes a telephone solicitation of a business opportunity, or who solicits by phone while representing that a buyer will receive additional units without further cost or a prize or gift for buying or paying, that an unusual event or price increase justifies a below-market price, that the seller, manufacturer or supplier is other than the real one, or who is selling gold, silver or another precious metal, a precious stone, or an interest in oil, gas or a mineral field, well or exploration site.

Such a seller must register with the Department of Justice at least 10 days before conducting business in Oregon, whether calling from inside or into the state, and pay a $400 annual fee; individual employees need not register separately.

The definition excludes, among others, a securities seller, a person licensed in real estate, construction contracting or insurance acting within that license, a franchise seller governed by Oregon's franchise law, a newspaper, magazine or negative-option subscription seller, a person soliciting prior purchasers of the business it calls for (unless selling a business opportunity), a person who completes the sale only at a later face-to-face meeting, a supervised financial institution or its affiliate, a funeral, cable or regulated-utility seller, an issuer registered under section 12 of the Securities Exchange Act of 1934 or its subsidiary, and a registered charity.

When a telephonic seller represents free items, offers metals, stones or minerals or an oil, gas or mineral interest, or offers office equipment or supplies below usual prices, it must, at the time of the solicitation and before any sale, give the street address it is calling from and its principal address and the further information the section lists for that kind of offer.

A violation of the registration or disclosure duty is an unlawful trade practice, letting a person who suffers an ascertainable loss from a willful violation sue under ORS 646.638 for actual damages or $200, whichever is greater, plus attorney fees, in addition to the Attorney General's own enforcement powers. The sections this entry groups came into force on different days.

A person may not engage in the telephone solicitation of a party at a telephone number on the current list published by the administrator of Oregon's telephone solicitation program or on the federal do-not-call registry designated as part of it.

A telephone solicitation for this purpose is a solicitation by telephone to encourage a party to purchase real estate, goods or services or to make a donation, and excludes a call responding to the called party's request or inquiry, a charitable organization's, public agency's or volunteers' call to members or donors, a call limited to polling or soliciting opinions or votes, and a business-to-business contact.

Unlike ORS 646.561, which chapter 580 of the 2025 Oregon Laws extended to text messages, this definition does not mention text messages. For the registry ban, a telephone solicitation also does not include soliciting a prospective purchaser who has previously purchased from the caller, the business it calls for, or a financial-institution predecessor of that business.

A person who knows or consciously avoids knowing that another is violating the registry ban and nonetheless provides substantial assistance, including carrying or facilitating the calls, is liable to the same extent as the caller, except a common carrier or a network operator on whose network the call merely terminates.

A violation is an unlawful trade practice, letting a person who suffers an ascertainable loss from a willful violation sue under ORS 646.638 for actual damages or $200, whichever is greater, plus attorney fees, in addition to the Attorney General's own enforcement powers. The sections this entry groups came into force on different days.

House Bill 3865 (Oregon Laws 2025, chapter 580) amended this section, effective January 1, 2026. As amended, Oregon bars a person from making a subsequent telephone solicitation, by call or text message, of a party who has stated during a telephone solicitation a desire not to be called or texted again.

It also bars initiating a telephone solicitation outside the hours of 8 a.m. to 8 p.m., or more than three separate times to a party within 24 hours, unless the person has an established business relationship with the party. An established business relationship for this purpose means a transaction within the preceding 18 months. And it bars misrepresenting or falsifying the caller's own identity or the identity of the person on whose behalf the call is made, or the purpose of the solicitation.

A telephone solicitation for this purpose is a call or text message encouraging a party to purchase real estate, goods or services or to make a donation, and it excludes a charitable organization or public agency contacting its own members or donors, a call or text limited to polling or soliciting opinions or votes, a business-to-business contact, and a call or text that responds directly to a message the party sent.

A party is a telephone customer of a telecommunications company, and a person may rely on a mobile number's area code to decide whether the party is in Oregon. A violation is an unlawful trade practice, letting a person who suffers an ascertainable loss from a willful violation sue under ORS 646.638 for actual damages or $200, whichever is greater, plus attorney fees, in addition to the Attorney General's own enforcement powers.

Bars a controller that has actual knowledge that, or willfully disregards whether, a consumer is under 16 from selling that consumer's personal data, using it for targeted advertising, or profiling in furtherance of decisions with legal or similarly significant effects, with no consent exception, and separately bars selling personal data that identifies a consumer's location within a 1,750 foot radius. Signed by Governor Kotek on June 3, 2025.