Oregon

Oregon's crime of unlawfully disseminating an intimate image, previously limited to a photograph, film or other visual reproduction, now also reaches a digitally created, manipulated or altered depiction that is reasonably realistic, so a deepfake or AI-generated nude or sexual image of a real, identifiable person falls within the same crime as an authentic one.

The person must have caused the disclosure with intent to harass, humiliate or injure someone who did not consent, and a reasonable person must be harassed, humiliated or injured by it. A first offense is a Class A misdemeanor; a second or later offense is a Class C felony.

Law enforcement activity, legitimate medical, scientific or educational activity, legal proceedings, reporting to law enforcement, and images the depicted person voluntarily displayed publicly or that were created commercially with consent are excluded.

A nonhuman entity, including but not limited to an agent powered by artificial intelligence, may not use the title or abbreviation of Advanced Practice Registered Nurse, certified registered nurse anesthetist, clinical nurse specialist, licensed practical nurse, registered nurse, nurse practitioner, certified medication aide or certified nursing assistant.

The chapter carrying this section exempts only the employment of nurses in institutions or agencies of the federal government; a state or local government entity is otherwise bound the same as a private one, so an AI system interacting with patients in a state, local or private health care setting may not present itself under any of these titles.

An operator of an artificial intelligence companion or companion platform, software designed to simulate a sustained human-like platonic, intimate or romantic relationship by retaining information across sessions, asking unprompted emotional questions and sustaining personal dialogue, must give users a clear and conspicuous notice that they are interacting with artificially generated output whenever a reasonable person could otherwise believe they were talking to a natural person.

An operator must maintain an evidence-based protocol for detecting suicidal or self-harm ideation that refers a user to the 988 crisis lifeline, or to a youth-specific lifeline where the operator identifies the user as under 25, and must publish its protocol and an annual incident report.

Where an operator knows or has reason to believe a user is a minor, it must prevent the companion from claiming to be sentient or human, simulating emotional dependence or romantic interest, role-playing a romantic relationship with a minor, or producing sexually explicit content, and must add periodic reminders that the output is artificially generated.

An individual who suffers an ascertainable loss because of a violation may sue for the greater of actual or statutory damages of $1,000 per violation, plus an injunction and, if they prevail, attorney fees. Customer-service, productivity, video-game and voice-assistant software are excluded, as are stand-alone voice-command devices. Passed by the Legislative Assembly in the 2026 regular session and assigned chapter 85; no commencement date has been located in the sources reviewed.

A campaign communication that includes synthetic media, an image, audio or video recording of a candidate's appearance, speech or conduct intentionally manipulated with artificial intelligence or similar digital technology to create a realistic but false depiction, must include a disclosure that the recording has been manipulated.

The Secretary of State, and in specified cases the Attorney General, may sue to enjoin a violation, and a court may impose a civil penalty of up to $10,000, which the statute makes the exclusive remedy. Interactive computer services, bona fide news coverage, paid broadcasters, periodicals that carry a corrective statement, and satire or parody are excluded.

A covered entity subject to a breach of security, or that receives notice of one from a vendor, must give notice of the breach to each affected Oregon consumer, and must also notify the Attorney General once the number of Oregon consumers notified exceeds 250. This provision is in force under the current codified text; no dated original commencement is established, so no effective date is recorded here.

OCPA governs private-sector processing of Oregon consumers' personal data. Enacted as S.B. 619 (2023 Regular Session), Or. Laws 2023, ch. 369, effective July 1, 2024 for most controllers; nonprofits were exempt from OCPA duties until January 1, 2026.

Two 2025 amendments, both effective January 1, 2026, are already reflected in the current codified text: H.B. 2008 added a precise-geolocation sale ban and a strict under-16 processing prohibition for targeted advertising, sale, and profiling; H.B. 3875 removed motor-vehicle manufacturers from the small-controller exemption.

OCPA gives an Oregon consumer the right to confirm processing, obtain a categories disclosure, receive a portable copy, correct, delete, and opt out of targeted advertising, sale, and profiling for decisions with legal or similarly significant effects.

A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available; an appeal of a refusal must be decided within 45 days; and consent revocation must be honored no later than 15 days after receipt.

The Oregon Attorney General has exclusive authority to enforce OCPA; no other Oregon law creates a private right of action for a violation. Civil penalties run up to $7,500 per violation, and the statute of limitations is five years from the last violative act.

The cure opportunity was discretionary from the outset: the Attorney General may notify a controller of a violation only if the Attorney General determines the violation can be cured, and, per secondary reporting, that discretionary practice tightened further as of January 1, 2026.

OCPA lists genetic or biometric data independently as sensitive data, not qualified by a for-the-purpose-of-uniquely-identifying clause the way several peer states phrase it, alongside data revealing racial or ethnic background, national origin, religious beliefs, mental or physical condition, sexual orientation, transgender or nonbinary status, victim-of-crime status, citizenship or immigration status, a child's data, and precise geolocation data.

'Biometric data' means data from automatic measurement of biological characteristics used to identify a consumer, and Oregon's clawback is the most explicit of any state in this batch: it separately and by name brings facial mapping or facial geometry back into biometric data whenever generated or used to identify a specific consumer, in addition to the general photo, audio, or video-derived-data clawback.

Subsections (3) and (4) make it a crime to knowingly and without authorization alter, damage, destroy, use, access, or attempt to access any computer, computer system, computer network, or the software, program, documentation, or data it contains.

This tracks the Computer Fraud and Abuse Act (CFAA)'s own without-authorization language closely enough that a court applying it would likely import the federal circuit split, Van Buren v. United States (593 U.S. 374, 2021) and hiQ Labs v. LinkedIn (31 F.4th 1180, 9th Cir. 2022), as the operative framework, though no Oregon court has adopted or rejected the Ninth Circuit's reading that a computer presumptively open to all comers erects no authorization gate at all.

Oregon's own case law construing without authorization comes from the insider-misuse context rather than outside scraping: State v. Nascimento, 360 Or 28, 379 P3d 484 (2016), held that an employee using access already granted for an improper personal purpose does not thereby act without authorization absent technical circumvention, and State v. Schwartz, 173 Or App 301, 21 P3d 1128 (2001), rejected a vagueness challenge to the phrase.

Neither reaches the hiQ fact pattern of unauthenticated, no-login access, so open-web crawling of an Oregon-connected public page is unsettled leaning toward permitted rather than settled by direct authority. Oregon has no ToS-specific statute or case (ordinary contract law governs browsewrap and clickwrap alike), no state text-and-data-mining exception or database right beyond the federal position, and no statute giving robots.txt independent legal weight.

Oregon's Unlawful Trade Practices Act, ORS 646.605 et seq., and common-law trespass to chattels are available in principle for unfair competition and misappropriation claims but remain untested against scraping specifically in Oregon case law.

OCPA applies to a person conducting business in Oregon, or providing products or services to Oregon residents, that during a calendar year controls or processes the personal data of 100,000 or more consumers, other than data processed solely to complete a payment transaction, or of 25,000 or more consumers while deriving 25 percent or more of gross revenue from selling personal data, with no separate dollar-revenue threshold of its own.

Sensitive data is defined to include a consumer's precise present or past location, accurate within a 1,750-foot radius, and genetic or biometric data, and a controller may not process sensitive data about a consumer without first obtaining the consumer's consent.

OCPA's own 'personal data' definition does carry a publicly-available-information exemption, and 'sensitive data' is itself defined as a subset of personal data, so the same exemption applies upstream to it: personal data does not include data that is lawfully available through federal, state, or local government records or through widely distributed media, or that a controller reasonably has understood to have been lawfully made available to the public by the consumer (ORS 646A.570(13)(b)).

This is narrower than a blanket public-availability exemption, since it does not cover data merely observable online that a scraper, rather than the consumer or a distributed-media outlet, is the one making public; scraped sensitive or personal data of unclear provenance should still be treated as covered unless one of those two specific showings applies.

Oregon amended OCPA in 2025 (HB 2008, reported signed by Governor Kotek June 3, 2025) to flatly ban selling a consumer's precise geolocation data effective January 1, 2026, a stricter rule than most peer states' consent-based approach; this amendment is reported by contemporaneous legal commentary and is not independently confirmed against HB 2008's own enrolled text, so its effective date and exact mechanism should be treated as reported rather than machine-verified.

Enforcement is by the Attorney General only, with a civil penalty of up to $7,500 per violation and a cure period through 2026; OCPA carries no private right of action.

A manufacturer, a person that makes a connected device and sells or offers to sell it in Oregon, must equip the device with reasonable security features: a preprogrammed authentication credential unique to each unit, or a requirement that the user generate new credentials before first use, or compliance with an applicable federal security requirement for connected devices.

A connected device is limited, under the section's own definition, to a physical object used primarily for personal, family or household purposes that connects to the Internet or is assigned an address for a short-range wireless connection.

The section expressly imposes no duty on the manufacturer for software, firmware or peripheral devices that another manufacturer makes and a consumer later installs or adds, so it does not by itself reach a developer who ships only software or an app with no connected device of its own. It also exempts a device already regulated as to the relevant activity under Health Insurance Portability and Accountability Act (HIPAA), or already subject to Food and Drug Administration medical-device requirements.

It imposes no verification duty on an app store or marketplace. A violation is declared an unlawful trade practice under ORS 646.607, enforceable only by the Attorney General or a district attorney by injunction and a civil penalty of up to $25,000 per willful violation. Oregon's general private right of action for unlawful trade practices, ORS 646.638, reaches only a practice declared unlawful under the separate ORS 646.608, so a violation of this section carries no private remedy of its own.

The enacted bill carries no operative-date or emergency clause of its own, so the section took effect under Oregon's constitutional default rule, ninety-one days after the 2019 regular session adjourned; no source located states that calendar day, so no day-precise effective date is recorded here.

A covered entity and a vendor must develop, implement and maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personal information, including safeguards for its disposal.

A covered entity is any person, defined to include a public body, that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses personal information in the course of the person's business, vocation, occupation or volunteer activities. A vendor is a person a covered entity contracts with to maintain, store, manage, process or otherwise access personal information on the covered entity's behalf.

A covered entity or vendor complies either by already being subject to and complying with Gramm-Leach-Bliley Act Title V regulations, Health Insurance Portability and Accountability Act (HIPAA) and HITECH regulations, or another state or federal law providing greater protection, or by implementing an information security program with the administrative safeguards (a designated coordinator, periodic risk assessment, employee training, vetted service-provider contracts), technical safeguards (network and software risk assessment, security patch management, attack detection and testing) and physical safeguards (collection and disposal risk assessment, intrusion monitoring, and secure destruction of records) the statute lists.

A small business may instead scale its program to its own size, complexity and the sensitivity of the personal information it collects. The Director of the Department of Consumer and Business Services enforces the duty by investigation, subpoena, and a cease-and-desist order or, only where enforcement by private civil action would be impractical, an order that the violator compensate injured consumers, with a civil penalty of up to $1,000 per violation and up to $500,000 for any one occurrence.

The sections name no private right of action of their own. The safeguards duty was first enacted in 2007 (2007 c.759 sec. 12) and has since been amended three times, most recently in 2019 (2019 c.180 sec. 4), each amendment carrying only a session and chapter citation rather than a stated calendar date, so no day-precise date is recorded here for when the duty as it now reads began to operate.

Bars a controller that has actual knowledge that, or willfully disregards whether, a consumer is under 16 from selling that consumer's personal data, using it for targeted advertising, or profiling in furtherance of decisions with legal or similarly significant effects, with no consent exception, and separately bars selling personal data that identifies a consumer's location within a 1,750 foot radius. Signed by Governor Kotek on June 3, 2025.