United States of America: Bill amending the Oregon Consumer Privacy Act to prohibit sale of geolocation data and children’s personal data (HB 2008) was introduced to House of Representatives

On 27 February 2025, Bill amending the Oregon Consumer Privacy Act to prohibit sale of geolocation data and children’s personal data (HB 2008) was introduced to the Oregon House of Representatives. The Bill would amend existing provisions on the collection, processing, and sale of personal data. It would require controllers to specify the purposes of processing, limit data collection to what is adequate, relevant, and reasonably necessary for those purposes, and implement safeguards to protect the confidentiality, integrity, and accessibility of personal data. Controllers would be required to provide a mechanism for consumers to revoke consent and to cease processing within 15 days of revocation. The Bill would prohibit processing beyond specified purposes without consent, processing sensitive data without consent or, in the case of children, without compliance with the Children’s Online Privacy Protection Act (COPPA), and using personal data for targeted advertising or profiling of individuals under 16 years of age. It would also prohibit the sale of personal data of individuals under 16 and the sale of geolocation data that identifies a location within a 1'750-foot radius, with exceptions for utility-related data. The Bill would require privacy notices to include specific information about data processing and sharing, and would mandate the provision of opt-out mechanisms for data sales, targeted advertising, and profiling. It would prohibit discriminatory treatment of consumers exercising their rights, while allowing differentiated terms for voluntary participation in loyalty or rewards programmes.