United States of America: Bill amending the Oregon Consumer Privacy Act to prohibit sale of geolocation data and children’s personal data (HB 2008) was adopted by Oregon legislature

On 29 May 2025, the Oregon legislature adopted the Bill amending the Oregon Consumer Privacy Act to prohibit sale of geolocation data and children’s personal data (HB 2008). The Bill amends ORS 646A.578 to modify provisions on the collection, processing, and sale of personal data. It requires controllers to specify the purposes of processing, limit data collection to what is adequate, relevant, and reasonably necessary for those purposes, and implement safeguards to protect the confidentiality, integrity, and accessibility of personal data. Controllers must provide a mechanism for consumers to revoke consent and to cease processing within 15 days of revocation. The Bill prohibits processing beyond specified purposes without consent, processing sensitive data without consent or, in the case of children, without compliance with the Children’s Online Privacy Protection Act (COPPA), and using personal data for targeted advertising or profiling of individuals under 16 years of age. It also prohibits the sale of personal data of individuals under 16 and the sale of geolocation data that identifies a location within a 1'750-foot radius, with exceptions for utility-related data. The Bill requires privacy notices to include specific information about data use and sharing, and mandates the provision of opt-out mechanisms for data sales, targeted advertising, and profiling. It prohibits discriminatory treatment of consumers exercising their rights, while allowing differentiated terms for voluntary participation in loyalty or rewards programmes.