United States of America: Bill amending the Oregon Consumer Privacy Act to prohibit sale of geolocation data and children’s personal data (HB 2008) enters into force

On 1 January 2026, the Bill amending the Oregon Consumer Privacy Act to prohibit sale of geolocation data and children’s personal data (HB 2008) enters into force. The Bill amends ORS 646A.578 to modify provisions on the collection, processing, and sale of personal data. It requires controllers to specify the purposes of collection in a privacy notice, limit data collection to what is adequate, relevant, and reasonably necessary, and implement safeguards to protect the confidentiality, integrity, and accessibility of personal data. Controllers must provide a mechanism for consumers to revoke consent and to cease processing within 15 days of revocation. The Law prohibits processing beyond specified purposes without consent, processing sensitive data without consent or, in the case of children, without compliance with the Children’s Online Privacy Protection Act (COPPA), and using personal data for targeted advertising or profiling of individuals under 16 years of age. It also prohibits the sale of personal data of individuals under 16 and the sale of geolocation data that identifies a location within a 1'750-foot radius, with exceptions for utility-related data. The Law requires clear and accessible privacy notices specifying data categories collected, purposes of processing, methods to exercise rights, categories of third parties with whom data is shared, and contact details. Controllers must provide user-friendly, voluntary, and unambiguous opt-out mechanisms for the sale of personal data, targeted advertising, and profiling with significant legal or similar effects. Finally, the Law prohibits discriminatory treatment of consumers exercising their rights, while allowing differentiated terms for voluntary participation in loyalty or rewards programmes.