Oregon Consumer Privacy Act - Profiling Provisions
Effective date
Penalty
Up to $7,500 per violation. Cure period expired January 1, 2026. AG no longer required to send cure notice before enforcement. Immediate enforcement now appl…
Obligations mapped
8 obligations
Overview
Grants Oregon consumers the right to opt out of profiling for decisions with legal or significant effects. Opt-out limited to profiling in furtherance of solely automated decisions (narrower than Colorado, Connecticut, and Montana which have removed the solely qualifier). 2025 amendments (SB 2008, SB 3875) prohibit sale of personal data for consumers under 16 and precise geolocation data (effective October 1, 2025). The Oregon CPA included a 30-day cure window that was not permanent: it ended January 1, 2026, after which the Attorney General is no longer required to provide a cure notice before enforcement.
This is a privacy law with automated decision-making provisions.
See if this regulation applies to your company with the free exposure scan.
Who this applies to
This regulation applies to the following roles:
- Deployers and users of covered AI systems and tools
- Organizations operating in Oregon
This regulation applies to companies that use or deploy AI tools and systems built by other vendors. If your company uses AI-powered products in the areas listed below, this regulation may apply to you.
ORS 646A.574(1)(d)(C) · ORS 646A.578(4)(h) and related sections
AI categories covered
- Consumer-facing AI
- Automated decision-making
Specific AI use cases:
- Customer profiling and segmentation
What this requires you to do
8 obligations identified from statutory analysis.
ORS 646A.576(6)
ORS 646A.578(2)(b)
ORS 646A.578(2)(c), as amended by HB 2008 (2025)
ORS 646A.574(1)(d)(C)
ORS 646A.586(1)
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.
Enforcement and penalties
Up to $7,500 per violation. Cure period expired January 1, 2026. AG no longer required to send cure notice before enforcement. Immediate enforcement now applies. No private right of action.
Penalty amounts are based on statutory text and may be subject to adjustment, judicial interpretation, or enforcement discretion.
Related regulations
- In EffectAI-Specific
Oregon Synthetic Intimate Imagery (HB 2299)
Criminal penalties for creating or distributing AI-generated nonconsensual intimate imagery in Oregon. Expands intimate-image offenses to cover realistic synthetic depictions.
Effective
- In EffectAI-Specific
Oregon Election Deepfake Disclosure (SB 1571)
Requires disclosure statement on political communications containing synthetic media in Oregon elections.
Effective
Oregon AI regulation guide lists every tracked rule for this jurisdiction with timelines and obligation tallies.
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.