Oregon Consumer Privacy Act: minor-protection amendments (HB 2008) ↗
HB 2008 (2025 Regular Session) amended the Oregon Consumer Privacy Act; signed by Governor Kotek in June 2025, operative 2026-01-01. No known legal challenge as of 2026-07-04.
Judgment call at breadth tier, consistent with co-sb24-041 and mt-sb297: HB 2008 is an amendment to the comprehensive Oregon Consumer Privacy Act rather than a standalone child-safety statute, but it is authored here because it adds substantive, currently-in-force minor-data-processing prohibitions that go materially beyond a generic targeted-ad opt-out (it removes consent as a defense for the entire under-16 population). The OCPA's generic (non-minor) provisions are out of scope. HB 2008 also bars the sale of precise geolocation data (within a 1,750-foot radius) for consumers of all ages; that provision is not minor-specific and is therefore noted here but not decomposed as a minor obligation. Signing date reported as June 3, 2025 by most secondary analyses (a few report June 2, 2025); recorded as 2025-06-03 pending OLIS status-page confirmation. Exact ORS section pins (ORS 646A.578 and related) and the OCPA applicability thresholds were not primary-text verified. No litigation known as of 2026-07-04.
Scope
A 'controller' under the Oregon Consumer Privacy Act (OCPA, ORS 646A.570–646A.589): a person that conducts business in Oregon or provides products or services to Oregon residents, determines the purposes and means of processing personal data, and meets the OCPA's applicability thresholds. HB 2008's minor-specific prohibitions attach where the controller has actual knowledge that, or willfully disregards whether, the consumer is under 16.
- Controller must meet the OCPA's applicability thresholds (controlling or processing the personal data of a threshold number of Oregon consumers, or a lower number while deriving a share of gross revenue from selling personal data). Exact threshold values not verified here.
- The minor-specific prohibitions are knowledge-gated: they attach only where the controller has actual knowledge that, or willfully disregards whether, the consumer is under 16.
Penalties
- Model
- Per violation
- Detail
- Enforced by the Oregon Attorney General under the OCPA (ORS 646A.570–646A.589) as an unlawful trade practice, with civil penalties of up to $7,500 per violation, plus injunctive and other relief. The OCPA's 30-day right-to-cure sunset on 2026-01-01, so no mandatory cure period applies once HB 2008 is operative.
- Enforcer
- Oregon Attorney General (exclusive)
- Private right of action
- No
Key dates
- Signed
- 2025-06-03
- Effective
- 2026-01-01
Obligations (1)
For a consumer the controller has actual knowledge is, or willfully disregards whether the consumer is, under 16 years of age, do not sell the consumer's personal data, process it for targeted advertising, or profile the consumer in furtherance of decisions that produce legal or similarly significant effects. Unlike prior OCPA law, which allowed these activities with the consumer's (or a parent's) consent, HB 2008 prohibits them outright; consent is no longer a permission.
Statute’s own ages: Applies to consumers under 16, i.e., the entire population below 16 (both under-13 and 13–15). This both raises the prior OCPA's 13–15 band up to under-16 and removes the consent exception that previously permitted these activities.
Cross-state comparisons
- similarco-sb24-041 (Colorado): Same species: minor-data-protection duties grafted onto a comprehensive state privacy act, triggered by actual knowledge or willful disregard that the consumer is a minor, restricting sale, targeted advertising, and significant-effect profiling. Oregon draws its line at under 16 and makes the prohibition absolute (no consent exception), whereas Colorado covers under-18 minors and permits the activities with age-appropriate consent.
- similarmt-sb297 (Montana): Both are minor-protection amendments to a comprehensive consumer privacy act using an actual-knowledge/willful-disregard trigger and barring sale, targeted advertising, and significant-effect profiling. Montana's SB 297 covers minors under 18 with consent thresholds and adds a heightened-risk-of-harm duty of care; Oregon's HB 2008 covers under 16, removes the consent exception entirely, and does not add a standalone duty of care.