State Children's Privacy Law Tracker / Oregon
Oregon Children's Privacy Laws (2026)
2 laws & bills tracked · overall: In force · current as of July 18, 2026
Oregon has 2 tracked children's privacy laws and bills, each listed below with its status, the ages it covers, litigation posture, and a link to the official primary source. For the interactive view, open Oregon in the tracker map.
Oregon Consumer Privacy Act (OCPA): minors' provisions · SB 619 (2023), as amended by HB 2008 (2025)
In force: Effective and enforceable today. · Privacy law (minors) · effective 2024-07-01 · binds operators
Ages: Children under 13 (per COPPA); minors under 16
Requires: A controller must process the sensitive data of a consumer it knows is under 13 in accordance with COPPA (15 U.S.C. 6501 et seq.), which requires verifiable parental consent. As amended by HB 2008 effective January 1, 2026, a controller that has actual knowledge of, or willfully disregards, that a consumer is under 16 may not process that consumer's personal data for targeted advertising or profiling, and may not sell that consumer's personal data; and, unlike the prior 13-15 rule, consent no longer cures the prohibition.
Primary sourceEntry last reviewed
Artificial intelligence companions (SB 1546) · SB 1546 (Oregon Laws 2026 ch. 85)
Enacted, not yet effective: Signed into law; its effective date is still in the future. · AI companion · effective 2027-01-01 · binds operators
Ages: All users; the break reminder and related duties trigger where the operator knows or has reason to believe the user is a minor under 18
Requires: Operators of AI companions must run an evidence-based protocol for detecting suicidal ideation or self-harm that refers users to 9-8-8, or to a youth line for users identified as under 25, publish that protocol on their website, and report annually by December 31 on referral counts and protocol details. Where the operator knows or has reason to believe the user is a minor, it must give a clear and conspicuous reminder at least every three hours of interaction that the user should take a break and that they are interacting with artificially generated output. Unlike the other 2026 companion-AI statutes, Oregon creates an express private right of action: an individual suffering an ascertainable loss or injury in fact may recover the greater of actual damages or $1,000 statutory damages per violation, plus an injunction, with attorney fees and costs available to a prevailing plaintiff, and the remedy is non-exclusive.
Litigation: None. Not challenged.
Primary sourceEntry last reviewed
Regardless of state law, COPPA governs personal information collected from children under 13: notice, verifiable parental consent, data minimization, and (under the 2025 amended Rule) limits on retention and third-party sharing.
SourceHow Oregon compares
- AI companion: Oregon is one of 13 states tracking ai companion legislation: California, Hawaii, New York, Colorado, Connecticut, Georgia and 6 more
- Privacy law (minors): Oregon is one of 24 states tracking privacy law (minors) legislation: Arkansas, California, Connecticut, Delaware, Florida, Indiana and 17 more
Not legal advice. I build products for a living; I'm not a lawyer. Compiled from primary sources and reviewed monthly as part of the State Children's Privacy Law Tracker; AI-assisted research, verified against each law's official source, but laws and injunctions change fast, so confirm the latest before relying on it. Related: COPPA's Gray Areas.
Cite this page: Calvo, Isaac A. "Oregon: Children's Privacy Laws." isaaccalvo.com/child-privacy-laws/oregon (data as of 2026-07-18).