Oregon Children’s Privacy Laws (2026)

SB 619 (2023), as amended by HB 2008 (2025)

In force · Privacy law (minors) · effective 2024-07-01 · binds operators

Ages: Children under 13 (per COPPA); minors under 16

Requires: A controller that knows a consumer is a child (under 13) must process that child's sensitive data, which includes all of a child's personal data, in accordance with COPPA (15 U.S.C. 6501 et seq.), which requires verifiable parental consent. As amended by HB 2008 effective January 1, 2026, a controller that has actual knowledge that, or willfully disregards whether, a consumer is under 16 may not process that consumer's personal data for targeted advertising or for profiling in furtherance of decisions that produce legal or similarly significant effects, and may not sell that consumer's personal data; unlike the prior 13-15 rule, consent no longer cures the prohibition. HB 2008 also bars any controller from selling personal data that accurately identifies a consumer's present or past location within a radius of 1,750 feet, a sale ban that covers every consumer, not only minors.

Entry last reviewed 2026-10-01

SB 1546 (Oregon Laws 2026 ch. 85)

Enacted, not yet effective · AI companion · effective 2027-01-01 · binds operators

Ages: All users; the break reminder and related duties trigger where the operator knows or has reason to believe the user is a minor under 18

AI chatbot access for minors: Safeguards only (enacted, applies from 2027-01-01).

Requires: Operators of AI companions must give a clear and conspicuous notice that the user is interacting with artificially generated output whenever a reasonable person would believe they were talking to a human, and may not give users access without a protocol that uses evidence-based methods to detect suicidal or self-harm ideation, prevents content that encourages suicide or self-harm, and refers users to 9-8-8 (a youth line may be offered instead to users identified as under 25); the protocol must be published on the operator's website, and a report of referral counts and protocol details posted publicly by December 31 each year. Where the operator knows or has reason to believe a user is a minor, it must disclose that output is artificially generated, remind the user at least every three hours to take a break, and take reasonable measures to stop the companion claiming to be sentient or human, simulating emotional dependence or romantic interest, making sexual innuendo, role-playing adult-minor romance, producing visual depictions of sexually explicit conduct or suggesting the minor engage in sexually explicit conduct, using rewards to maximize engagement, sending guilt, loneliness or abandonment messages when the minor tries to leave, cut back or delete the account, or misrepresenting its identity, capabilities or training data. Oregon creates an express private right of action: an individual suffering an ascertainable loss or injury in fact may recover the greater of actual damages or $1,000 statutory damages per violation, plus an injunction, with attorney fees and costs available to a prevailing plaintiff, and the remedy is non-exclusive.

Litigation: None. Not challenged.

Entry last reviewed 2026-10-01