Oregon Consumer Privacy Act (SB 619) - Profiling, Children's Data, Assessments
Oregon · Oregon Consumer Privacy Act, 2023 Or. Laws (SB 619), ORS 646A.570-646A.589, eff. July 1, 2024
Oregon's consumer privacy law lets residents opt out of having their personal data used for profiling that supports decisions with legal or similarly significant effects. It adds stronger protections for data about people the business knows are under 16, and requires businesses to complete and document data protection assessments for processing that poses a heightened risk, including risky profiling. The Attorney General enforces it; there is no private lawsuit right.
Technical detail
SB 619 enacts the Oregon Consumer Privacy Act, providing an opt-out from profiling in furtherance of decisions with legal or similarly significant effects, heightened protections for consumers under 16, and mandatory data protection assessments for heightened-risk processing.
Who is protected: Oregon consumers, with added protections for those under 16.
Who must comply: Controllers and processors doing business in Oregon that meet the Act's thresholds.
Key facts
| Jurisdiction | Oregon |
|---|---|
| Level | State |
| Status | In effect |
| Protection strength | Limited protection |
| Effective date | 2024-07-01 |
| Enacted | 2023-07-18 |
| Citation | Oregon Consumer Privacy Act, 2023 Or. Laws (SB 619), ORS 646A.570-646A.589, eff. July 1, 2024 |
| Enforced by | Oregon Department of Justice / Attorney General. |
| Private right of action | No — agency enforcement only |
| Penalties | Civil penalties of up to $7,500 per violation; no private right of action. |
| Topics | consumer data privacy · automated decision-making · children's online safety |
| Last verified | 2026-06-16 |
| Official source | Oregon Legislature - Enrolled Senate Bill 619 (2023) ↗ |
More AI rules in Oregon
- Oregon SB 1546 (AI companion chatbot disclosure + private right of action) · Enacted (not yet in effect)
- Oregon HB 4084 Data Center Tax Moratorium · In effect
- Oregon POWER Act · In effect
- OR weaponized-drone ban · In effect
- Oregon SB 1571 (campaign ads must disclose AI/synthetic media) · In effect
- SB 1546 (OR Chatbot Safety) · Enacted (not yet in effect)
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for lo · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.