Relating to consumer protection.
HB 2008 amends Oregon’s consumer privacy law, ORS 646A.578, to strengthen rules for businesses and other entities that act as “controllers” of personal data. The bill requires controllers to clearly state the specific purposes for collecting and processing personal data, limit collection to what is adequate and necessary, maintain security safeguards, and provide an effective way for consumers to revoke consent. Once consent is revoked, processing must stop as soon as practicable and no later than 15 days after the revocation is received.
The bill also tightens restrictions on how personal data may be used. It prohibits processing for purposes beyond those disclosed unless the consumer consents, bars processing sensitive data without consent except as allowed under federal child privacy law, and restricts targeted advertising, profiling with significant effects, and sale of personal data for consumers under 16. It also prohibits the sale of highly precise location data, while preserving an exception for certain utility metering data and communications content. The bill further requires controllers to provide a detailed privacy notice and to offer accessible opt-out methods, including a clear online link and support for consumer opt-out signals.
HB 2008’s impact is to expand and clarify consumer privacy protections in Oregon law, especially around consent, data minimization, targeted advertising, location data sales, and consumer opt-out rights. It amends the state’s existing privacy statute rather than creating a new framework, and it adds operational requirements for businesses that collect or share personal data, including notice, security, and response procedures for consumer requests. It also affects loyalty and rewards programs by allowing controllers to resolve conflicts between opt-out requests and voluntary program participation.
The overall sentiment around the bill appears strongly supportive and largely noncontroversial. It passed the House and Senate with unanimous committee and floor votes, indicating broad bipartisan agreement on the need for stronger consumer privacy protections. The absence of recorded opposition in the voting history suggests the bill was viewed as a measured update to existing privacy law rather than a major policy fight.
The main points of contention, based on the text, would likely center on the scope of restrictions on targeted advertising, profiling, and data sales, as well as the practical burden on businesses to implement opt-out systems, privacy notices, and consent revocation procedures. Another possible tension point is the treatment of loyalty and rewards programs, where the bill preserves those programs but requires controllers to honor consumer opt-out choices if the consumer withdraws from the program. No specific objections are reflected in the available committee materials or votes.
HB 2008 amends ORS 646A.578 within Oregon’s consumer privacy framework, imposing additional duties on data controllers and expanding limits on the collection, processing, sale, and targeted use of personal data. It affects businesses and other entities subject to Oregon privacy law, especially those engaged in targeted advertising, profiling, sale of personal data, or handling sensitive data and children’s data. The bill also strengthens consumer rights to notice, opt out, and revoke consent, and it requires controllers to maintain security safeguards and accessible request mechanisms.
The bill appears to have enjoyed broad, bipartisan support throughout the legislative process. It received unanimous committee approvals and unanimous floor votes in both chambers, with no recorded dissent in the provided voting history. That pattern suggests the measure was viewed as a straightforward consumer protection update with little public or legislative controversy.
The likely areas of debate are the practical and compliance burdens placed on controllers, especially around privacy notices, opt-out infrastructure, consent revocation deadlines, and restrictions on targeted advertising and profiling. Businesses may also have concerns about the limits on selling precise location data and the interaction between opt-out rights and loyalty or rewards programs. The bill text includes carveouts and clarifications, suggesting lawmakers sought to balance consumer privacy with existing commercial practices, but no specific opposition is shown in the available record.