Amended law will prohibit certain data processing and sales regardless of consent
On June 2, Gov. Tina Kotek signed HB 2008 amending the Oregon Consumer Privacy Act (the Act) to increase protection both for personal data collected from consumers younger than 16 years of age and for all Oregonians' precise geolocation data. The amendment does not specify an effective date, so it will become effective January 1, 2026.
New Protections for Age 16 and Under
The amendment prohibits controllers from processing the personal data of consumers, whom the controller has actual knowledge or willfully disregards is under 16 years of age, when the processing is for the purpose of targeted advertising, selling personal data, or profiling. The Act previously allowed controllers to process the personal data of such consumers for these purposes so long as the controller first obtained the consumer's consent.
New Geolocation Protections
The amendment also prohibits controllers from selling precise geolocation data—i.e., data that "accurately identifies within a radius of 1,750 feet a consumer's present or past location, or the present or past location of a device that links or is linkable to a consumer" by means of global positioning systems and other technologies. The Act previously did not impose restrictions on sales of location data.
The ban on the sale of precise geolocation data may restrict controllers' ability to engage in location-based advertising if such advertising requires the disclosure of location data to a third party. Although the ban relates to sales of such data and not the use of such data for targeted advertising, a sale is any exchange of personal data for monetary or other valuable consideration. Therefore, any disclosure of such data to another entity for purpose of delivering location-based ads could be prohibited by the amendment.
Next Steps
Businesses that knowingly collect—or that willfully disregard that they collect—personal data from consumers under 16 years of age, or that disclose precise geolocation data, need to analyze their use and disclosure of such data and adopt appropriate policies and procedures to ensure compliance before the end of the year.
[View source.]
