Bill > HB3899

This bill modifies Oregon's consumer data privacy laws by lowering the thresholds for when businesses are subject to regulation regarding personal data processing. Specifically, the bill reduces the number of consumers' personal data a business must handle to be regulated from 100,000 to 35,000, and from 25,000 to 10,000 when deriving revenue from selling personal data. The bill introduces significant new restrictions on processing sensitive data, prohibiting businesses from using such data for targeted advertising or profiling consumers in ways that could produce legal effects, regardless of consumer consent. Furthermore, the bill completely bans the sale of sensitive data under any circumstances. The legislation requires businesses to provide clear, comprehensive privacy notices that explain their data processing practices, including explicit statements about their limitations on sensitive data usage. These changes aim to provide stronger protections for consumers' personal information, with a particular focus on protecting more vulnerable populations like children and limiting potentially invasive data processing practices. The bill applies to businesses conducting business in Oregon or providing services to Oregon residents, with numerous specific exemptions for certain types of organizations and data uses.

Business and Industry

https://olis.oregonlegislature.gov/liz/2025R1/Measures/Overview/HB3899