Oregon’s 2025 legislative session was adjourned on June 27. The legislature was busy this session addressing certain uses of artificial intelligence, revising the Oregon Consumer Privacy Act, and passing other laws related to the use of technology. To view the full text of any 2025 bill, navigate from this page . Unless otherwise noted, all bills listed below have a January 1, 2026 effective date.

 

Artificial Intelligence (AI)

  • HB 2299 adds digitally created, manipulated, or altered depictions that are reasonably realistic to the definition of “image” for the crime of unlawful dissemination of an intimate image.
  • HB 2748 prohibits a “nonhuman entity”, including one powered by AI, from using different nursing titles, such as registered nurse (RN).

 

Oregon Consumer Privacy Act (OCPA)

 

  • The OCPA currently prohibits a “controller” (the corporate entity “in charge” of personal data) from processing a consumer’s personal data for targeted advertising, certain profiling activities, or the sale of data from consumers 13-15 years old without consent. HB 2008 amends this prohibition so that profiling is only barred for consumers under 16 years old. Additionally, it adds two prohibitions against any sale of certain data: (1) the data of a consumer under 16 years old and (2) precise geolocation data (unless for a utility). Other sensitive data can still be processed with consent.
  • As of September 26, 2025, under HB 3875, all motor vehicle manufacturers and their affiliates that obtain data from consumers’ use of vehicles or any component of a vehicle are subject to the OCPA, regardless of the law’s threshold requirements.
  • The OCPA currently provides a 30-day cure period until January 1, 2026. SB 1121 extends the 30-day cure period until June 30, 2026 for certain non-commercial educational broadcast stations.

 

Other technology-related bills

  • HB 3167 substantially beefs up the crackdown on third-party resellers of tickets for concerts, sports games, and other shows.
  • Landlords are currently required to provide working locks and keys for doors and latches for windows. HB 3378 amends ORS 90.320 to provide that landlords need to give tenants the ability to unlock doors through an app on a phone or other device along with an alternative means of access, such as an access code, fob, key card, or tangible key.
  • HB 3865 amends Oregon’s telephone solicitation law to affirmatively include text messages. It also changes the permissible hours of contact and how often contact can be made.
  • SB 167 amends the UCC. Among the amendments to the UCC is an exclusion of cryptocurrency (e.g., Bitcoin) and other digital assets from the definition of “money.” It creates a definition of “electronic money” and sets out rights and responsibilities around the use of electronic money (i.e., control over, collateral, security interest in, chattel paper, etc.). Additionally, it adds UCC Article 12 relating to controllable electronic records. SB 167 also provides that bank security procedures can include biometrics and does not include, by itself, requiring that payment be sent from a known email address, IP address, or telephone number.
  • Except for financial institutions, mortgage bankers or brokers, and broadband internet providers, companies that sell goods or services online must include all fees or charges in the advertised price, excluding taxes and fees, actual shipping charges, and a pre-disclosed service fee. Enforcement for SB 430 is added to ORS 646.608, so can be by the Attorney General or an individual plaintiff (or class action). This new law is in addition to ORS 646A.093, which requires disclosure of shipping and handling charges, which is already in addition to the general Unlawful Trade Practices Act restrictions on false advertising.
  • Separate from the modification to the cure period in the OCPA, SB 1121 also establishes the crime of unlawful disclosure of private information. Beginning on January 1, 2026, knowing disclosure of enumerated contact information, Social Security number, photographs of a person’s child or identification of the child’s school with the intent to stalk or injure a person or cause damage to the person’s property is a crime if there was no consent to the disclosure and it resulted in personal injury or property damage.

 

This blog post provides a high-level overview of bills that may be of interest to members of the Technology Law Section. It should not be considered as a comprehensive review of the Oregon legislative session or to provide legal advice on any of the topics mentioned.

 

About the Author:

 

Eva Novick is a Certified Information Privacy Professional (FIP, CIPP/US, CIPP/E, CIPM) and leads Miller Nash’s privacy and data security team. Eva advises clients on complying with U.S. and international data privacy laws and remediating and responding to data security incidents. Prior to private practice, Eva dedicated nearly two decades of her career to the Oregon Department of Justice (DOJ) and assisted with advancing the Attorney General’s consumer protection legislative agenda.