What AI requirements does the Oregon Consumer Privacy Act include?

OCPA, effective July 1, 2024, gives consumers the right to opt out of profiling for decisions related to employment, financial services, housing, education, and lending. Businesses must conduct Data Protection Assessments before processing personal data for profiling or activities presenting 'heightened risks to consumers.' Feeding consumer data into AI models explicitly requires a data protection assessment.

What is Oregon's SB 1571 campaign disclosure law?

SB 1571, enacted March 5, 2024, requires campaign materials using synthetic media (AI-generated images, audio, or video) to disclose this use. It applies to communications depicting a person's voice or image, from physical fliers to online videos. Violations can result in up to $10,000 per violation, with enforcement by the Secretary of State.

What did Oregon's Attorney General say about AI enforcement?

In December 2024, AG Ellen Rosenblum issued guidance clarifying that existing Oregon laws already apply to AI. Key points include: the Oregon Equality Act prohibits AI systems producing biased outcomes based on protected characteristics; consumer protection laws apply to AI-enabled deception; and privacy laws apply to AI data processing. No new AI-specific legislation is required for enforcement.

What is HB 2299 and when does it take effect?

HB 2299, effective January 1, 2026, criminalizes AI-generated sexually explicit images. Creating or distributing such images without consent is a Class A misdemeanor, punishable by up to 1 year in jail and $6,000+ in fines. The law specifically addresses deepfake intimate images created using artificial intelligence.

Who does OCPA apply to in Oregon?

OCPA applies to businesses that process data of 100,000+ Oregon consumers, OR businesses processing data of 25,000+ consumers if they derive 50% or more of their revenue from data sales. Unlike some other state privacy laws, OCPA does not have a revenue threshold, focusing instead on data volume and business model.

Oregon AI Laws: Privacy Act, Campaign Disclosure, and AG Guidance

GLACIS·US state AI laws·Oregon·Updated April 2026

By Joe Braidwood, CEO GLACIS·14 min read·Updated 24 April 2026

In this guide:

OCPA Profiling Rights Campaign Disclosure AG Guidance 2025-2026 Changes

SB 1546 (companion chatbots) passed by the Oregon Legislature on March 5, 2026 and signed by Governor Kotek. Effective January 1, 2027. Companion-chatbot operators must implement protective measures for minors; private right of action available for affected users — the only one of the spring 2026 chatbot laws (Oregon, Washington, California) with a PRA.^[OR1]

The OCPA profiling opt-out is the workhorse for non-frontier AI deployment in Oregon. Effective since July 1, 2024 (and for non-profits since July 1, 2025), it gives consumers the right to opt out of profiling for legal or similarly significant decisions, with a data protection assessment requirement for higher-risk processing.

Attorney General DOJ guidance on AI under existing Oregon law remains operative. The position: anti-discrimination, consumer-protection, and privacy statutes already reach AI use; new comprehensive AI legislation is not required. Federal preemption push has not changed Oregon’s posture.

Executive summary

Oregon’s approach to AI regulation emphasizes consumer rights and transparency through existing legal frameworks. The Oregon Consumer Privacy Act (OCPA), effective July 2024, grants consumers the right to opt out of AI profiling for consequential decisions and requires data protection assessments for AI systems processing personal data.

SB 1571 (March 2024) targets election integrity by requiring disclosure when campaign materials use synthetic media, with penalties up to $10,000 per violation. Meanwhile, Attorney General Ellen Rosenblum has clarified that existing Oregon laws—including anti-discrimination, consumer protection, and privacy statutes—already apply to AI systems without need for new legislation.

Looking ahead, HB 2299 (effective January 2026) criminalizes AI-generated intimate images, while HB 2008 amendments will strengthen minor protections under OCPA.

Oregon Consumer Privacy Act (OCPA)

Passed July 2023 and effective July 1, 2024, OCPA is Oregon’s comprehensive privacy law with significant AI implications. It gives consumers control over how their data is used in profiling and automated decision-making, particularly in high-stakes contexts.

AI Profiling Opt-Out Rights

Consumers can opt out of profiling for decisions related to:

Employment decisions
Financial services
Housing opportunities

Educational opportunities
Lending decisions
Credit determinations

Data Protection Assessment Requirements

OCPA requires Data Protection Assessments (DPAs) before processing personal data for:

Profiling Activities

Any processing that evaluates, analyzes, or predicts personal aspects of consumers

"Heightened Risk" Activities

Processing presenting risks to consumers, explicitly including feeding data into AI models

Key point: OCPA explicitly states that feeding consumer data into AI models requires a data protection assessment, making this one of the clearest AI-specific requirements in US state privacy law.

Who Must Comply?

Coverage Thresholds

Threshold 1: Process data of 100,000+ Oregon consumers
Threshold 2: Process data of 25,000+ consumers AND derive 50%+ revenue from data sales

Notable Features

No revenue threshold (unlike some states)
AG enforcement only (no private right)
30-day cure period available

SB 1571: Campaign AI Disclosure

Enacted March 5, 2024, SB 1571 requires disclosure when campaign communications use synthetic media to depict a person’s voice or image. Oregon was among the first states to address AI deepfakes in political advertising.

Key Requirements

What’s Covered

AI-generated images of real people
AI-generated audio/voice synthesis
AI-generated video content
Physical fliers through online videos

Disclosure Requirement

Campaign materials must clearly disclose the use of AI to create synthetic depictions of a person’s voice or image.

Definition: "Synthetic media" means digital technology creating realistic images, audio, or video of events that did not occur.

Penalties

$10,000 maximum per violation
Each instance of non-disclosed synthetic media can constitute a separate violation

Enforcement

Secretary of State enforces (AG for SoS candidates)
Can seek injunctions to stop distribution
Any elector may file written complaint

Attorney General AI Guidance

In December 2024, Oregon Attorney General Ellen Rosenblum issued comprehensive guidance titled "What you should know about how Oregon’s laws may affect your company’s use of Artificial Intelligence." This guidance clarifies how existing Oregon laws apply to AI without requiring new legislation.

Key AG Enforcement Positions

Oregon Equality Act Application

AI systems that produce biased outcomes based on protected characteristics (race, sex, disability, etc.) violate Oregon’s anti-discrimination laws. The law applies regardless of whether bias was intentional.

Consumer Protection

Oregon’s Unlawful Trade Practices Act applies to AI-enabled deceptive practices. Companies cannot use AI to mislead consumers about products, services, or the nature of their interactions.

Accountability Concerns

The AG highlighted that AI’s unpredictability affects fairness and can obscure accountability. Organizations deploying AI must maintain human oversight and clear responsibility chains.

AG Rosenblum’s Core Message

"Existing consumer protection, privacy, and anti-discrimination laws apply to AI... No new AI-specific legislation is required for enforcement."

This means organizations using AI in Oregon should already be compliant with existing laws—the AG is prepared to enforce them against AI-related harms.

2025-2026 Changes

HB 2299

Effective January 1, 2026

AI-Generated Intimate Images

Criminalizes creating or distributing AI-generated sexually explicit images without consent.

Class A Misdemeanor: Up to 1 year jail, $6,000+ fine

HB 2008