Oregon AI Laws:
Privacy Act, Campaign Disclosure, and AG Guidance
Oregon combines strong privacy protections with targeted AI transparency requirements. Understand OCPA's profiling opt-out rights, campaign disclosure rules, and how existing laws apply to AI systems.
In this guide:
Executive Summary
Oregon's approach to AI regulation emphasizes consumer rights and transparency through existing legal frameworks. The Oregon Consumer Privacy Act (OCPA), effective July 2024, grants consumers the right to opt out of AI profiling for consequential decisions and requires data protection assessments for AI systems processing personal data.
SB 1571 (March 2024) targets election integrity by requiring disclosure when campaign materials use synthetic media, with penalties up to $10,000 per violation. Meanwhile, Attorney General Ellen Rosenblum has clarified that existing Oregon laws—including anti-discrimination, consumer protection, and privacy statutes—already apply to AI systems without need for new legislation.
Looking ahead, HB 2299 (effective January 2026) criminalizes AI-generated intimate images, while HB 2008 amendments will strengthen minor protections under OCPA.
Oregon Consumer Privacy Act (OCPA)
Passed July 2023 and effective July 1, 2024, OCPA is Oregon’s comprehensive privacy law with significant AI implications. It gives consumers control over how their data is used in profiling and automated decision-making, particularly in high-stakes contexts.
AI Profiling Opt-Out Rights
Consumers can opt out of profiling for decisions related to:
- Employment decisions
- Financial services
- Housing opportunities
- Educational opportunities
- Lending decisions
- Credit determinations
Data Protection Assessment Requirements
OCPA requires Data Protection Assessments (DPAs) before processing personal data for:
Profiling Activities
Any processing that evaluates, analyzes, or predicts personal aspects of consumers
"Heightened Risk" Activities
Processing presenting risks to consumers, explicitly including feeding data into AI models
Key point: OCPA explicitly states that feeding consumer data into AI models requires a data protection assessment, making this one of the clearest AI-specific requirements in US state privacy law.
Who Must Comply?
Coverage Thresholds
- Threshold 1: Process data of 100,000+ Oregon consumers
- Threshold 2: Process data of 25,000+ consumers AND derive 50%+ revenue from data sales
Notable Features
- No revenue threshold (unlike some states)
- AG enforcement only (no private right)
- 30-day cure period available
SB 1571: Campaign AI Disclosure
Enacted March 5, 2024, SB 1571 requires disclosure when campaign communications use synthetic media to depict a person’s voice or image. Oregon was among the first states to address AI deepfakes in political advertising.
Key Requirements
What’s Covered
- AI-generated images of real people
- AI-generated audio/voice synthesis
- AI-generated video content
- Physical fliers through online videos
Disclosure Requirement
Campaign materials must clearly disclose the use of AI to create synthetic depictions of a person's voice or image.
Definition: "Synthetic media" means digital technology creating realistic images, audio, or video of events that did not occur.
Penalties
- $10,000 maximum per violation
- Each instance of non-disclosed synthetic media can constitute a separate violation
Enforcement
- Secretary of State enforces (AG for SoS candidates)
- Can seek injunctions to stop distribution
- Any elector may file written complaint
Attorney General AI Guidance
In December 2024, Oregon Attorney General Ellen Rosenblum issued comprehensive guidance titled "What you should know about how Oregon’s laws may affect your company’s use of Artificial Intelligence." This guidance clarifies how existing Oregon laws apply to AI without requiring new legislation.
Key AG Enforcement Positions
Oregon Equality Act Application
AI systems that produce biased outcomes based on protected characteristics (race, sex, disability, etc.) violate Oregon’s anti-discrimination laws. The law applies regardless of whether bias was intentional.
Consumer Protection
Oregon’s Unlawful Trade Practices Act applies to AI-enabled deceptive practices. Companies cannot use AI to mislead consumers about products, services, or the nature of their interactions.
Accountability Concerns
The AG highlighted that AI’s unpredictability affects fairness and can obscure accountability. Organizations deploying AI must maintain human oversight and clear responsibility chains.
AG Rosenblum’s Core Message
"Existing consumer protection, privacy, and anti-discrimination laws apply to AI... No new AI-specific legislation is required for enforcement."
This means organizations using AI in Oregon should already be compliant with existing laws—the AG is prepared to enforce them against AI-related harms.
2025-2026 Changes
HB 2299
Effective January 1, 2026
AI-Generated Intimate Images
Criminalizes creating or distributing AI-generated sexually explicit images without consent.
Class A Misdemeanor: Up to 1 year jail, $6,000+ fine
HB 2008
Effective January 1, 2026
OCPA Amendments
Strengthens protections for minors under the Oregon Consumer Privacy Act.
- Profiling prohibition for consumers under 16
- Ban on selling data of minors under 16
- Ban on selling precise geolocation data
Operating AI in Oregon?
GLACIS helps organizations build auditable evidence of responsible AI deployment. Our continuous attestation platform creates verifiable records that satisfy current OCPA requirements and prepare you for emerging regulation.