GLACIS·US state AI laws·Oregon·Updated April 2026
Oregon AI laws, the working playbook for April 2026.
The Oregon Consumer Privacy Act’s profiling opt-out is the operating mechanism. SB 1571 covers campaign deepfakes. The 2026 session added SB 1546 on companion chatbots with a private right of action. The Attorney General’s 2024 guidance still sets the tone: existing laws apply.
In this guide:
SB 1546 (companion chatbots) passed by the Oregon Legislature on March 5, 2026 and signed by Governor Kotek. Effective January 1, 2027. Companion-chatbot operators must implement protective measures for minors; private right of action available for affected users — the only one of the spring 2026 chatbot laws (Oregon, Washington, California) with a PRA.[OR1]
The OCPA profiling opt-out is the workhorse for non-frontier AI deployment in Oregon. Effective since July 1, 2024 (and for non-profits since July 1, 2025), it gives consumers the right to opt out of profiling for legal or similarly significant decisions, with a data protection assessment requirement for higher-risk processing.
Attorney General DOJ guidance on AI under existing Oregon law remains operative. The position: anti-discrimination, consumer-protection, and privacy statutes already reach AI use; new comprehensive AI legislation is not required. Federal preemption push has not changed Oregon’s posture.
Executive summary
Oregon’s approach to AI regulation emphasizes consumer rights and transparency through existing legal frameworks. The Oregon Consumer Privacy Act (OCPA), effective July 2024, grants consumers the right to opt out of AI profiling for consequential decisions and requires data protection assessments for AI systems processing personal data.
SB 1571 (March 2024) targets election integrity by requiring disclosure when campaign materials use synthetic media, with penalties up to $10,000 per violation. Meanwhile, Attorney General Ellen Rosenblum has clarified that existing Oregon laws—including anti-discrimination, consumer protection, and privacy statutes—already apply to AI systems without need for new legislation.
Looking ahead, HB 2299 (effective January 2026) criminalizes AI-generated intimate images, while HB 2008 amendments will strengthen minor protections under OCPA.
Oregon Consumer Privacy Act (OCPA)
Passed July 2023 and effective July 1, 2024, OCPA is Oregon’s comprehensive privacy law with significant AI implications. It gives consumers control over how their data is used in profiling and automated decision-making, particularly in high-stakes contexts.
AI Profiling Opt-Out Rights
Consumers can opt out of profiling for decisions related to:
- Employment decisions
- Financial services
- Housing opportunities
- Educational opportunities
- Lending decisions
- Credit determinations
Data Protection Assessment Requirements
OCPA requires Data Protection Assessments (DPAs) before processing personal data for:
Profiling Activities
Any processing that evaluates, analyzes, or predicts personal aspects of consumers
"Heightened Risk" Activities
Processing presenting risks to consumers, explicitly including feeding data into AI models
Key point: OCPA explicitly states that feeding consumer data into AI models requires a data protection assessment, making this one of the clearest AI-specific requirements in US state privacy law.
Who Must Comply?
Coverage Thresholds
- Threshold 1: Process data of 100,000+ Oregon consumers
- Threshold 2: Process data of 25,000+ consumers AND derive 50%+ revenue from data sales
Notable Features
- No revenue threshold (unlike some states)
- AG enforcement only (no private right)
- 30-day cure period available
SB 1571: Campaign AI Disclosure
Enacted March 5, 2024, SB 1571 requires disclosure when campaign communications use synthetic media to depict a person’s voice or image. Oregon was among the first states to address AI deepfakes in political advertising.
Key Requirements
What’s Covered
- AI-generated images of real people
- AI-generated audio/voice synthesis
- AI-generated video content
- Physical fliers through online videos
Disclosure Requirement
Campaign materials must clearly disclose the use of AI to create synthetic depictions of a person’s voice or image.
Definition: "Synthetic media" means digital technology creating realistic images, audio, or video of events that did not occur.
Penalties
- $10,000 maximum per violation
- Each instance of non-disclosed synthetic media can constitute a separate violation
Enforcement
- Secretary of State enforces (AG for SoS candidates)
- Can seek injunctions to stop distribution
- Any elector may file written complaint
Attorney General AI Guidance
In December 2024, Oregon Attorney General Ellen Rosenblum issued comprehensive guidance titled "What you should know about how Oregon’s laws may affect your company’s use of Artificial Intelligence." This guidance clarifies how existing Oregon laws apply to AI without requiring new legislation.
Key AG Enforcement Positions
Oregon Equality Act Application
AI systems that produce biased outcomes based on protected characteristics (race, sex, disability, etc.) violate Oregon’s anti-discrimination laws. The law applies regardless of whether bias was intentional.
Consumer Protection
Oregon’s Unlawful Trade Practices Act applies to AI-enabled deceptive practices. Companies cannot use AI to mislead consumers about products, services, or the nature of their interactions.
Accountability Concerns
The AG highlighted that AI’s unpredictability affects fairness and can obscure accountability. Organizations deploying AI must maintain human oversight and clear responsibility chains.
AG Rosenblum’s Core Message
"Existing consumer protection, privacy, and anti-discrimination laws apply to AI... No new AI-specific legislation is required for enforcement."
This means organizations using AI in Oregon should already be compliant with existing laws—the AG is prepared to enforce them against AI-related harms.
2025-2026 Changes
HB 2299
Effective January 1, 2026
AI-Generated Intimate Images
Criminalizes creating or distributing AI-generated sexually explicit images without consent.
Class A Misdemeanor: Up to 1 year jail, $6,000+ fine
HB 2008
Effective January 1, 2026
OCPA Amendments
Strengthens protections for minors under the Oregon Consumer Privacy Act.
- Profiling prohibition for consumers under 16
- Ban on selling data of minors under 16
- Ban on selling precise geolocation data
References
- [OR1] Troutman Pepper Locke, “Oregon Legislature Passes Bill Regulating Consumer-Facing Interactive AI With Private Right of Action” (Mar 2026); IAPP, “State of the states: Maine comprehensive privacy, Oregon AI chatbot bills on the move”; Mayer Brown, “Oregon and Washington Join California in Enacting Companion Chatbot Laws” (Apr 2026).
Operating AI in Oregon?
Ready to make the receipts? See what GLACIS can attest in 5 minutes.
Auditable evidence for OCPA profiling-opt-out compliance, SB 1546 chatbot duties of care, and SB 1571 campaign-disclosure attestations. The kind of attestation an Oregon DOJ inquiry would expect.
Talk to us State AI laws overview →