In the absence of a national data-privacy standard, some state legislatures continue to push the envelope with their own privacy laws. Such is the case with Oregon’s HB 2008, which amends the Oregon Consumer Privacy Act (in effect since January 1, 2025).

While HB 2008 makes relatively few changes to the OCPA, they are notable because they are outright prohibitions on certain types of data processing.

What’s Prohibited by HB 2008?

Under the new rules from HB 2008, businesses are prohibited from doing the following:

• Regarding the personal data of minors under the age of 16, businesses may not sell that data, use it for targeted advertising, or use it for profiling (if the profiling produces legal or similarly significant effects).
  
  • This rule applies when the business has actual knowledge or willfully disregards that a consumer is under 16.
• Businesses may not sell the precise geolocation data of any consumer, regardless of age.

Under the original version of the OCPA, these activities would be allowed with the consumer's consent. Once HB 2008 goes into effect, that will no longer be the case.

What is HB 2008’s Effective Date?

The new rules will go into effect on January 1, 2026.

Stay Current on Compliance with TrueVault

Privacy rules for business are not static; they are being updated all the time. There’s no such thing as one-and-done compliance, so businesses need a privacy solution that adapts to changes in the law.

TrueVault helps businesses of all sizes get compliant fast, and then stay that way via regular updates that incorporate the latest requirements and guidance from regulators. This includes adding in new state privacy laws as they go into effect—at no additional cost.

Contact our team today to learn how TrueVault can help your business stay up-to-date with privacy compliance.

‍