Posted in on January 2, 2026
Yes. The law requires consent to process data of children under the age of 13. As of January 1, 2026, a controller cannot sell the data of a consumer who is under 16 years of age. Also, a controller cannot... View Article
Posted in on
No. As of January 1, 2026, it is unlawful to sell a consumer’s precise geolocation (past or present location) data. This ban on the sale of location data applies to all consumers regardless of their age. See HB 2008 for... View Article
Posted in on May 13, 2025
You can maintain the necessary minimum information to honor the do not contact request, but any extraneous information should be deleted unless an OCPA exemption applies.
Posted in on
The Oregon DOJ has published guidance regarding the use of generative AI, including in the context of the OCPA. Page four of the document (linked in the press release) starts the OCPA section: DOJ Issues Guidance on AI for Oregon... View Article
Posted in on April 11, 2024
Yes, for certain types of data and under certain circumstances. Consent is required to collect, store, or otherwise process all categories of “sensitive data”, as defined in the law (see question above for more detail about this). In addition, a... View Article
Posted in on
Among other obligations, controllers must: Provide a privacy notice regarding the types of personal data the controller processes, the specific purpose(s) for processing data, whether and why the controller shares personal data with third parties, and information about how consumers... View Article
