HB 3899
Lowers the thresholds above which, in applicable circumstances, controllers are subject to regulation in processing consumers' personal data.
Jurisdiction
Oregon
Session
2025 Regular Session
Committee
Commerce and Consumer Protection
Take action
Record your position on this measure.
Sign in to record your position, submit testimony, or contact your legislator.
Sign in to take actionPublic sentiment
Support
82%
Oppose
18%
- Introduced
- Passed House
- Passed Senate
- To Governor
- Became Law
Bill overview
This bill changes Oregon’s laws regarding the use of consumer personal data. It lowers the thresholds at which companies are regulated for processing this data, specifically targeting those handling sensitive information. The bill prohibits the processing of sensitive data for targeted advertising or profiling that leads to legal decisions, and it prohibits the sale of sensitive data. It also strengthens consumer privacy rights.
Key provisions
- Lowers the thresholds for regulation of data controllers to 35,000 or 10,000 consumers, respectively, when deriving 20% or more of revenue from selling data.
- Prohibits the processing of sensitive data for targeted advertising or profiling that leads to legal decisions.
- Prohibits the sale of sensitive data.
- Exempts certain entities, including public corporations, protected health information under HIPAA, and information used for specific research activities.
- Requires controllers to provide a detailed privacy notice outlining data categories, purposes, and consumer rights.
- Establishes a process for consumers to opt-out of targeted advertising and data sales.
- Reinforces existing protections for consumer credit information under the Fair Credit Reporting Act.
- Updates requirements for controllers regarding safeguarding personal data and responding to consumer requests.
Who is affected
- Businesses operating in Oregon or providing services to Oregon residents
Sponsors
Official sponsors from legislative records.
Primary sponsors
Cosponsors
Arguments in favor
Reasons to support this legislation.
Supporters of the bill argue that Oregon should strengthen its consumer privacy laws to better protect residents' safety and well-being. They propose amendments to the Oregon Consumer Privacy Act (SB 619 - 2023) to expand protections for minors, prohibit the sale of precise location data, and enhance data minimization requirements. The supporters believe that current practices often result in personal information being collected and sold without clear understanding or consent, leaving consumers vulnerable to exploitation by advertisers, government entities, and foreign actors. By closing technical loopholes and banning the sale of precise geolocation information, proponents aim to give Oregonians more control over their data and safeguard sensitive personal information, particularly for minors, from being misused.
Source: Testimony Summaries
Arguments opposed
Reasons to oppose this legislation.
Opponents of HB 3899 express concerns that the bill will have unintended consequences on Oregon's non-profit media and arts community, which is already subject to existing Open Meetings Law (OCPA) requirements. They argue that the proposed changes will place an undue burden on these organizations without providing adequate resources or warning, potentially harming their ability to operate effectively. Additionally, opponents of the bill, including Oregon Business & Industry, caution that the new regulations may pose challenges for small businesses in complying with the complex requirements, which could lead to increased costs and administrative burdens.