[co-author: James O'Reilly]*
Oregon will begin to regulate the use of minors’ information and sale of users’ location data (regardless of age) with an update to its Oregon Consumer Privacy Act. These revisions will go into effect January 1, 2026. As amended, those subject to the law will not be able to profile or serve targeted advertising to anyone under 16. This includes both those the company knows are under that age, as well as those that they should know are under that age. (Currently, restriction that applies to consumers that are at least thirteen but not older than fifteen without their consent.)
As amended, the law will also prohibit sale of information of those under 16. As we previously wrote, Maryland will impose a similar prohibition, but for information of those under 18. Beginning January 2026 covered entities will also be prohibited from selling location data. Namely, data that can show, within a 1,750-foot radius, where a person or their device is or has been in the past. This includes information collected through GPS or other technologies that can track precise locations. This location restriction is for all users, not only that of minors.
*James O’Reilly is a Cybersecurity and Privacy Fellow in the firm’s Chicago office.
Putting it Into Practice: These obligations add to the patchwork approach state comprehensive laws are taking to treatment of minors and the location data. Other obligations to keep in mind include social media or online operator restrictions for minors, and potential applicability of existing laws to new practices.
