The Oregon Department of Justice (DOJ) recently issued significant guidance detailing how the state's existing legal framework will regulate artificial intelligence, eschewing the need for immediate AI-specific legislation. This guidance maps out how four key existing state laws will apply to AI development and deployment.
The Unlawful Trade Practices Act (UTPA) will be a primary enforcement mechanism for AI-related consumer protection. The guidance provides that AI's complexity provides no exemption from UTPA compliance. Companies may violate the UTPA through various AI-related activities, including: failing to disclose known material defects in AI products; misrepresenting AI system capabilities or falsely presenting AI as human; using AI to generate fake product reviews or celebrity endorsements; employing AI for deceptive pricing schemes; using AI-generated voices in misleading robocalls; or deploying AI in unconscionable sales tactics. One specific instance called out by the guidance is a prohibition against using AI to set unconscionably excessive sales prices during an emergency, which would violate Oregon’s anti-gouging law. Importantly, these violations can arise even when misrepresentations are not made directly to consumers, potentially creating liability to downstream users.
The Oregon Consumer Privacy Act (OCPA) provides another crucial framework for AI regulation, particularly regarding training data for generative AI systems. The guidance details specific OCPA requirements for AI applications, including: mandatory disclosure of personal data collection used in AI training; explicit consent requirements for using sensitive personal data; prohibition on retroactive privacy notice alterations to legitimize data use; and a 15-day deadline for ceasing data processing after consent withdrawal. Notably, the OCPA requires companies to offer consumers the ability to opt out of AI-driven profiling in decisions with significant impacts, such as housing or lending. The Act also mandates Data Protection Assessments before processing personal data for profiling or other high-risk activities.
The Oregon Consumer Information Protection Act adds another layer of requirements for AI developers and users who handle personal information. The guidance clarifies that companies must implement appropriate safeguards for personal data used in AI systems and must notify both consumers and the Attorney General in the event of security breaches. Violations of this Act are enforceable under the UTPA, creating an interconnected enforcement framework.
The Oregon Equality Act rounds out the regulatory framework by addressing potential discrimination in AI applications. The guidance explicitly warns that AI systems producing biased outcomes based on protected characteristics like race, color, religion, sex, sexual orientation, gender identity, national origin, marital status, age or disability may violate the Act. This is particularly relevant for automated decision-making systems in housing, lending and other crucial sectors where historical biases in training data could lead to discriminatory outcomes.
While the guidance acknowledges that the 2025 legislative session may consider AI-specific legislation, it emphasizes that companies cannot treat AI as an unregulated space in the interim. The DOJ's approach suggests that enforcement actions will proceed under these existing frameworks rather than waiting for new regulations. This effectively requires immediate integration of AI compliance into existing regulatory compliance programs.
