• by Wendy Davis  @wendyndavis, July 19, 2023

Oregon Governor Tina Kotek on Tuesday signed a privacy bill that gives state residents the right to opt out of ad targeting based on their online activity.

The Oregon Consumer Privacy Act (SB 619) also provides that people have the right to learn what personal data about them has been collected, and which third parties received that information. The measure's definition of personal data is broad enough to cover pseudonymous identifiers -- such as cookies -- that can be linked to consumers.

Other provisions require companies to obtain consumers' opt-in consent before processing precise location data, biometric data, and additional potentially sensitive data -- including information about race, ethnicity, religion, health condition or diagnosis, sexual orientation and immigration status.

The statute tasks the attorney general with enforcement, and doesn't empower individuals to bring private lawsuits over violations. 

Most provisions are slated to take effect in July of 2024.

Oregon is now the 12th state to enact a comprehensive privacy law, and the seventh state to do so this year.

Other states with comprehensive privacy statutes are California, Utah, Virginia, Colorado, Connecticut, Iowa, Indiana, Tennessee, Montana, Florida and Texas.

State attorney general Ellen Rosenblum championed the law, which was developed with input from a task force including Technology Association of Oregon, World Privacy Forum, Electronic Frontier Foundation, and the ACLU of Oregon.

Late last month, lawmakers in Delaware also passed a privacy bill (HB 154) that gives residents the right to opt out of targeted advertising. That measure awaits the governor's signature.