• by Wendy Davis  @wendyndavis, June 26, 2023

Lawmakers in Oregon passed a privacy bill that, if enacted, will give state residents the right to opt out of ad targeting based on their online activity.

The Oregon Consumer Privacy Act (SB 619), which moved forward late last week and now awaits the governor's signature, also gives consumers the right to learn what personal data about them has been collected, and which third parties received that information.

The measure's definition of personal data is broad enough to cover pseudonymous identifiers -- such as cookies -- that can be linked to consumers.

The bill also requires companies to obtain consumers' opt-in consent before processing a host of potentially sensitive data -- including information about race, ethnicity, religion, health condition or diagnosis, sexual orientation and immigration status.

Companies also must obtain opt-in consent before processing precise location data and biometric data.

The measure tasks the attorney general with enforcement, and doesn't authorize residents to sue over violations.

If signed by Governor Tina Kotek, Oregon will become the 12th state with a comprehensive privacy law, and the 7th state to enact a comprehensive data law this year.

Other states with comprehensive privacy statutes are California, Utah, Virginia, Colorado, Connecticut, Iowa, Indiana, Tennessee, Montana, Florida and Texas.

The bill was championed by state attorney general Ellen Rosenblum, who in 2019 convened a privacy task force to develop legislation.

The task force grew to include 150 participants, including the Technology Association of Oregon, World Privacy Forum, Electronic Frontier Foundation, and the ACLU of Oregon.

If enacted, most provisions will take effect next July.