Compliance Radar · Privacy and consent
Oregon extends its privacy law to nonprofits, requires GPC and bans location data sales
Oregon brought nonprofits in, then required GPC and banned location data sales from 2026.
- Status
- In force
- Takes effect
- Nonprofits: July 1, 2025. GPC and HB 2008 bans: January 1, 2026, when the cure period ended.
- Announced
- Jun 2, 2025 (HB 2008); nonprofit coverage enacted 2023
- Type
- law
What changed
GPC must be honored. HB 2008 bans selling precise location data (within 1,750 feet) and selling or ad-targeting data of users known to be under 16.
Who it affects
Controllers and nonprofits with data of 100,000+ Oregon consumers (25,000+ with 25% or more of revenue from data sales).
What to do
- Nonprofits: offer donors and members the same opt-outs.
- Honor GPC for Oregon visitors.
- Stop location data sales and ads to users under 16.
What ComplyMo already handles
Page audits and daily re-checks: Growth and up. Everything else: every plan, from $19 a month.
Sources
- Oregon Legislature: HB 2008 (2025), chapter 251 (opens in a new tab)
- Davis Wright Tremaine: Oregon location and teen data (opens in a new tab)
Summary of public sources, not legal advice.