Title 50, Trade Regulations and Practices

(1) An antique or vintage crib that is clearly not intended for use by an infant is exempt from the provisions of ORS 646A.500 to 646A.514 if the antique or vintage crib is accompanied at the time of remanufacturing, retrofitting, selling, leasing, subletting or otherwise placing…

Any person may maintain an action against a commercial user who violates ORS 646A.506 (1) to (3), to enjoin the remanufacture, retrofitting, sale, contract to sell or resell, lease or subletting of a crib that is unsafe for an infant, and for reasonable attorney fees and costs. […

Remedies available under ORS 646A.508 and 646A.512 are in addition to any other remedies available under law to an aggrieved party. [Formerly 646.507] CHILDREN’S PRODUCTS

As used in ORS 646A.525 to 646A.535: (1)(a) “Children’s product” means a consumer product that is designed or intended: (A) For the care of or use by a child under 12 years of age; or (B) To come into contact with a child under 12 years of age at the time the product is used. (b)…

(1) A retailer may not sell or offer for sale, lease, sublet or otherwise distribute a children’s product to consumers in this state if the children’s product is: (a) Subject to a recall notice issued by or in cooperation with the United States Consumer Product Safety Commission …

The Attorney General shall assist retailers in obtaining information the retailers may need to subscribe to or arrange to receive recall notices issued by the United States Consumer Product Safety Commission for children’s products. The assistance shall include, but is not limite…

(1) As used in ORS 646A.540 to 646A.544: (a) “Covered entity” means: (A) The manufacturer of a covered product that is sold or offered for sale in this state; and (B) A wholesaler, supplier or retailer that has contractually undertaken responsibility to a manufacturer for labelin…

Within 90 days after receiving a request from a city, county or special district that provides wastewater service, a covered entity shall submit to the city, county or special district business information and documentation that is not confidential and that demonstrates complianc…

(1) A city, county or special district that provides wastewater service has exclusive and concurrent authority to enforce compliance with the requirements of ORS 646A.540. Selling, or displaying for sale, a product package that does not comply with the requirements of ORS 646A.54…

ORS 646A.555 may be cited as the Oregon Young Entrepreneurs Act. [2009 c.276 §1]

(1) Except as provided in subsection (2) of this section and notwithstanding any other provision of law, the State of Oregon, a political subdivision of the state or an agency of the state or of a political subdivision of the state may not require an individual under 17 years of …

As used in ORS 646A.570 to 646A.589: (1) “Affiliate” means a person that, directly or indirectly through one or more intermediaries, controls, is controlled by or is under common control with another person such that: (a) The person owns or has the power to vote more than 50 perc…

(1)(a) ORS 646A.570 to 646A.589 apply to any person that conducts business in this state, or that provides products or services to residents of this state, and that during a calendar year, controls or processes: (A) The personal data of 100,000 or more consumers, other than perso…

(1) Subject to ORS 646A.576, a consumer may: (a) Obtain from a controller: (A) Confirmation as to whether the controller is processing or has processed the consumer’s personal data and the categories of personal data the controller is processing or has processed; (B) At the contr…

(1) A consumer may exercise the rights described in ORS 646A.574 by submitting a request to a controller using the method that the controller specifies in the privacy notice described in ORS 646A.578. (2) A controller may not require a consumer to create an account for the purpos…

(1) A controller shall: (a) Specify in the privacy notice described in subsection (4) of this section the express purposes for which the controller is collecting and processing personal data; (b) Limit the controller’s collection of personal data to only the personal data that is…

(1) A processor shall adhere to a controller’s instructions and shall assist the controller in meeting the controller’s obligations under ORS 646A.570 to 646A.589. In assisting the controller, the processor must: (a) Enable the controller to respond to requests from consumers und…

(1)(a) A controller that possesses deidentified data shall: (A) Take reasonable measures to ensure that the deidentified data cannot be associated with an individual; (B) Publicly commit to maintaining and using deidentified data without attempting to reidentify the deidentified …

(1)(a) A controller shall conduct and document a data protection assessment for each of the controller’s processing activities that presents a heightened risk of harm to a consumer. (b) Processing activities that present a heightened risk of harm to a consumer include: (A) Proces…

(1)(a) The Attorney General may serve an investigative demand upon any person that possesses, controls or has custody of any information, document or other material that the Attorney General determines is relevant to an investigation of a violation of ORS 646A.570 to 646A.589 or …

(1) As used in this section: (a) “Brokered personal data” means any of the following computerized data elements about a resident individual, if categorized or organized for sale or licensing to another person: (A) The resident individual’s name or the name of a member of the resi…

ORS 646A.600 to 646A.628 shall be known as the Oregon Consumer Information Protection Act. [2007 c.759 §1; 2019 c.180 §1]

As used in ORS 646A.600 to 646A.628: (1)(a) “Breach of security” means an unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information that a person maintains or possesses. (b) “Breach of security” do…

(1) If a covered entity is subject to a breach of security or receives notice of a breach of security from a vendor, the covered entity shall give notice of the breach of security to: (a) The consumer to whom the personal information pertains. (b) The Attorney General, either in …

(1) A consumer may elect to place a security freeze on the consumer’s consumer report or, if the consumer is a representative, on a protected consumer’s consumer report or protective record by sending a written request to a consumer reporting agency at an address the agency desig…

(1)(a) A consumer reporting agency shall place a security freeze on a consumer report not later than five business days after receiving from a consumer: (A) The request described in ORS 646A.606 (1); and (B) Proper identification. (b) If a consumer report does not exist for a pro…

A consumer reporting agency may not charge a consumer a fee or collect from a consumer any money or item of value for: (1) Placing, temporarily lifting or removing a security freeze on the consumer’s consumer report. (2) Creating or deleting a protective record. (3) Placing or re…

(1)(a) A consumer reporting agency shall temporarily lift or remove a security freeze placed on a consumer report only if a consumer requests that the consumer reporting agency lift or remove the security freeze for the consumer report in accordance with ORS 646A.608. (b) A consu…

(1) The provisions of ORS 646A.606 to 646A.610 do not apply to the use of a consumer report or a protective record by or for any of the following: (a) A person, or the person’s subsidiary, affiliate, agent or assignee with which the consumer or protected consumer has or, prior to…

If a third party requests access to a consumer report on which a security freeze is in effect, the request is in connection with an application for credit or any other use, the consumer does not allow the consumer’s consumer report to be accessed for that period of time, and the …

(1) If a security freeze is in place, a consumer reporting agency shall not change any of the following official information in a consumer credit report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer’…

(1) Except as otherwise specifically provided by law, a person may not: (a) Print a consumer’s Social Security number on mail to the consumer that is: (A) Material the consumer did not request; or (B) Part of any documentation the consumer requested for a transaction or service, …

(1) A covered entity and a vendor shall develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of personal information, including safeguards that protect the personal information when the covered entity or vendor disposes of t…

(1) The Director of the Department of Consumer and Business Services may: (a) Make such public or private investigations within or outside this state as the director deems necessary to determine whether a person has violated any provision of ORS 646A.600 to 646A.628, or to aid in…

In accordance with ORS chapter 183, the Director of the Department of Consumer and Business Services may adopt rules for the purpose of carrying out the provisions of ORS 646A.600 to 646A.628. [2007 c.759 §14]

Notwithstanding ORS 705.145 (2), (3) and (5), the Director of the Department of Consumer and Business Services can allocate as deemed appropriate the moneys derived pursuant to ORS 86A.095 to 86A.198, 86A.990, 86A.992, 650.005 to 650.100, 697.005 to 697.095, 697.602 to 697.842, 7…

As used in ORS 646A.640 to 646A.673: (1) “Applicant” means a person that applies for a license to engage in business as a debt buyer in this state. (2) “Controller” means: (a) A director, officer or general partner of a business entity; (b) A managing member of a limited liabilit…

(1) Except as provided in subsection (2) of this section, a person may not engage in debt buying in this state unless the person obtains or renews a license under ORS 646A.646. (2)(a) A person need not obtain or renew a license under subsection (1) of this section if the person i…

(1)(a) A person that is subject to the requirement to obtain or renew a license under ORS 646A.643 (1) shall submit an application to the Director of the Department of Consumer and Business Services in the manner the director specifies by rule. The director by rule shall specify …

(1) A licensee shall designate and maintain a principal place of business at or from which the licensee engages in debt buying in this state and a registered agent in this state. (2)(a) If a licensee does not maintain a principal place of business in this state, the licensee shal…

(1)(a) A licensee shall notify the Director of the Department of Consumer and Business Services in writing at least 30 days before the licensee relocates or closes the licensee’s principal place of business in this state. (b) In a notice under paragraph (a) of this subsection the…

A licensee or a person that engages in debt buying shall comply with standards that the Director of the Department of Consumer and Business Services adopts by rule. The standards, at a minimum, must require the licensee or the person to: (1) Establish appropriate training program…

A licensee or a person that engages in debt buying may not: (1) Perform any act, undertake any practice or employ any device, scheme or artifice in the course of the licensee’s or the person’s business that the Director of the Department of Consumer and Business Services defines …

(1) The Director of the Department of Consumer and Business Services has general supervisory authority and control over: (a) Any person that engages in debt buying in this state; and (b) Any person that had a license that the director withdrew, canceled, suspended, conditioned or…

(1) If after conducting an investigation, initiating or conducting a proceeding or taking an enforcement action under ORS 646A.661 the Director of the Department of Consumer and Business Services determines that a licensee or a person that engages in debt buying in this state has…

(1) Except as provided in subsection (2) of this section, the provisions of ORS 646A.640 to 646A.673 and 646A.670 preempt all charter and statutory authority of local governments in this state to require a debt buyer or a person that engages in debt buying to obtain a license, re…

(1) A debt buyer that brings legal action to collect or brings legal action to attempt to collect purchased debt, or a debt collector that brings legal action on the debt buyer’s behalf, shall include in an initial pleading that begins the legal action: (a) The original creditor’…

The Director of the Department of Consumer and Business Services may adopt rules to implement the provisions of ORS 646.639 (4), 646A.640 to 646A.673 and 646A.670. [2017 c.625 §13] (Medical Debt)

(1) As used in this section: (a) “Consumer report” has the meaning given that term in 15 U.S.C. 1681a, as in effect on January 1, 2026. (b) “Consumer reporting agency” has the meaning given that term in 15 U.S.C. 1681a, as in effect on January 1, 2026. (c) “Debt collector” has th…

The legislative intent of ORS 646A.683 is to improve public health and safety by taking steps to address the spiraling health care costs for residents of this state. [2019 c.436 §1]