Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

OR HB3899: Relating to requirements that apply to persons that process consumer personal data.

Dead/Failed Oregon · 2025 session

Last verified Oct 10, 2026 · official bill text

HB3899 · where it stands

This bill did not become law (dead/failed) · last action Jun 27, 2025.

What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Oregon's HB 3899 (2025) would have amended the Oregon Consumer Privacy Act. It would have lowered the applicability thresholds in ORS 646A.572 from 100,000 to 35,000 consumers, and from 25,000 consumers with 25 percent of gross revenue from selling personal data to 10,000 consumers with 20 percent. It would have barred controllers from selling sensitive data for any reason and from processing sensitive data for targeted advertising or for profiling a consumer, and required processing to stop no later than 15 days after a consumer revokes consent. It remained in the House Committee on Commerce and Consumer Protection when the 2025 session adjourned on June 27, 2025.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

No duties for businesses because the bill died. Had it passed, smaller controllers of Oregon consumers' data would have been covered, and controllers could not have sold sensitive data or used it for targeted ads or profiling.

Key provisions

  1. Lowers ORS 646A.572 thresholds: 35,000 or more consumers (was 100,000); or 10,000 or more consumers (was 25,000) while deriving 20 percent (was 25 percent) or more of gross revenue from selling personal data
  2. Controllers may not sell sensitive data for any reason, with or without a consumer's consent (ORS 646A.578(2)(e))
  3. Controllers may not process sensitive data for targeted advertising or for profiling a consumer (ORS 646A.578(2)(d))
  4. After a consumer revokes consent, processing must stop as soon as practicable and no later than 15 days after the revocation (ORS 646A.578(1)(d))
  5. Referred to House Commerce and Consumer Protection March 4, 2025; public hearing March 18, 2025; in committee upon adjournment June 27, 2025

Latest legislative action

Jun 27, 2025. In committee upon adjournment.

Sponsors (showing 5 of 19)

NameRoleDistrict
D Sponsor SD-027
D Sponsor HD-039
D Sponsor SD-013
D Sponsor HD-028
D Sponsor HD-010

Amendments (1)

  • House Committee On Commerce and Consumer Protection Amendment #-6 Not adopted 2025-04-03

Topics and industries

Affected industries

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error