Get emailed when this bill changes status, is amended, or advances.
Disclaimer: This page provides general informational summaries only and does not constitute legal advice. AI-generated content may contain errors. Always consult a qualified attorney for guidance specific to your situation.
Read full disclaimer →
Data brokers in Oregon must register with the Department of Consumer and Business Services before collecting or selling personal data. The bill is effective immediately upon passage.
If you operate as a data broker in Oregon, you must register with the state before collecting or selling personal data or face fines up to $10,000.
State
Oregon
Bill Number
HB4017
Status
Enacted
Risk Level
High
Category
Comprehensive
Last Action
Mar 4, 2022
Last Verified
May 28, 2026
Data Updated
May 28, 2026
What do these statuses mean?▼
Introduced— Filed in the legislature; not yet heard in committee
In Committee— Assigned to and being reviewed by a legislative committee
Passed— Approved by one or both chambers; awaiting further action
Signed / Enacted— Signed into law by the governor; may or may not be in effect yet
Dead / Vetoed— Vetoed, failed to pass, or session expired without action
Unknown— Status data not yet available or awaiting classification
Affected Industries
Consumer ProtectionData BrokerageTechnology
What This Means
Oregon's HB4017 mandates that data brokers register with the Department of Consumer and Business Services before engaging in the collection, sale, or licensing of personal data. This law aims to enhance consumer protection and accountability in data handling practices. Businesses that fail to comply may face significant penalties, making it crucial for data brokers to understand their obligations under this new regulation. The bill is effective immediately upon passage.
Key Provisions
Data brokers must register with the Department of Consumer and Business Services.
Prohibits collection, sale, or licensing of personal data without registration.
Specifies application form, method, and contents.
Establishes civil penalties for non-compliance.
Caps penalties at $10,000 per calendar year.
Includes exemptions from registration.
Declares an emergency, making it effective immediately upon passage.
Latest Legislative Action
In committee upon adjournment.
Roll Call Votes
H ·
House Committee Do pass with amendments and be referred to Ways and Means by prior reference. (Printed A-Eng.) ·
Feb 9, 2022
11 Yea 0 NayPassed ✓
Compliance Checklist
Register as a data broker with the Department of Consumer and Business Services Who: Data brokers operating in Oregon Penalty: Fines up to $1,000 per violation, capped at $10,000 per year
HB4017 establishes a registration requirement for data brokers operating in Oregon. Specifically, it prohibits data brokers from collecting, selling, or licensing personal data unless they have registered with the Department of Consumer and Business Services. The bill outlines the application process, including the form, method, and content required for registration. It also specifies exemptions to the registration requirement, although these are not detailed in the provided text. Non-compliance can result in civil penalties of up to $500 per violation, with a cap of $10,000 in penalties per calendar year. The bill declares an emergency, making it effective immediately upon passage.
We use cookies for analytics to understand how visitors use this site. We also use essential cookies for site functionality.
See our Privacy Policy for details.