Oregon AI Most owners we meet ask the same question before they let AI near customer information: am I breaking some law? Here is the plain-English version, using Oregon's privacy law as the worked example; most state laws follow a similar pattern. It is general information, not legal advice.
Does a state privacy law apply to you?
Probably not directly. The Act (ORS 646A.570 to 646A.589) applies to businesses that, in a calendar year, control or process personal data of 100,000 or more Oregon consumers, or 25,000 or more while getting at least 25 percent of revenue from selling personal data (ORS 646A.572). Most local shops, offices and clinics are well under that. It took effect for businesses on July 1, 2024 (Oregon DOJ).
Why it still matters
Oregon's Department of Justice published AI guidance in December 2024 (PDF). Two points apply to every business, covered by the privacy law or not:
- Misrepresenting how you use data can be an unlawful trade practice under the Unlawful Trade Practices Act.
- Using a chatbot while falsely representing that it is a human is listed as a violation. So is posting AI-generated fake reviews.
Five habits that keep you safe either way
- Disclose the AI. Your phone or chat assistant should say it is an AI assistant at the start.
- Use business accounts. Business tiers of AI tools let you turn off training on your data. Free personal accounts usually do not.
- Keep sensitive numbers out. No Social Security, card or bank numbers in AI tools.
- Get it in writing. Any vendor that handles your customers' data should sign a data-processing agreement.
- Write a one-page AI policy so staff know what is allowed.
Health-care practices: patient information falls under HIPAA instead, and every vendor touching it needs a business associate agreement. Talk to us before putting AI on your phones.