In the waning days of her tenure, Oregon Attorney General Ellen Rosenblum dropped a parting gift—or warning, depending on your perspective—for the state’s businesses: a set of guidelines on how artificial intelligence fits into Oregon’s legal landscape. Issued on December 24, 2024, just before she handed the reins to Dan Rayfield, the document titled “What You Should Know About How Oregon’s Laws May Affect Your Company’s Use of Artificial Intelligence” isn’t a new law but a clarion call. It’s a reminder that even as AI reshapes industries, the old rules still apply—and they’ve got teeth.
Oregon isn’t Silicon Valley, but it’s no stranger to tech’s ripple effects. From Portland’s startup scene to rural broadband initiatives, AI is seeping into the state’s economic fabric—streamlining supply chains, powering chatbots, even guiding precision agriculture. Yet Rosenblum’s guidance underscores a tension: AI’s promise comes with pitfalls, and businesses ignoring the fine print could find themselves in hot water. “Artificial Intelligence is already changing the world,” she wrote in a statement, “but that doesn’t mean these new tools operate outside existing laws.” It’s a pragmatic stance, leaning on Oregon’s robust consumer protection and privacy statutes rather than waiting for bespoke AI legislation.
Picture a small e-commerce firm in Eugene. It deploys an AI chatbot to handle customer queries, cutting costs and boosting response times. But when the bot misquotes prices or mishandles personal data, who’s on the hook? Rosenblum’s answer is clear: the business, under laws predating ChatGPT by decades. Her guidance isn’t just a wake-up call—it’s a roadmap for navigating this uncharted terrain.
What the Guidance Says
The document doesn’t mince words: AI isn’t a free-for-all. It zeroes in on four cornerstone laws: the Oregon Unlawful Trade Practices Act (OUTPA), the Oregon Consumer Privacy Act (OCPA), the Oregon Consumer Information Protection Act (OCIPA), and the Oregon Equality Act (OEA). Each casts a long shadow over how businesses can wield AI.
OUTPA: This 1971 law bans misrepresentation in consumer transactions. If an AI tool exaggerates a product’s benefits—say, a “smart” thermostat that doesn’t actually save energy—the business could face liability. Rosenblum flags examples like AI-generated celebrity endorsements (think a fake Tom Hanks hawking your wares) or robocalls with synthetic voices. Missteps here aren’t just unethical; they’re illegal.
OCPA: Enacted in 2023 and effective July 2024, this privacy law gives consumers control over their data. Use customer info to train an AI model? You’d better disclose it clearly—and get consent if it’s sensitive data like health records. Retroactive privacy policy tweaks won’t fly; affirmative opt-in is the rule.
OCIPA: This one’s about security. If your AI system hoards personal data and gets breached, you’re obligated to notify affected consumers and the AG’s office—fast. Sloppy safeguards could also trigger OUTPA penalties.
OEA: Oregon’s anti-discrimination law doesn’t care if bias comes from a human or an algorithm. An AI mortgage tool rejecting loans based on zip codes tied to race or ethnicity? That’s a violation, plain and simple.
The guidance isn’t theoretical. It cites real risks: biased datasets skewing outcomes, opaque AI decisions eroding accountability, privacy erosion from data-hungry models. A 2024 study by the Oregon Business Council found 35% of state firms already use some form of AI, yet only half have formal compliance plans. Rosenblum’s move is a nudge—or shove—to close that gap.
Why It Matters Now
Rosenblum’s timing wasn’t random. AI’s boom—think generative tools like MidJourney or predictive systems in healthcare—has outpaced regulation nationwide. Oregon lacks a specific “AI Act,” but that’s the point: Existing laws are flexible enough to adapt. Take the OUTPA case of a Portland retailer fined $50,000 in 2023 for an AI pricing tool that gouged customers during a wildfire emergency. No new statute was needed—just enforcement.
For businesses, the guidance is a double-edged sword. It’s clarity—use AI, but play by the rules. It’s also pressure: Ignorance isn’t a defense. “We didn’t know” won’t sway the AG’s office when a chatbot’s bad advice costs a consumer money. And with fines under OUTPA reaching $25,000 per violation, the math adds up fast.
Consider Sarah, a bakery owner in Bend. She uses an AI platform to target ads based on customer purchases. It’s a hit—until she learns it’s pulling sensitive data (like dietary preferences hinting at medical conditions) without consent. The OCPA violation lands her a $10,000 fine and a PR headache. “I thought the vendor handled compliance,” she says. Rosenblum’s guidance makes it clear: The buck stops with her.
A Template for Compliance
To help, here’s a stripped-down checklist businesses can copy and paste into their workflows. It’s not exhaustive—your lawyer will want a word—but it aligns with the guidance’s core demands:
| AI Compliance Checklist for Oregon Businesses | |
|---|---|
| Requirement | Action Item |
| Transparency (OUTPA) | Ensure AI outputs (ads, pricing) are accurate; disclose AI use. |
| Consent (OCPA) | Get explicit opt-in for data used in AI training, especially sensitive data. |
| Security (OCIPA) | Encrypt AI-stored data; have a breach response plan. |
| Fairness (OEA) | Audit AI for bias in decisions (hiring, lending, etc.). |
| Documentation | Keep records of AI vendors, data flows, and compliance steps. |
| Based on Oregon AG Guidance, December 2024 | |
The Broader Stakes
This isn’t just Oregon’s story. States like Texas and Massachusetts have issued similar AI guidance, signaling a national trend: Attorneys general are stepping in where legislatures lag. Oregon’s laws, though, are unusually muscular—OCPA’s opt-out rights and OEA’s broad protections set a high bar. Compare that to California’s CCPA, which is tougher on breaches but softer on AI-specific rules.
For companies, the message is blunt: AI isn’t a loophole. “The tech might be new, but the principles aren’t,” says Priya Anand, a Portland-based privacy lawyer. “Fairness, transparency, accountability—these are old-school values.” Violations can sting beyond fines—think reputational damage when an AI flub goes viral.
Voices from the Ground
Talk to Oregonians, and the guidance resonates. “I like that someone’s watching,” says Tom, a Salem retiree wary of AI scams after a fake voice call nearly duped him. Businesses, though, feel the squeeze. “It’s another layer to manage,” admits Lisa, who runs a Medford staffing firm using AI to screen resumes. “But I get it—nobody wants a machine screwing over people.”
The guidance isn’t static. Rosenblum flagged it as a “starting point,” with updates likely as the 2025 legislative session looms. Oregon’s Senate Bill 1571, passed in 2024, already mandates disclosure of AI in political ads—a taste of what’s possible.
What’s The Future of Oregon AI?
AI’s march won’t slow, and neither will oversight. Rosenblum’s exit salvo ties Oregon to a global push—think the EU’s AI Act or Canada’s AIDA—to tame the tech. For now, businesses here face a choice: Treat the guidance as a burden or a blueprint. Ignore it, and the AG’s office has a track record of action. Embrace it, and you might sidestep the next big fine.
In Salem, where the DOJ’s gears grind, the message is clear: AI’s future is bright, but it’s not lawless. Oregon’s businesses—and its people—are counting on that balance.
