Oregon Student Information Protection Act
OSIPA
Students · Children · Data security
Oregon's K-12 edtech privacy law, modeled on California's SOPIPA. It bars operators of school-purpose sites and apps from targeted advertising, building student profiles for non-school purposes, selling student information, and most disclosures, and requires reasonable security and deletion at a school's request.
- Where
- Oregon
- Citation
- ORS 336.184; 646.607(11)
- Status
- In force
- In force since
- 2016-07-01
- Enforced by
- Oregon Attorney General (unlawful trade practice under ORS 646.607(11))
- People can sue
- No
- Penalties
- Unlawful trade practice under ORS 646.607: injunction and civil penalties up to $25,000 per willful violation (ORS 646.642(3)).
- Applies to
- Operators of websites, online services and apps with actual knowledge that they are used primarily for, and designed and marketed for, K-12 school purposes (ORS 336.184(2)(c))
Practices it requires
- No targeted advertising on the service, or elsewhere based on information acquired through the K-12 service.ORS 336.184(3)(a)(A)-(B)
- Do not amass a student profile except for K-12 school purposes, and do not sell student information.ORS 336.184(3)(a)(C)-(D)
- Disclose covered information only for K-12 purposes, legal compliance, judicial process, safety or security, or to contractually bound service providers.ORS 336.184(3)(a)(E)
- Delete a student's covered information within a reasonable time when the school or district requests it.ORS 336.184(4)(b)
Security duties
- Implement and maintain reasonable security procedures and practices appropriate to the covered information.ORS 336.184(4)(a)
Sources
- Official text
- ORS 336.184 (ORS chapter 336, 2025 edition)
- 2015 Or. Laws ch. 528 (SB 187), effective 2016-07-01
- ORS 646.607 (ORS chapter 646)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Research reference, not legal advice.