Oregon has enacted new legislation that changes how businesses can use electronic ID scanners to verify customer ages. Oregon Senate Bill 1005 (SB 1005), signed into law on July 24, 2025, and effective January 1, 2026, allows private businesses to electronically scan driver’s licenses and identification cards when providing age-restricted goods or services, regardless of how old a customer appears.
Previously, Oregon law restricted age-verification scanning based on whether there was reasonable doubt that a customer had reached age 21. SB 1005 removes that limitation, giving businesses greater flexibility to implement universal ID scanning policies.
The legislation also increases financial penalties for businesses that improperly scan, store, share, or otherwise use personal information obtained from identification documents.
For retailers, bars, restaurants, cannabis dispensaries, and other age-restricted businesses, the changes provide additional clarity around electronic age verification while reinforcing the importance of protecting customer information.
What is Oregon SB 1005?
Oregon Senate Bill 1005 amends ORS 807.750, the state’s existing law governing electronic scanning of driver’s licenses and identification cards.
Under the previous framework, private businesses could electronically scan an ID to verify a customer’s age when there was reasonable doubt that the individual had reached 21 years of age. Oregon’s alcohol regulations generally define reasonable doubt based on whether an individual appears to be younger than 26.
This created complications for businesses that wanted to establish consistent age verification policies requiring every customer to have their ID scanned, regardless of appearance.
SB 1005 addresses this issue by explicitly permitting private entities to electronically scan IDs for age verification when offering age-restricted goods or services, even when the customer clearly appears to be over 21.
The law does not establish a universal ID scanning mandate. Instead, it removes a previous restriction on when businesses may use electronic ID scanners for age verification.
What does Oregon SB 1005 require?
The legislation makes two primary changes to Oregon’s existing ID scanning laws: expanding permissible age verification scanning and increasing the financial consequences of unlawful ID data practices.
| Provision | What it means for businesses |
| Universal age verification | Businesses may scan IDs for age verification regardless of apparent age. |
| Age-restricted transactions | The authorization applies when providing age-restricted goods or services. |
| Mandatory scanning | SB 1005 does not require businesses to scan every customer’s ID. |
| Personal information | Existing restrictions on collecting, storing, sharing, and using ID data remain applicable. |
| Civil liability | Minimum statutory damages for violations increase from $1,000 to $5,000, or actual damages if greater. |
| Effective date | January 1, 2026. |
Oregon SB 1005: What does it mean?
What the law says
SB 1005 modifies ORS 807.750(2)(b) to permit private entities to electronically scan a driver’s license or identification card to verify an individual’s age when providing age-restricted goods or services, without requiring reasonable doubt that the person has reached age 21.
The law also amends ORS 807.750(8), increasing the amount an individual may recover when an entity unlawfully scans or uses information obtained from an ID.
The full legislation is available through the Oregon Legislature’s enrolled SB 1005.
What this means in plain English
Previously, an Oregon business could face legal challenges for electronically scanning the ID of an older customer solely to verify age when there was no reasonable doubt the customer was over 21.
Under SB 1005, businesses can establish policies requiring age verification scans for all customers purchasing age-restricted products or accessing age-restricted services, regardless of how old those customers appear.
For example, a liquor store may choose to electronically scan every customer’s driver’s license at checkout rather than relying on employees to determine which customers look young enough to require verification.
However, businesses must still comply with Oregon’s restrictions on how personal information obtained through ID scanning is collected, retained, and used.
Which businesses are affected by Oregon’s new ID scanning law?
SB 1005 applies broadly to private entities offering age-restricted goods or services. This includes several industries where electronic age verification is already an important part of daily operations.
Alcohol retailers, bars, and restaurants
Businesses selling alcoholic beverages can implement universal ID scanning procedures without limiting electronic verification to customers who appear younger than a particular age.
This allows businesses to standardize age verification at the point of sale and reduce inconsistencies between employees. However, businesses must still follow applicable Oregon Liquor and Cannabis Commission (OLCC) requirements.
Tobacco and vape retailers
Tobacco retailers, vape shops, and convenience stores can use electronic ID scanning to verify customer ages consistently, including for customers who appear well above the legal purchasing age.
For businesses operating multiple locations, universal scanning policies can help establish consistent procedures across stores while reducing reliance on subjective age assessments.
Cannabis dispensaries
Oregon cannabis retailers are already subject to identification verification requirements under ORS 475C.217. SB 1005 provides additional clarity for businesses that want to use electronic ID scanners as part of those verification procedures.
The distinction is important: requiring a customer to present identification does not necessarily mean that a business is legally required to electronically scan that identification.
Does Oregon SB 1005 require businesses to scan every ID?
No. SB 1005 permits universal electronic age verification, but it does not mandate that businesses scan every customer’s identification.
The legislation distinguishes between businesses being legally permitted to scan IDs and businesses being legally required to do so.
Individual industries may have separate identification verification obligations under Oregon law or applicable regulations. Businesses should review those requirements independently when developing their age verification policies.
What are Oregon’s ID scanning data privacy requirements?
Although SB 1005 expands the circumstances under which businesses may electronically scan IDs, it does not eliminate Oregon’s existing data privacy restrictions.
Under ORS 807.750(3), private entities scanning IDs for age verification under subsection (2)(b) are prohibited from storing, selling, or sharing personal information collected through those scans.
This distinction is especially important for businesses using electronic ID scanning systems that automatically capture customer information.
For age verification scans, businesses should configure their systems to verify the necessary information without retaining prohibited personal data.
Oregon law separately authorizes certain other scanning purposes, including specific fraud prevention and financial transactions, with different rules governing permitted information collection and use. Businesses should not assume that information permitted to be retained for one purpose can also be retained for age verification.
For retailers using ID scanning technology, the ability to control data collection and retention is an important part of maintaining compliance.
How IDScan.net can help businesses comply with Oregon SB 1005
Oregon’s updated ID scanning law gives businesses greater flexibility to adopt standardized age verification procedures while maintaining strict expectations for protecting customer information.
IDScan.net offers electronic age verification solutions designed to help businesses verify identification documents, identify underage customers, and streamline age-restricted transactions.
VeriScan Identity Platform allows businesses to electronically scan driver’s licenses and IDs, calculate customer ages, and identify potential issues with presented identification.
For businesses operating in Oregon, VeriScan’s customizable personally identifiable information (PII) settings can support age verification workflows designed to minimize unnecessary collection and retention of customer information.
Businesses should configure VeriScan to comply with Oregon’s specific data handling restrictions, including the prohibition on storing personal information collected through age verification scans.
IDScan.net also offers ID authentication technology to help businesses identify potentially fraudulent identification documents. While electronic barcode scanning can confirm the age information encoded in an ID, additional authentication capabilities can help determine whether the physical document itself is genuine.
By combining electronic age verification, configurable data privacy settings, and document authentication, businesses can create more consistent verification procedures while addressing identity fraud risks.
Final thoughts
Oregon SB 1005 represents an important change for businesses that rely on electronic ID verification. By removing restrictions tied to a customer’s apparent age, the law makes it easier for retailers and other age-restricted businesses to implement consistent ID scanning policies.
However, the expanded authorization comes alongside increased financial consequences for improper handling of customer information.
For businesses operating in Oregon, the priority should be establishing age verification procedures that are consistent, reliable, and compliant with state privacy requirements.
Solutions such as VeriScan can help businesses streamline age verification while offering configurable data handling options that support compliance with Oregon’s ID scanning laws.
