Overview of Oregon ID scanning laws
Oregon has 4 laws which we consider relevant to ID verification, in addition to other laws which may related to age verification, identity verification, KYC, privacy, and biometrics.
Can you scan IDs in Oregon?
An Oregon statute prohibits a business from scanning IDs except under one of the following circumstances:
- To verify the authenticity of an ID or to verify the identity of an individual if the individual (a) pays for a good or service with a method other than cash, (b) returns an item, or (c) requests a refund.
- To verify the individual’s age in providing age-restricted goods or services.
- To prevent fraud or other criminal activity if an individual returns an item or requests a refund and the business uses a fraud prevention service company or system.
- To transmit information to a check services company for the purpose of approving checks, electronic funds transfers, or similar methods of payment.
Exceptions also allow for ID scanning in Oregon if permission from the individual has been given, or to establish or maintain a contract.
Can you save data from a scanned ID in Oregon?
A business scanning under 1 or 2 above may not store, sell, or share personal information collected from the scan. A business scanning under 3 or 4 above may store or share name, address, date of birth, and ID number for the purpose of preventing fraud or other criminal activity.
Does Oregon offer affirmative defense for ID scanning?
Yes. Oregon provides affirmative defense for ID scanning for sale of age restricted products.
What types of IDs does Oregon issue?
Oregon issues drivers licenses and state IDs, including REAL ID.
Individual Oregon ID verification laws
ID scanning in lieu of penaly
The Oregon Liquor Control Commission may allow licensees to acquire and use age-verifying ID scanners in lieu of other penalties for selling alcohol to a minor.
ID scanning for scrap metal
Before completing a transaction, scrap metal businesses must create property records including sale details, a signature from the seller, seller information, and a copy of the seller’s ID.
ID scanning for ephedrine and pseudoephedrine
Pharmacists must submit the purchaser’s name, address, date of birth, and ID type, along with the date and time of purchase, when issuing ephedrine or pseudoephedrine.
Age restrictions for pornography
The proposed bill would require businesses that provide access to pornography to verify that individuals are 18 before granting access.
Data privacy laws in Oregon
The Oregon Consumer Privacy Law gives residents rights to manage and safeguard their personal data. Under this law, consumers can:
- access the specific entities that received their personal data.
- edit any inaccuracies in the data about them.
- delete the data a business has about them.
- opt out of a business selling, profiling or otherwise using their data for targeted advertising.
- receive a copy of the personal and sensitive data a business has about them.
Businesses are required to have heightened opt-in protections when personal data including racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, status as transgender or nonbinary, crime victim status, or citizenship or immigration status; genetic or biometric data; and precise geolocation data is being collected.
Additionally, youth have heightened protections. Businesses must follow the requirements of the federal Children’s Online Privacy Protection Act (COPPA) when processing data of children under 13 years old and “opt in” consent is required for targeted advertising, profiling or sale of the personal data of a youth 13 to 15 years old.
