Oregon bill would extend Consumer Privacy Act to motor-vehicle makers; exempts commercial trucks in amendment

House Committee on Commerce and Consumer Protection members opened a work session March 18 on House Bill 3,875, a proposal to clarify that the Oregon Consumer Privacy Act (OCPA) applies to motor vehicle manufacturers and their affiliates that control or process personal data from the use of a motor vehicle.

The bill’s sponsor, Representative David Gomberg, said the change would give “every Oregonian that buys a car” the ability to opt out of car-collected personal and sensitive data under the OCPA. He told the committee that “cars are a privacy nightmare” and quoted a Mozilla research project alleging popular brands collect deeply personal data via sensors, cameras, microphones and telematics.

The measure matters because current OCPA coverage depends on statutory thresholds tied to data-sales revenue and the number of Oregonians whose data a business controls. Gomberg said the thresholds—either that a business derives 25% of annual gross revenue from sale of personal data and collects the personal data of at least 25,000 Oregonians, or collects data on at least 100,000 Oregonians—create gaps that could let smaller or niche vehicle manufacturers avoid the law. His dash-1 amendment, he said, would exempt “commercial vehicles” such as trucks from the bill.

Committee staff member Mr. Henry read the bill summary to the committee, describing that HB 3,875 “establishes that the Oregon Consumer Privacy Act applies to motor vehicle manufacturers and any affiliates that control or process personal data from the use of motor vehicle or any component of a motor vehicle.” The summary also noted the bill’s effective date would be “the 91st day following adjournment/signing day.”

Supporters who testified said they want clearer consumer protections when buying a car. Chris Coughlin of Oregon Consumer Justice said modern vehicles “function as computers on wheels, continuously collecting and transmitting personal data often to third parties with little transparency or consumer control,” and that clarifying coverage will let consumers opt out more easily.

Representing an industry perspective, JL Wilson of Daimler Truck told the committee that Daimler’s trucks “come from the factory equipped with a telematics system that captures a significant volume of information” used for service and diagnostics. Wilson said customers opt into Daimler’s paid portal service (Detroit Connect) and that excluding commercial vehicles from the bill is important because those products are sold to businesses rather than individual consumers.

Committee members asked clarifying questions about the scope of the commercial-vehicle exemption and whether the bill would change existing OCPA thresholds; the sponsor and staff said the bill’s primary purpose is to make clear that vehicle manufacturers fall within OCPA when they meet its criteria so consumers know whether they can exercise existing OCPA rights. Committee staff and witnesses indicated the dash-1 amendment is intended to carve out commercial truck manufacturers from the bill’s coverage.

The committee closed public testimony on HB 3,875 after the three witnesses and did not take a vote during the hearing. No formal legislative action or recorded vote occurred in the work session; the item remained at the public-hearing/work-session stage.

Looking ahead, the committee will receive the sponsor’s dash-1 amendment language and industry advocates said they are working with the sponsor on the commercial-vehicle language. The bill, as presented at the hearing, does not change OCPA’s thresholds; it clarifies that vehicle manufacturers are subject to the act when they otherwise meet the law’s criteria.