As one of her last acts in office, on December 24, 2024, Oregon Attorney General (AG) Ellen Rosenblum issued guidance for businesses deploying artificial intelligence (AI) technologies. The guidance highlights the risks associated with the commercial use of AI, and underscores that, despite the absence of a specific AI law in Oregon, a company’s use of AI must still comply with existing laws.

Rosenblum’s Guidance

The guidance highlights the AG’s concerns with the unpredictability of AI outputs, noting that these can affect fairness, obscure accountability, and impact trustworthiness. Privacy and accountability are also emphasized as significant risks due to AI’s reliance on vast amounts of personal data. The guidance addresses bias and discrimination, noting that AI systems trained on data sets that include data reflecting bias may perpetuate social inequalities. The lack of transparency in AI decision-making processes can make it difficult for humans to identify, understand, and correct such decisions.

With the foregoing risks in mind, the guidance reminds businesses that AI is regulated under the Oregon Unlawful Trade Practices Act (OUTPA), the Oregon Consumer Privacy Act (OCPA), the Oregon Consumer Information Protection Act (OCIPA), and the Oregon Equality Act (OEA) and discusses the ways AI developers and deployers may violate these statutes.

First, the OUTPA prohibits misrepresentations in consumer transactions. The guidance reminds companies developing, selling, or deploying AI technology to ensure their tools provide accurate information to consumers, and notes that misrepresentations may be actionable even if not made directly to a consumer, or made to a consumer by AI. As a result, Rosenblum made clear that AI developers or deployers could be liable to downstream consumers for harms caused by their products. The guidance identifies various examples of OUTPA violations, such as misrepresenting the characteristics, uses, benefits, or qualities of AI products; using AI to falsely claim nonexistent sponsorships, approvals, or connections (such as artificial celebrity endorsements); or using AI-generated voices for robocalling campaigns.

Second, the OCPA guarantees a consumer’s right to control the distribution of their personal data. Per the AG’s guidance, such control is particularly relevant for generative AI systems trained with such data. Thus, Rosenblum suggests that AI developers should disclose whether personal data was used to train any particular AI model, and obtain consumers’ express consent to the usage if the data used is considered “sensitive data” under the act. Notably, the guidance emphasizes that affirmative consent for the use of Oregon consumer sensitive data is required and retroactive or passive attempts to modify privacy notices or terms of use will not bring a company into compliance. Consumers must also be able to opt out of AI profiling when AI is used to make significant decisions, such as those pertaining to housing, education, or lending.

Third, the guidance notes that the OCIPA requires AI developers who possess personal information to safeguard that information through reasonable cybersecurity measures and to comply with the provisions of the OCIPA.

Finally, the guidance highlights that the OEA prohibits discrimination based on protected classes and bars discrimination resulting from AI use, particularly in the context of housing and public accommodations.

Why It Matters

This latest guidance from Oregon aligns with similar commentary by other state AGs, including those in Texas and Massachusetts. Based on such announcements, it appears that AGs across the U.S. intend to apply existing consumer protection laws to the use and application of AI. The trend of using traditional enforcement actions to address the rapid proliferation of AI will likely continue in the absence of specific AI legislation, and demonstrates why AGs are equipped to rapidly adapt to a changing environment as legislators struggle to keep pace.

Troutman Pepper Locke State Attorneys General Team

	Ashley Taylor – Co-leader and Firm Vice Chair Ashley is co-leader of the firm’s nationally ranked State Attorneys General practice, vice chair of the firm, and a partner in its Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group. He helps his clients navigate the complexities involved with multistate attorneys general investigations and enforcement actions, federal agency actions, and accompanying litigation.
	Clay Friedman – Co-leader Clayton is a partner in the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group and co-leader of the State Attorneys General practice, multidisciplinary teams with decades of experience crafting effective strategies to help deter or mitigate the risk of enforcement actions and litigation.
	Stephen Piepgrass Stephen leads the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group. He focuses his practice on enforcement actions, investigations, and litigation. Stephen primarily represents clients engaging with, or being investigated by, state attorneys general and other state or local governmental enforcement bodies, including the CFPB and FTC, as well as clients involved with litigation, with a particular focus on heavily regulated industries.
	Michael Yaghi Michael is a partner in the firm’s State Attorneys General and Regulatory Investigations, Strategy + Enforcement (RISE) Practice Groups, nationwide teams that advise clients on consumer protection enforcement matters and other regulatory issues.
	Samuel E. “Gene” Fishel Gene is a member of the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) practice, based in the Richmond office. He brings extensive regulatory experience, having most recently served as senior assistant attorney general and chief of the Computer Crime Section in the Office of the Attorney General of Virginia, and as special assistant U.S. attorney in the Eastern District of Virginia for 20 years.
	Chuck Slemp Chuck advises clients on a wide range of complex issues that frequently involve government actions, including investigations, inquiries, regulatory matters, and litigation. With a distinguished background in the law and public service, he served as chief deputy attorney general of Virginia before joining the firm. In addition to overseeing the Department of Law and Division of Debt Collection, Chuck managed a team of attorneys who handle complex litigation and investigations. He also directed the attorney general’s legislative affairs and represented the attorney general in various capacities.
	Tim Bado Tim is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group, where he represents corporations and individuals facing potential civil and criminal exposure. Tim’s experience in government investigations, enforcement actions, and white-collar litigation spans a number of industries, including financial services, pharmaceutical, health care, and government contracting, among others.
	Jessica Birdsong Jessica is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group. She received her J.D. from the University of Richmond School of Law, magna cum laude, where she served as associate articles editor of the Journal of Law & Technology.
	Chris Carlson Chris Carlson represents clients in regulatory, civil and criminal investigations and litigation. In his practice, Chris regularly employs his prior regulatory experience to benefit clients who are interacting with and being investigated by state attorneys general.
	Blake R. Christopher Blake collaborates with clients on matters related to government contracting, investigations, and disputes. His senior-level government experience generates valuable insights and strategies for clients across a variety of industries.
	Nick Gouverneur Nick is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group.
	Natalia Jacobo Natalia is an associate in the firm’s Regulatory Investigations, Strategy and Enforcement (RISE) practice. She focuses her practice on two primary areas: government contracting and state attorney general work.
	Namrata Kang Namrata (Nam) is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group, based in the Washington, D.C. office. She routinely advises clients on a wide variety of state and federal regulatory matters, with a particular emphasis on state consumer protection laws relating to consumer financial services and marketing and advertising.
	Michael Lafleur Michael is an associate in the firm’s Regulatory Investigations, Strategy, and Enforcement Practice Group. Based out of the firm’s Boston office, Mike has deep experience in litigation, investigations, and other regulatory matters involving state-level regulators and state attorneys general.
	Susan Nikdel Susan is an associate in the firm’s Consumer Financial Services Practice Group, and focuses her practice on consumer financial services matters. She has defended several of the nation’s largest and most influential financial institutions in individual and class action litigation involving the Telephone Consumer Protection Act (TCPA), Fair Credit Reporting Act (FCRA), Fair Debt Collection Practices Act (FDCPA), and other consumer privacy statutes.
	Lane Page Lane specializes in federal and state regulatory investigations and complex civil litigation. He focuses on representing financial institutions and other businesses, with a particular emphasis on consumer protection and fair lending issues.
	Trey Smith Trey is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice. He focuses his practice on helping financial institutions and consumer facing companies navigate regulatory investigations and resulting litigation.
	Daniel Waltz Daniel is a member of the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group and State Attorneys General team. He counsels clients in connection with navigating complex government investigations, regulatory compliance, and transactions, involving state and federal government contracting obligations. Drawing on his broad experience as a former assistant attorney general for the state of Illinois, Daniel is a problem solver both inside and outside the courtroom.
	Cole White Cole is a member of the firm’s Regulatory Investigations, Strategy and Enforcement (RISE) group. He has a decade of experience working in the attorney general community, having joined the firm from the Wyoming Office of the Attorney General, where he was assistant attorney general.
	Stephanie Kozol Stephanie is Troutman Pepper Locke’s senior government relations manager in the state attorneys general department.