Camera-related state law

Oregon's audio recording rule is unusual. ORS 165.540 generally prohibits recording an in-person oral communication unless all parties to the conversation have been specifically informed that the conversation is being recorded. The statute provides one-party consent for telephonic communications under 165.540(1)(a) but holds in-person recording to an all-party-notice standard. The practical effect is that Oregon treats in-person audio more strictly than typical one-party states.

Video-only surveillance of common areas with posted notice is generally lawful. ORS 163.700 and 163.701 (invasion of personal privacy) reach hidden cameras in places where privacy is reasonably expected. Posted notice at the entrance is the industry standard.

Practical translation. Commercial OR camera installs default to video-only on the cameras. Audio is only added with documented all-party-notice signage and a workflow that confirms participant awareness.

DPSST private security licensing

The Oregon Department of Public Safety Standards and Training (DPSST) regulates private security providers, executive managers, instructors, and certain related categories under ORS 181A.840 et seq. and OAR 259-060. Companies providing security services for compensation must hold a current state license, and individual employees performing covered functions must be certified.

For commercial buyers, the practical takeaway is that any security service provider operating in Oregon should provide a DPSST license number and individual certification confirmation. Buyers can verify at oregon.gov/dpsst.

Biometric data and the OCPA

The Oregon Consumer Privacy Act (ORS 646A.570 et seq.) took effect July 1, 2024. OCPA applies to controllers conducting business in Oregon or producing products targeted to Oregon residents above defined thresholds. The Act classifies biometric data as sensitive personal data and requires consent before processing.

For commercial security buyers, the practical reach is fingerprint and facial-recognition access control and any AI camera that builds a faceprint template. OCPA compliance requires consent, privacy notice, consumer-rights handling, and a data protection assessment for sensitive processing. Enforcement is by the Oregon Attorney General; there is no private right of action.

Cannabis surveillance (OLCC)

The Oregon Liquor and Cannabis Commission (OLCC) publishes camera coverage and retention rules for licensed adult-use and medical cannabis businesses under OAR 845-025. Pull the current text before designing the install. Most OR licensed operators retain at least the OLCC minimum and configure VMS retention with a buffer to absorb investigation holds.

Privacy in the workplace

The combination of ORS 165.540 (in-person all-party notice) and OCPA (biometric consent) makes Oregon one of the more notice-heavy states for workplace surveillance. Pure video surveillance of common work areas with posted notice is generally lawful. Cameras in employee-only spaces with a reasonable expectation of privacy are off-limits.

Most OR employers issue a single workplace surveillance notice in the employee handbook and obtain written acknowledgment at hire. The acknowledgment is the practical mechanism that documents the all-party-notice posture for any audio capture.

Video retention requirements

  • Cannabis. OAR 845-025 (OLCC) sets retention. Pull the current rules before designing the install.
  • Healthcare. HIPAA Security Rule (45 CFR Part 164) governs PHI-touching footage.
  • Retail and hospitality. PCI-DSS Requirement 9 specifies 90-day retention for the cardholder data environment.
  • Federal contractors. NDAA Section 889 controls vendor selection.
  • Schools. FERPA reach for K-12 districts and higher education.

Default retention for OR commercial systems with no specific industry rule is 30 days.

What Tec-Tel does to comply with Oregon regulations

  • Video-only on cameras unless audio is documented with all-party notice under ORS 165.540.
  • Posted surveillance notice at every public entrance.
  • No cameras in restrooms, locker rooms, dressing rooms, or any space where privacy is reasonably expected.
  • OCPA consent and notice language coordinated with the customer's privacy team for any biometric capture.
  • Retention configured to the regime that governs the industry (HIPAA, PCI, OLCC, NDAA).
  • NDAA Section 889-compliant vendor selection on federal-touching installs.
  • DPSST-licensed work where the install scope or service triggers ORS 181A.840.

This is a buyer-facing reference, not legal advice.

Security service in Oregon

Tec-Tel deploys AI-era security across Oregon with one accountable project manager owning design, install, and service to one standard. The cities below have local service detail, deal sizing, and a free consultation. Don't see yours? We cover the whole state.

Or browse the full city directory and nationwide coverage map.