State guide
Oregon ID scanning laws
Oregon expressly allows ID scanning to check any customer's age for an age-restricted sale or service. Personal information from that scan may not be stored, sold or shared.
For bars, restaurants, dispensaries and retailers, the practical questions are when scanning is allowed, when an ID check is required, which IDs count and what may be kept after a scan.
Reviewed September 29, 2026 · 10 primary sources linked
Oregon at a glance
- Is it legal to scan IDs in Oregon?
- Yes.Oregon expressly allows a business to scan an ID to verify age for an age-restricted good or service, and since January 1, 2026, that permission applies to any customer.
- Do you have to check IDs in Oregon, and when?
- It depends on what you sell.OLCC rules require an alcohol ID check for anyone who appears under 26, dispensaries check ID before every sale and federal law requires tobacco and vape retailers to check photo ID for buyers under 30.
- Which IDs provide protection in Oregon?
- A driver's license or ID card from a US state, DC or Canada, a passport or passport card, a US military ID, a tribal ID or a SENTRI or NEXUS card.For alcohol, the list also includes an ID card from a US territory, and each ID must be unexpired and unaltered and show the person's name, photo and date of birth. A customer without one of the listed IDs can use Oregon's signed statement-of-age process with supporting evidence.
- Can you keep data from an ID scan in Oregon?
- Not personal information from a scan performed for age verification or ID authenticity.Oregon prohibits storing, selling or sharing that scan-derived personal information, and customer consent does not create an exception.
- What other Oregon laws reach the data you keep?
- Oregon's data-security, breach-notification and consumer privacy laws can apply.A name kept with an Oregon license or ID card number must be safeguarded. The privacy act reaches businesses above its volume thresholds.
- Does scanning give you a defense if you serve a minor in Oregon?
- No, but a scan can help staff spot an altered ID.Oregon's alcohol protections turn on whether a reasonable person would have seen that the ID was altered or did not describe the customer.
- Can a customer refuse an ID scan in Oregon?
- Oregon does not specifically regulate this.Where an alcohol ID check is required, a customer still needs an accepted ID or the signed statement-of-age route before service can proceed.
What Oregon venues should know
Is it legal to scan IDs in Oregon?
Yes. Oregon expressly allows ID scanning to verify a customer's age.
Oregon has a law written specifically about scanning a driver's license or ID card. It allows a business to scan the barcode or magnetic strip only for the purposes it lists.
The purposes that can apply to a bar, restaurant or store are:
- Verifying a customer's age when providing age-restricted goods or services
- Verifying that the license or ID card is genuine or verifying the customer's identity if the customer pays by a method other than cash, returns an item or asks for a refund
- Preventing fraud on returns and refunds, where the business uses a fraud-prevention service
- Passing information to a check services company to approve a check or other payment
Since January 1, 2026, the age purpose covers any customer. Before then, the law allowed an age scan only where there was reasonable doubt that the customer was 21 or older.
The exact wording
Except as provided in subsection (6) of this section, a private entity may not swipe an individual's driver license or identification card, except for the following purposes:
To verify the individual's age when providing an age-restricted good or service to any person.
To verify the authenticity of a driver license or identification card or to verify the identity of the individual if the individual pays for a good or service with a method other than cash, returns an item or requests a refund.
Do you have to check IDs in Oregon, and when?
The ID-checking duty depends on the product, and for alcohol it covers anyone who appears under 26.
Alcohol
Before selling or serving alcohol to anyone who may reasonably be under 21, a licensee must ask for one of the IDs Oregon accepts. Oregon Liquor and Cannabis Commission (OLCC) rules treat anyone who appears to be under 26 as such a customer, and apply the same check to anyone in an area of the premises closed to minors.
Cannabis
Dispensaries must ask for one of the IDs the cannabis law lists before every sale.
Tobacco and vape
Oregon's own tobacco law makes it an offense to knowingly sell tobacco or vape products to anyone under 21. The ID check itself comes from federal rules, which require retailers to check photo ID showing the date of birth for any buyer under 30.
The exact wording
Before selling or serving an alcoholic beverage to any person about whom there is any reasonable doubt of the person's having reached 21 years of age, a licensee or permittee shall require the person to produce one of the following pieces of identification:
The Commission requires a licensee or permittee to verify the age of anyone who wants to drink alcoholic beverages, or is in an area prohibited to minors, if there is reasonable doubt that the person is at least 21 years old. "Reasonable doubt" exists if the person appears to be under the age of 26;
Whenever a licensee or permittee verifies age, he/she must verify it as ORS 471.130 requires (statement of age card or the specified items of identification) and must reject any obviously altered document or one which obviously does not identify the person offering it;
Subject to subsection (2) of this section, a licensee or licensee representative, before selling or providing a marijuana item to another person, must require the person to produce one of the following pieces of identification:
Except as otherwise provided in paragraph (a)(2)(ii) of this section and in § 1140.16(c)(2)(i), each retailer must verify by means of photographic identification containing the bearer's date of birth that no person purchasing the product is younger than 21 years of age; (ii) No such verification is required for any person over the age of 29;
Which IDs provide protection in Oregon?
Oregon uses a defined list of IDs for alcohol, with a signed statement-of-age route when the customer has none of them.
Each must be unexpired and unaltered and show the person's name, photo and date of birth:
- A driver's license from a US state, the District of Columbia or a Canadian province or territory
- An ID card with a physical description, from a US state, the District of Columbia, a US territory or a Canadian province or territory
- A tribal ID card with the person's photo, name, date of birth and physical description
- A passport or passport card
- A US military ID card
- A SENTRI or NEXUS trusted-traveler card
If a customer has none of these, the alcohol law requires the licensee to take a signed statement of age on an OLCC-approved form, together with evidence of the customer's age and identity. Dispensaries use a similar list in the cannabis law, which does not include Canadian driver's licenses or ID cards.
The exact wording
Only the following forms of unexpired, unaltered, and legitimate identification that have the person's name, picture, and date of birth are acceptable alone as proof of age: (A) A driver license issued by a U.S. state, the District of Columbia, or a province or territory of Canada; (B) An identification card that includes a physical description of the person and is issued by a U.S. state, the District of Columbia, or a territory of the U.S., or a province or territory of Canada; (C) An identification card that has a picture of the person, the name of the person, the person's date of birth, and a physical description of the person and is issued by a federally recognized Indian tribe; (D) A passport or passport card (E) A U.S. military identification card; or (F) An identification card that is proof of the person's participation in the Secure Electronic Network for Travelers Rapid Inspection (SENTRI) program operated by United States Customs and Border Protection, the NEXUS program jointly operated by that agency and the Canada Border Services Agency, or a successor to either of those programs that is recognized by the Commission.
If a person does not have identification as described in subsection (1) of this section, the permittee or licensee shall require the person to make a written statement of age and furnish evidence of the person's true age and identity.
Can you keep data from an ID scan in Oregon?
Not personal information from a scan made to check age or whether the ID is genuine.
Oregon's scanning law says a business that scans a license or ID card for either of those purposes may not store, sell or share the personal information collected from the scan. Personal information includes the person's name, address, date of birth, photograph, license or ID card number and any other unique personal identifier or number.
Oregon therefore sets no retention period for these scans, because the information may not be kept at all. The rule has no exception for a customer's consent, and the law makes any waiver of its provisions void. By contrast, the law allows a name, address, date of birth and license or ID card number to be stored from scans made to prevent fraud on returns and refunds or to approve a check or other payment.
The rule covers personal information collected by passing a license or ID card through a device that can read the information encoded in its barcode or magnetic strip. Dispensaries have a separate rule on customer information, which applies whether the information sits on the ID or in another record.
The exact wording
A private entity that swipes an individual's driver license or identification card under subsection (2)(a) or (b) of this section may not store, sell or share personal information collected from swiping the driver license or identification card.
"Personal information" means an individual's name, address, date of birth, photograph, fingerprint, biometric data, driver license number, identification card number or any other unique personal identifier or number.
"Swipe" means the act of passing a driver license or identification card through a device that is capable of deciphering, in an electronically readable format, the information electronically encoded in a magnetic strip or bar code on the driver license or identification card.
Any waiver of a provision of this section is contrary to public policy and is void and unenforceable.
In addition to any other remedy provided by law, an individual may bring an action to recover actual damages or $5,000, whichever is greater, and to obtain equitable relief, if equitable relief is available, against an entity that swipes, stores, shares, sells or otherwise uses the individual's personal information in violation of this section. A court shall award a prevailing plaintiff reasonable costs and attorney fees. If a court finds that a violation of this section was willful or knowing, the court may increase the amount of the award to no more than three times the amount otherwise available.
A marijuana retailer may not record and retain any information that may be used to identify a consumer, except as necessary to make deliveries to consumers pursuant to ORS 475C.117, as required by any rules adopted under ORS 475C.117.
What other Oregon laws reach the data you keep?
Other personal information a venue keeps can still fall under Oregon's security, breach and consumer privacy laws.
A customer's name kept together with an Oregon driver's license or ID card number, or a US passport number, is personal information under Oregon's data-security law. A business holding it must maintain reasonable safeguards, including when it disposes of the information, and must give notice of a qualifying breach.
The Oregon Consumer Privacy Act applies to a business that controls or processes the personal data of 100,000 or more consumers in a year, or of 25,000 or more while deriving 25 percent or more of its annual gross revenue from selling personal data. These rules reach details typed in by hand as well as scanned ones.
Does scanning give you a defense if you serve a minor in Oregon?
No, but a scan can help staff spot an altered ID, which is part of what Oregon's alcohol protections weigh.
For alcohol, a customer without one of the listed IDs must sign a statement of age on an OLCC-approved form, with the evidence of age and identity they showed written on it. If that statement is offered as evidence in a criminal or OLCC case over a sale to someone under 21, the licensee or permit holder is found to have committed no crime or other wrong, unless a reasonable person would have seen that the ID shown was altered or did not accurately describe the customer.
A licensee is also not liable to people injured by an under-21 customer who got alcohol from it, unless a reasonable person would have asked for ID or would have seen that the ID shown was altered or did not describe the customer. Neither protection depends on scanning. A scan can help staff spot an altered ID at the moment of sale, but Oregon does not let a business keep the personal information from that scan as a record of the check.
Separately, a licensee that joins the OLCC's responsible vendor program and takes all the measures it requires cannot have its license canceled or refused because an employee sold alcohol to a minor. Those measures include accepting only the IDs the alcohol law lists, posting house rules for checking ID and training staff at least four times a year.
The exact wording
If a written statement of age and the information pertaining to the evidence which was exhibited to the permittee or licensee at the time the statement was made that is entered in writing on the statement, are offered as evidence in any administrative or criminal prosecution for sale or service of alcoholic liquor to a person not having reached 21 years of age, the permittee or licensee shall be found to have committed no crime or other wrong unless it is demonstrated that a reasonable person would have determined that the identification exhibited was altered or did not accurately describe the person to whom the alcoholic liquor was sold or served.
Notwithstanding ORS 471.130 and 471.565, no licensee, permittee or social host shall be liable to third persons injured by or through persons under the age of 21 years who obtained alcoholic beverages from the licensee, permittee or social host unless it is demonstrated that a reasonable person would have determined that identification should have been requested or that the identification exhibited was altered or did not accurately describe the person to whom the alcoholic liquor was sold or served.
If a licensee participates in the responsible vendor program and takes all measures specified by the program as necessary to prevent sales of alcoholic beverages to minors, the commission may not cancel the license of the licensee, or deny issuance of a license to the licensee, based on sales of alcoholic beverages to minors by employees of the licensee.
Can a customer refuse an ID scan in Oregon?
Oregon does not create a specific right to refuse a scan or require a manual alternative.
Where the alcohol rules require an ID check, a customer who will not produce one of the accepted IDs or sign a statement of age cannot lawfully be served. How a venue handles a customer who declines a scan is otherwise a matter of venue policy.
Refusal decisions remain subject to Oregon's public-accommodation law, which prohibits distinctions based on characteristics such as race, religion, sex, sexual orientation, gender identity and national origin. The same law expressly allows the laws on minors and alcohol to be enforced.
Alcohol, cannabis and tobacco
Alcohol
Scanning is allowed for every customer, and an ID check is required for anyone who appears to be under 26.
OLCC rules apply the check before alcohol is sold or served and to anyone in an area of the premises closed to minors. Staff must also reject an ID that is obviously altered or obviously does not belong to the person showing it.
OAR 845-006-0335Cannabis
Dispensaries check ID before every sale and may not keep information that identifies a customer.
The exceptions are records needed for deliveries, and a customer's name and contact details kept for marketing after the dispensary asks and the customer agrees. A dispensary may not pass identifying information to anyone else, and the rule applies whether the information sits on the ID or in another record.
ORS 475C.221Tobacco and vape
Selling to anyone under 21 is an offense, and federal rules require photo ID for buyers under 30.
Oregon's offense reaches the clerk who makes the sale, a manager who supervises it and the owner of the business, with separate fines for each.
ORS 167.755What this means for your AgeShield setup
These are the AgeShield settings affected by the Oregon rules above. How you configure them is ultimately a decision for your venue.
- How long visits are kept
- Oregon sets no retention period for personal information from a scan made to check age or whether the ID is genuine, because that information may not be stored at all.AgeShield setting: Choose how long visits are kept, down to 0. Which ID fields are stored with them is a separate setting.
- Which ID fields are stored
- Personal information from those scans, which may not be stored, includes the name, address, date of birth, photograph, license or ID card number and any other unique personal identifier or number.AgeShield setting: Choose which ID fields are stored. Each field can be switched off.
- Manual entry
- Oregon's scanning rule covers personal information collected by passing a license or ID card through a device that can read the information encoded in its barcode or magnetic strip. Oregon's data-security law and the dispensary rule on customer information do not depend on how details were entered.AgeShield setting: Manual entry is available for staff to type details from the printed card.
- Banned and watch lists
- A Banned, VIP, Regulars or custom list entry created from a scan would keep personal information collected from that scan. Exclusion decisions also remain subject to Oregon's public-accommodation law.AgeShield setting: Each list entry can be created from a scan or entered by staff.
- Sharing across venues
- Oregon bars sharing and selling personal information collected from these scans, as well as storing it.AgeShield setting: Choose whether each list is shared across your venues.
- Consent screen
- Oregon's rule on age and authenticity scans has no consent exception, and the scanning law makes any waiver of its provisions void.AgeShield setting: The consent screen is available if your venue uses one as part of its own policy.
Common questions
Is it legal to scan IDs at a bar in Oregon?
Yes. Oregon expressly allows ID scanning to verify a customer's age.
Can a bar scan every customer in Oregon?
Yes, since January 1, 2026. Before that date, Oregon allowed an age scan only where there was reasonable doubt that the customer was 21 or older.
Do you have to check IDs in Oregon, and when?
It depends on what you sell. OLCC rules require an alcohol ID check for anyone who appears under 26, dispensaries check ID before every sale and federal law requires tobacco and vape retailers to check photo ID for buyers under 30.
Which IDs provide protection in Oregon?
For alcohol, a driver's license or ID card from a US state, the District of Columbia or Canada, an ID card from a US territory, a passport or passport card, a US military ID, a tribal ID card or a SENTRI or NEXUS card, each unexpired and showing the person's name, photo and date of birth. A customer without one of the listed IDs can use Oregon's signed statement-of-age process with supporting evidence.
Can you keep data from an ID scan in Oregon?
Not personal information from a scan performed for age verification or ID authenticity. Oregon prohibits storing, selling or sharing that scan-derived personal information, and customer consent does not create an exception.
Does a customer's consent change the Oregon rule?
No. The rule on age and authenticity scans has no consent exception, and Oregon's scanning law makes any waiver of its provisions void.
Does scanning give you a defense if you serve a minor in Oregon?
No. Oregon's alcohol protections turn on a signed statement of age where the customer has no listed ID, and on whether a reasonable person would have seen that the ID shown was altered or did not describe the customer.
What happens if a business violates the scanning law?
A customer can sue for actual damages or $5,000, whichever is greater. A court must award a winning customer reasonable costs and attorney fees, and may increase the award up to three times for a willful or knowing violation.
Sources
- ORS 807.750
- Oregon Laws 2025, chapter 603
- ORS 471.130
- OAR 845-006-0335
- ORS 475C.217
- 21 CFR 1140.14
- ORS 646A.602 and 646A.622
- OAR 845-009-0135
- ORS 659A.403
- ORS 167.755
This page is for informational purposes only and is not a substitute for professional legal advice. We research each rule and link its source, so you can check it against your own venue. Questions are welcome at support@ageshield.bar.
ID scanning laws in nearby states
Rules change across state lines. Compare the ID-scanning guidance for nearby states.
- State lawState law
Washington ID scanning laws
Washington sets no limits on what you keep from a scan. See why its liquor protection needs a signed card instead.
- State lawState law
Idaho ID scanning laws
Idaho allows ID scanning, and bars and lounges may not let customers under 21 inside. See which IDs count as proof of age.
- State lawState law
California ID scanning laws
California allows scanning only for listed purposes. See which fields you may keep and who you may never share them with.
Still unsure how Oregon applies to your venue?
Tell us what type of venue you run and we'll point you to the published rules we know of that may apply.