Oregon School Internet Safety Laws
A plain guide for Oregon technology directors, school librarians and principals. It covers what federal CIPA requires, what Oregon adds and what that means for the filter you run on student devices.
We found no Oregon statute that requires schools to filter the internet. CIPA is the filtering rule. Oregon's own rules are about phones (Executive Order 25-09) and student data held by edtech companies (OSIPA).
Oregon at a glance
Four questions decide what an Oregon school has to do online. Only one of them is answered by Oregon law on filtering itself, and the answer is no.
Federal CIPA
Filter, internet safety policy, monitoring of minors and online safety education. Certified every funding year.
State filtering statute
No Oregon law we could find adds its own filtering duty for K-12 schools. A 2025 bill proposed one but was not enacted at our last check.
Phone policy
Executive Order 25-09 required every district to ban student phone use during instructional hours from January 1, 2026.
Student data
OSIPA, ORS 336.184, limits what K-12 online service operators may do with student information.
The CIPA baseline for Oregon schools and libraries
The Children's Internet Protection Act applies to any Oregon school or library that takes E-Rate discounts for internet access or internal connections. If you need the background first, start with what is CIPA.
Technology protection measure
Block or filter visual depictions that are obscene or child pornography for every user, and those harmful to minors on computers that minors use.
Internet safety policy
Address inappropriate material, safety in email and chat, hacking, unauthorized disclosure of minors' personal data and the filter itself. Adopt after reasonable public notice and at least one hearing or meeting.
Monitoring and education
Schools monitor the online activities of minors and teach appropriate online behavior, including social networking safety and cyberbullying awareness.
Certification
- Schools and libraries certify on FCC Form 486 each funding year.
- Members of a consortium certify to the lead applicant on Form 479.
- A missed or wrong certification can put the year's discounts at risk.
Adults and research
- An authorized person may disable the filter for an adult doing bona fide research or other lawful work.
- CIPA does not list categories. Your district decides which categories meet "harmful to minors" for each age group.
- CIPA does not require tracking individual students' browsing histories.
No state filtering statute means the quality of your CIPA set-up is the whole defence
Oregon asks for a phone policy and for care with student data, but on filtering it relies on CIPA alone. Our hosted CIPA filter gives an Oregon district category rules that you can export and explain, run as a DNS service on our side.
- Separate settings per school let elementary and secondary rules differ
- Guest and BYOD networks can be pointed at the same filter as school devices
- Reports stay at the level of schools and categories, which is how CIPA monitoring is usually shown
What Oregon adds beyond CIPA
Oregon's additions sit around the filter rather than inside it. Here is each one, with its status at our last check in October 2026.
| Rule | What it does | Who it binds | Status |
|---|---|---|---|
| Executive Order 25-09 (July 2025) | Requires district policies that ban student cellphone use during instructional hours | All Oregon school districts | Policies due October 31, 2025; full implementation January 1, 2026 |
| ORS 336.184, Oregon Student Information Protection Act | Limits use, sale and disclosure of student information by K-12 online service operators | Edtech operators, including filtering and monitoring vendors that handle student data | In force since January 1, 2016 |
| HB 2251 (2025) | Would have written a whole-day phone ban into statute | Districts | Failed in a Senate committee |
| HB 3456 (2025) | Would have required district and library boards to adopt internet safety policies that comply with CIPA | District and public library boards | Introduced; not enacted at our last check |
Executive Order 25-09: the Oregon phone order
After HB 2251 stalled, Governor Tina Kotek used an executive order to set a statewide expectation. It is a phone rule, not a filtering rule, but it changes where students go online during the day.
- 2025 session
HB 2251 does not pass
The bill would have banned phones for the whole school day with medical and IEP exemptions. It failed to clear a Senate committee vote after school board and administrator groups pressed for local control.
- July 2, 2025
Order signed
Executive Order 25-09 directs every district to adopt a policy banning student cellphone use from the start to the end of regular instructional hours.
- October 31, 2025
Policies adopted
Districts had to adopt their policies by this date. Model policies were offered for districts that already had restrictions.
- January 1, 2026
Full implementation
Policies had to be fully in effect. Students whose medical provider or IEP requires access to a phone are exempt.
Devices the order covers
- Portable, battery powered devices that can make calls and reach the internet on their own, without school Wi-Fi.
- Cellphones and smartwatches with their own connection.
- Not laptops or other devices that support classroom learning.
What it means for your network
- With phones away, more browsing happens on school devices, which your CIPA filter already covers.
- Students who bring phones may still try school Wi-Fi at lunch or after class. Put guest and BYOD networks on the student rule set.
- Block VPN / Proxy / Anonymizers so phone traffic cannot tunnel around the filter. See blocking proxy sites in schools.
Putting guest and BYOD networks under the student rules
The filter needs one DNS setting on the router or firewall, so a guest network can use it too. VPN/Proxy stays blocked even when staff use the PIN bypass.
Student data: OSIPA and your filtering vendor
The Oregon Student Information Protection Act came from SB 187 in 2015. It applies to operators of websites, online services and apps used mainly for K-12 school purposes, which can include filtering, monitoring and classroom tools.
No targeted advertising
Operators may not use student information to target ads to students or parents.
No profiles for other purposes
Operators may not build a profile of a student except for K-12 school purposes.
No sale of student data
Selling covered information, or disclosing it outside the allowed purposes, is barred.
Reasonable security
Operators must protect student information with security suited to its sensitivity.
Narrow exceptions
The Act allows some limited disclosures, for example to serve the school purpose or meet legal duties. Read the statute for the exact list before signing a contract.
Federal law too
FERPA and COPPA still apply. Read student data privacy and filtering for how they fit.
What it means for filtering and monitoring in Oregon
With CIPA as the only filtering rule, your choices are local. These decisions give you a defensible Oregon setup that meets CIPA and respects OSIPA.
| Decision | Recommended setting | Why |
|---|---|---|
| All users | Block Adult on every device and network | CIPA covers obscene content and child abuse imagery for adults too |
| Elementary students | Add Gambling, Illegal Drugs, Weapons, Violence, Hate/Discrimination, Dating, Alcohol, Tobacco, Lingerie/Swimsuits/Intimate Apparel, VPN / Proxy / Anonymizers, File Sharing/P2P | A broad reading of harmful to minors suits younger children |
| Secondary students | Keep the core blocks; open health, news and research topics that older students need | Over-blocking harms coursework and draws complaints |
| School devices at home | Same student rule set off campus | Devices go home every night; see filtering school devices off campus |
| Logs | Category-level reporting; short retention for named-student logs | Meets CIPA monitoring without building student profiles |
| AI tools | Allow approved tools, block the rest by category | No Oregon statute requires an AI block; it is a policy choice |
AI tools by list
The AI tools blocklist for schools separates chatbots, image generators and writing tools so you can allow some and block others.
Filtering is not monitoring
CIPA monitoring can be supervision plus reports. See filtering vs monitoring vs classroom management.
Fresh categories
About 300,000 new domains are categorized every day and checked again after a week and a month, so new proxy and adult sites are caught early.
Research sites older Oregon students need, with their categories
The guide says to keep health, news and research topics open for secondary students. These are real results from our database that show what such sites are called.
| Domain | Categories in our data | Use in a secondary course |
|---|---|---|
| who.int | Health & Medicine | Health class reading |
| kidshealth.org | Health & Medicine, Education/Reference | Health topics written for young people |
| apnews.com | News/Media, Political | Civics and current events |
| noaa.gov | Science | Earth science data |
| smithsonianmag.com | Science, Arts & Entertainment, News/Media | Three labels, so a single-category rule could miss it |
Common Oregon misreadings
Because Oregon's rules arrived through an executive order and a privacy statute rather than a filtering law, staff and parents often mix them up. These are the points we hear confused most.
| What people say | What actually applies |
|---|---|
| "The phone ban means Oregon now requires filtering." | The order limits personal phone use. It says nothing about which sites a school network must block. CIPA is still the filtering rule. |
| "Oregon law lists the categories we must block." | Neither CIPA nor Oregon law lists categories. Your district decides, and should write the reasons down. |
| "Monitoring means we must record every site each student visits." | CIPA monitoring can be adult supervision plus summary reports. Detailed per-student logs create OSIPA and FERPA duties. |
| "Smartwatches are fine because they are not phones." | The order covers watches that can call or reach the internet without school Wi-Fi. Watches that only tell time are a local call. |
| "HB 3456 made internet safety policies a state law." | It was introduced in 2025 and had not been enacted at our last check. Your policy duty comes from CIPA. |
| "If we drop E-Rate, nothing applies." | CIPA would no longer apply, but the phone order, OSIPA, FERPA and your own duty of care still do. |
School libraries and public libraries in Oregon
School libraries follow the district's CIPA program. Public libraries are a separate case, and Oregon has many that serve students after school.
School library media centers
- Use the same student rule sets as classrooms, by grade band.
- Give librarians a fast route to request unblocks for research topics.
- Keep research categories such as Health & Medicine and News/Media open for older students.
- Teach search skills and source checking as part of the CIPA education duty.
Public libraries
- CIPA applies when the library takes E-Rate for internet access or certain federal library grants for internet access.
- Adults may ask for the filter to be disabled for lawful purposes.
- Many libraries run a filtered children's network and a separate adult setup.
- See web filtering for libraries for common designs.
Oregon checklist by role
Split the work so each owner knows their part. The federal items are covered in more depth in the CIPA compliance checklist.
Technology director
- Adult blocked for all users on every network
- Student rule sets by grade band, documented
- Guest and BYOD Wi-Fi on the student rule set
- VPN and proxy categories blocked for students
- Off-campus filtering active on take-home devices
- Log retention period set and written down
- Yearly filter test with results saved
Principal and staff
- Phone policy under EO 25-09 enforced during instructional hours
- Medical and IEP phone exemptions recorded
- Online safety lessons delivered and logged
- Unblock request route known to teachers
- Supervision in labs and libraries
- Incidents reported and reviewed
Board and business office
- Internet safety policy adopted after notice and a hearing or meeting
- Acceptable use policy updated for phones and AI
- Vendor contracts checked against OSIPA
- Form 486 or 479 filed on time
- Policy review on a set cycle
- Public copy of policies available
Evidence to keep
If an E-Rate reviewer, a parent or a reporter asks how you comply, these records answer the question. Keep one folder per school year.
| Record | Proves | Rule |
|---|---|---|
| Board minutes and public notice for the internet safety policy | Policy adopted with the required process | CIPA |
| Exported filter rule sets for each grade band and for staff | Technology protection measure in place | CIPA |
| Filter test results with date and devices tested | The measure actually works | CIPA |
| Lesson plans and attendance for online safety education | Education duty met | CIPA |
| Filed Form 486 or 479 and confirmation | Federal certification | CIPA |
| Adopted phone policy, adoption date and exemption log | Order followed on time | EO 25-09 |
| Vendor data agreements with OSIPA terms | Student data protected | ORS 336.184 |
| Log retention setting and deletion records | Data kept only as long as needed | OSIPA, FERPA |
Oregon decisions in the guide and how the hosted filter handles each
Each row picks up a decision from the recommended-settings table, with our product on one side and a manual approach on the other.
| Oregon decision | Hosted CIPA filter | Manual approach |
|---|---|---|
| Adult blocked for all users on every network | On in the CIPA preset from the start | Rule written network by network |
| Elementary and secondary rule sets | Switches set separately per school | Separate lists to keep in step |
| School devices at home | A private encrypted link applies the same rules | Rules end at the school door |
| Guest and BYOD Wi-Fi | One DNS setting points the network at the filter | Often left open |
| Unblock for a research topic | Always-allow entry for one school | Edit the main list |
| Category-level reporting | Activity reports and log export | Assembled by hand |
Oregon school internet safety FAQ
Does Oregon have a state law that requires school internet filtering?
We found no Oregon statute that requires K-12 schools to filter. CIPA is the filtering rule for E-Rate schools and libraries. HB 3456 (2025) proposed state internet safety policies but had not been enacted at our last check.
What does Executive Order 25-09 require?
Signed July 2, 2025, it required every district to adopt a policy banning student cellphone use during instructional hours by October 31, 2025, and to implement it by January 1, 2026. Medical and IEP needs are exempt.
Does the phone order cover school laptops?
No. It covers devices that can call and reach the internet without school Wi-Fi, such as phones and smartwatches. School laptops stay under your CIPA filter and policy.
What is OSIPA and why does it matter for a filter?
ORS 336.184 bars K-12 online service operators from targeted ads, non-school profiles and selling student data, and requires reasonable security. Filtering and monitoring vendors that handle student data should meet it.
Did Oregon pass a statewide school cellphone law?
HB 2251 (2025) failed in a Senate committee, so the governor acted by executive order. Check the current legislative record before assuming the rule is now in statute.
Do Oregon schools that skip E-Rate have to filter?
CIPA applies only with E-Rate or certain library grants. Without that funding and without a state statute, filtering is a local decision, though most districts filter anyway.
Are AI tools restricted by Oregon school law?
We found no Oregon statute that requires blocking AI tools. Allow the tools your district approves and block the rest by category.
Compare Oregon with other states
West Coast and Mountain West neighbours take very different approaches. All guides are on the school internet safety laws by state hub.
Related guides
Our Oregon quote depends on the number of schools and devices, and it reaches you within one business day. If you prefer to see results first, a pilot at one school shows the blocks and the reports.
Talk to us about your district
We can show how CIPA category filtering, grade-band rule sets and low-data reporting fit an Oregon district, on campus and at home.