Pennsylvania HB 2108: An Act providing for duties of covered entities to protect the best interests of children that use online services, products or features and for data protection impact assessments; prohibiting certain actions by covered entities; and imposing penalties.

Bill Text

PRINTER'S NO. 2727
THE GENERAL ASSEMBLY OF PENNSYLVANIA
HOUSE BILL
No. 2108
Session of
2025
INTRODUCED BY McNEILL, STEELE, WAXMAN, FREEMAN, SANCHEZ,
McANDREW, RIVERA, D. WILLIAMS, HILL-EVANS AND PARKER,
DECEMBER 18, 2025
REFERRED TO COMMITTEE ON CHILDREN AND YOUTH, DECEMBER 18, 2025
AN ACT
Providing for duties of covered entities to protect the best
interests of children that use online services, products or
features and for data protection impact assessments;
prohibiting certain actions by covered entities; and imposing
penalties.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Short title.
This act shall be known and may be cited as the Online Safety
Protection Act.
Section 2. Findings and declarations.
The General Assembly finds and declares as follows:
(1) Covered entities that develop and provide online
services, products or features that children are likely to
access should consider the best interests of children when
designing, developing and providing that online service,
product or feature.
(2) If a conflict arises between commercial interests
and the best interests of children, covered entities that
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

develop online products, services or features likely to be
accessed by children should prioritize the privacy, safety
and well-being of children over commercial interests.
Section 3. Definitions.
The following words and phrases when used in this act shall
have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Actual knowledge." In relation to a covered entity that
chooses to conduct age estimation to determine whether a user is
a consumer under 18 years of age. The term does not include:
(1) data processing undertaken during the period when
the covered entity is estimating age;
(2) an erroneous estimation; or
(3) data processing in the absence of reasonable
evidence that a user is a consumer under 18 years of age.
"Best interests of children." The use, by a covered entity
that provides an online product reasonably likely to be accessed
by children, of the personal data of children or the design of
the online product in a way that will not infringe on children's
access to information and will not prioritize the covered
entity's commercial interests over children's interests in a way
that would cause:
(1) reasonably foreseeable and material physical or
financial harm to children;
(2) severe and reasonably foreseeable psychological or
emotional harm to children;
(3) a reasonably foreseeable and highly offensive
intrusion on children's reasonable expectation of privacy and
the risk of foregoing such harms was known to the covered
entity on the basis of a data protection impact assessment
20250HB2108PN2727 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

for the online product under this act; or
(4) unlawful discrimination against children based on
race, color, religion, national origin, disability, gender
identity, sex or sexual orientation.
"Child." A consumer who is under 18 years of age.
"Collect." The act of buying, renting, gathering, obtaining,
receiving or accessing personal information pertaining to a
consumer by any means. The term includes receiving information
from a consumer, either actively or passively, or by observing
the consumer's behavior.
"Consumer." An individual who is a resident of this
Commonwealth. The term does not include an individual acting in
a commercial or employment context or as an employee, owner,
director, officer or contractor of a company, partnership, sole
proprietorship, nonprofit entity or State agency whose
communications or transactions with a covered entity occur
solely within the context of the individual's role with the
company, partnership, sole proprietorship, nonprofit entity or
State agency.
"Covered entity." A business or organization that knowingly
processes a child's personal information.
"Dark pattern." A user interface knowingly designed with the
intended purpose of subverting or impairing user decision making
or choice.
"Data protection impact assessment." A systematic survey to
assess compliance with the duty to act in the best interests of
a child.
"Default." A preselected option adopted by a covered entity
for the online service, product or feature.
"Deidentified data." Data that meets all of the following
20250HB2108PN2727 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

criteria:
(1) The data cannot reasonably be linked to an
individual or a device linked to the individual.
(2) The data is in the possession of a covered entity
that:
(i) takes reasonable technical and administrative
measures to prevent the data from being reidentified;
(ii) does not attempt to reidentify the data and
publicly commits not to attempt to reidentify the data;
and
(iii) contractually obligates a person to which the
covered entity transfers the data to comply