Pennsylvania HB 78: An Act providing for consumer data privacy, for duties of controllers and for duties of processors; and imposing penalties.

Bill Text

SENATE AMENDED
PRIOR PRINTER'S NOS. 65, 1024, 1476 PRINTER'S NO. 3688
THE GENERAL ASSEMBLY OF PENNSYLVANIA
HOUSE BILL
No. 78
Session of
2025
INTRODUCED BY NEILSON, SCIALABBA, HOWARD, MENTZER, LEADBETER,
SANCHEZ, HILL-EVANS, GIRAL, FRANKEL, KHAN, ARMANINI, WARREN,
FREEMAN, OTTEN, ZIMMERMAN, GILLEN, CIRESI, T. DAVIS,
K. HARRIS, INGLIS, SCHLEGEL, SCOTT, M. BROWN, HANBIDGE,
PIELLI AND MUNROE, JANUARY 14, 2025
SENATOR PENNYCUICK, COMMUNICATIONS AND TECHNOLOGY, IN SENATE,
RE-REPORTED AS AMENDED, JUNE 24, 2026
AN ACT
Providing for consumer data privacy, for duties of controllers
and for duties of processors; and imposing penalties.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Short title.
This act shall be known and may be cited as the Consumer Data
Privacy Act.
Section 2. Definitions.
The following words and phrases when used in this act shall
have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Affiliate." A legal entity that shares common branding with
another legal entity or controls, is controlled by or is under
common control with another legal entity.
"Biometric data." Data generated by automatic measurements
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

of an individual's biological characteristics, including
fingerprints, voiceprints, eye retinas, irises or other unique
biological patterns or characteristics that are used to identify
a specific individual. The term does not include a digital or
physical photograph, an audio or video recording or any data
generated from a digital or physical photograph or an audio or
video recording. The term does not include information captured
and converted to a mathematical representation, including a
numeric string or similar method that cannot be used to recreate
the data captured or converted to create the mathematical
representation.
"Business associate." As defined in 45 CFR 160.103 (relating
to definitions).
"Child." As defined in 15 U.S.C. § 6501 (relating to
definitions).
"Common branding." A shared name, servicemark or trademark.
"Consent." A clear affirmative act signifying a consumer's
freely given, specific, informed and unambiguous agreement to
allow the processing of personal data relating to the consumer.
The term includes a written statement, including by electronic
means, or any other unambiguous affirmative action specified in
this definition. The term does not include acceptance of general
or broad terms of use or a similar document that contains
descriptions of personal data processing along with other
unrelated information, hovering over, muting, pausing or closing
a given piece of content or an agreement obtained through the
use of dark patterns.
"Consumer." An individual who is a resident of this
Commonwealth. The term does not include an individual acting in
a commercial or employment context or as an employee, owner,
20250HB0078PN3688 - 2 -
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

director, officer or contractor of a company, partnership, sole
proprietorship, nonprofit or government agency whose
communications or transactions with a controller occur solely
within the context of that individual's role with the company,
partnership, sole proprietorship, nonprofit or government
agency.
"Control." Any of the following:
(1) Ownership of or the power to vote on more than 50%
of the outstanding shares of any class of voting security of
a controller.
(2) Control in any manner over the election of a
majority of the directors or over the individuals exercising
similar functions.
(3) The power to exercise a controlling influence over
the management of a company.
"Controller." As follows:
(1) A sole proprietorship, partnership, limited
liability company, corporation, association or other legal
entity that meets all of the following criteria:
(i) Is organized or operated for the profit or
financial benefit of its shareholders or other owners.
(ii) Alone or jointly with others, determines the
purposes and means of the processing of consumers'
personal information.
(iii) Does business in this Commonwealth.
(iv) Satisfies any of the following thresholds:
(A) Has annual gross revenues in excess of
$10,000,000.
(B) Alone or in combination, annually buys or
receives, sells or shares for commercial purposes,
20250HB0078PN3688 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

alone or in combination, the personal information of
at least 50,000 100,000 consumers, households or
devices.
(C) Derives at least 50% of annual revenues from
selling consumers' personal information.
(2) An entity that controls a sole proprietorship,
partnership, limited liability company, corporation,
association or other legal entity under paragraph (1). or
shares common branding with the sole proprietorship,
partnership, limited liability company, corporation,
association or other legal entity.
"Covered entity." As defined in