Bill > HB78

This bill establishes comprehensive consumer data privacy protections for Pennsylvania residents, creating a framework that gives consumers more control over their personal data while imposing specific obligations on businesses (called "controllers") that collect and process such data. Consumers are granted several key rights, including the ability to confirm what personal data is being processed, correct inaccuracies, delete their data, obtain a copy of their data, and opt out of certain data processing activities like targeted advertising or data sales. Controllers must limit data collection to what is necessary, protect the data with appropriate safeguards, obtain consent for processing sensitive data, and provide clear privacy notices explaining their data practices. The bill applies to businesses that meet certain revenue or data processing thresholds and includes extensive definitions of terms like "personal data," "sensitive data," and "targeted advertising." Enforcement is exclusively handled by the Pennsylvania Attorney General, who must initially provide businesses an opportunity to cure violations before taking action. The law will take effect one year after its passage, giving businesses time to adapt to the new requirements. Notably, the bill does not create a private right of action for consumers, meaning individuals cannot sue directly for violations, but violations can be treated as unfair trade practices.

Budget and Finance, Business and Industry, Labor and Employment

https://www.legis.state.pa.us/cfdocs/billinfo/bill_history.cfm?syear=2025&sind=0&body=H&type=B&bn=78