PA HB78: Consumer Data Privacy Act

In one paragraph

Pennsylvania's HB 78 (Consumer Data Privacy Act) would give consumers rights to access, correct, delete and port personal data and to opt out of targeted advertising, data sales and profiling for solely automated decisions with legal or similarly significant effects. Controllers would need consent for sensitive data and data protection assessments; the Attorney General alone would enforce, with no private right of action. Passed the House 127-76 October 1, 2025; this describes the Senate-amended version (PN 3688), which has not passed the Senate.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None yet: the bill is pending in the Senate. If enacted, large data-handling businesses in Pennsylvania would have to honor opt-outs, get consent for sensitive data, run data protection assessments, and face Attorney General enforcement.

Key provisions

1. 1Applies to for-profit controllers doing business in Pennsylvania with over $10,000,000 in annual gross revenue, or that handle personal information of a threshold number of consumers, or that earn at least 50% of revenue from selling it; excludes the Commonwealth, nonprofits, higher education, financial institutions subject to Gramm-Leach-Bliley, and HIPAA covered entities and business associates
2. 2Consumers could confirm, correct, delete and obtain a copy of their data, and opt out of targeted advertising, sale, and profiling for solely automated decisions with legal or similarly significant effects; controllers would have to answer within 45 days (one 45-day extension) and offer an appeal answered within 60 days
3. 3Controllers would have to limit data collection, secure data, get consent before processing sensitive data (which includes biometric data used to identify a person and precise geolocation) and not process personal data in violation of anti-discrimination laws
4. 4Controllers would have to give a privacy notice and a link to opt out of targeted advertising or sale, and honor opt-out preference signals no later than January 1 of the year starting two years after the effective date
5. 5Controllers would have to conduct data protection assessments for heightened-risk processing, including targeted advertising, sale, sensitive data and certain profiling; processors would have to follow controller instructions under a binding contract
6. 6Only the Attorney General could enforce, treating violations as unfair or deceptive practices under the UTPCPL; a 60-day cure notice would be required (where a cure is possible) only in an initial window, then at the AG's discretion; the Senate-amended text bars any private right of action
7. 7Would take effect one year after enactment
8. 8Passed the House October 1, 2025 (127-76); in the Senate, re-reported as amended by the Communications and Technology Committee June 24, 2026 (PN 3688) and second consideration June 25, 2026; laid on and removed from the table October 6, 2026

Latest legislative action

Oct 6, 2026. Removed from table

Sponsors (showing 5 of 108)

Roll call votes (showing 3 of 6)