Law / United States / 
Pennsylvania
House Bill 78, sensitive data and biometric data definitions
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
Proposed: draft date not recorded.
Before the second chamber, dated 25 June 2026, as of 12 September 2026.
A sensitive categories rule binding private bodies.
As of 28 August 2026.
Where it has got to
The text described here is Printer's Number 3688, as amended by the Senate Communications and Technology Committee. That print is PN 3688, published 24 June 2026.
Locally, this stage is second consideration in the Senate.
The stage above is recorded at www.palegis.us.
House passed HB 78 (PN 1476) 127-76 on 2025-10-01. Senate Consumer Protection and Professional Licensure Committee reported it as committed 14-0 on 2026-02-04 and re-referred it to Communications and Technology same day; that committee re-reported it as amended (PN 3688) 11-0 on 2026-06-24. Senate gave it first consideration 2026-06-24 and second consideration 2026-06-25; no action recorded since. The 2025-2026 session runs through 2026-11-30.
What it requires
- This bill has not been enacted; do not treat its biometric-data definition as binding.
- If HB 78 is enacted as currently amended, a faceprint or voiceprint deliberately extracted from a public photograph, video, or audio recording to identify someone would not be biometric data under this bill, unlike under Biometric Information Privacy Act (BIPA) or Wisconsin's breach statute, which carry no such exclusion.
- If enacted, obtain opt-in consent before processing sensitive data, including biometric or genetic data collected to uniquely identify an individual.
What it reaches
Excludes recording-derived identifiersYes
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
As amended (PN 3688), HB 78 would define biometric data as data generated by automatic measurements of an individual's biological characteristics, including fingerprints, voiceprints, eye retinas, irises, or other unique biological patterns or characteristics used to identify a specific individual, but the definition excludes a digital or physical photograph, an audio or video recording, or any data generated from either, with no exception for data generated to identify a specific person, unconditionally, unlike Kentucky's, Maryland's, Minnesota's, or New Jersey's clawback-shaped equivalents.
A separate clause also excludes an irreversible mathematical representation (a template or hash that cannot be used to recreate the underlying capture), and 'personal data' itself separately excludes biometric data converted to such a representation.
Sensitive data, requiring opt-in consent, includes the processing of genetic or biometric data to uniquely identify an individual, alongside race or ethnicity, religion, health, sexuality, citizenship or immigration status, child data, precise geolocation, and, added by the 24 June 2026 amendment, Social Security number, driver's license number, and financial account number with access credentials. This bill has not been enacted and binds nothing today.
Pennsylvania has no enacted, freestanding biometric-privacy statute; a 2023-2024 session bill of that kind, HB 926, never advanced past introduction and has no confirmed 2025-2026 successor.
When LexLint raises it
processes_biometricsprocesses_voicecrawls_webtrains_models
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.