Law / United States / 
Pennsylvania
House Bill 78, sensitive data and biometric data definitions
Before the second chamber, dated , as of .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- Yes
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
Where it has got to
The text described here is Printer's Number 3688, as amended by the Senate Communications and Technology Committee. That print is PN 3688, published .
Locally, this stage is second consideration in the Senate.
The stage above is recorded at www.palegis.us.
House passed HB 78 (PN 1476) 127-76 on . Senate Consumer Protection and Professional Licensure Committee reported it as committed 14-0 on and re-referred it to Communications and Technology same day; that committee re-reported it as amended (PN 3688) 11-0 on . Senate gave it first consideration and second consideration , and laid it on the table and removed it from the table on ; no later action recorded. The 2025-2026 session runs through .
What it requires
- A faceprint or voiceprint deliberately extracted from a public photograph, video, or audio recording to identify someone is not biometric data under HB 78 as amended by Printer's Number 3688, unlike under Biometric Information Privacy Act (BIPA) or Wisconsin's breach statute, which carry no such exclusion.
- Obtain opt-in consent before processing sensitive data, including biometric or genetic data collected to uniquely identify an individual.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a faceprint or voiceprint that a business extracts from a photograph or recording to identify a specific person remain 'biometric data' under section 2 of House Bill 78 (Printer's No. 3688), or is it 'data generated from' a photograph or recording and so excluded?
What it makes you log
Logging duty
Section 2 is a list of definitions. It defines sensitive data (racial or ethnic origin, religious beliefs, health condition, sex life, citizenship or immigration status, genetic or biometric data used to identify an individual, data from a known child, precise geolocation, and the account and identity numbers added in the Senate text) and biometric data, and it defines a controller as a for-profit entity that does business in the Commonwealth and meets a revenue or data-volume threshold, and a consumer as an individual who is a resident of the Commonwealth. A definition imposes no duty, so the section states no log, record or audit duty; the data protection assessment of section 7 and the duties of sections 3 to 6 are in sections this row does not cite. The text is Printer's No. 3688 of a bill that has not been enacted.
- Kind
- None
- As of
What this law does
As amended (PN 3688), HB 78 would define biometric data as data generated by automatic measurements of an individual's biological characteristics, including fingerprints, voiceprints, eye retinas, irises, or other unique biological patterns or characteristics used to identify a specific individual, but the definition excludes a digital or physical photograph, an audio or video recording, or any data generated from either, with no exception for data generated to identify a specific person, unconditionally, unlike Kentucky's, Maryland's, Minnesota's, or New Jersey's clawback-shaped equivalents.
A separate clause also excludes an irreversible mathematical representation (a template or hash that cannot be used to recreate the underlying capture), and 'personal data' itself separately excludes biometric data converted to such a representation.
Sensitive data, requiring opt-in consent, includes the processing of genetic or biometric data to uniquely identify an individual, alongside race or ethnicity, religion, health, sexuality, citizenship or immigration status, child data, precise geolocation, and, added by the amendment, Social Security number, driver's license number, and financial account number with access credentials.
The bill passed the House 127-76 on and had second consideration in the Senate on . Pennsylvania has no enacted, freestanding biometric-privacy statute; a 2023-2024 session bill of that kind, HB 926, never advanced past introduction and has no confirmed 2025-2026 successor.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .