Law / United States / 
Pennsylvania
HB 78, Pennsylvania Consumer Data Privacy Act
Pennsylvania House Bill No. 78 (2025-2026 Reg. Sess.), pending
Before the second chamber, dated , as of .
An age-appropriate design code rule binding private bodies.
- Private right of action
- No
- Penalties
- Proposed exclusive enforcement by the Attorney General, no private right of action
- Audit expectation
- none
Where it has got to
The text described here is Printer's Number 3688, as amended by the Senate Communications and Technology Committee. That print is PN 3688, published .
Locally, this stage is second consideration in the Senate.
The stage above is recorded at www.palegis.us.
House passed HB 78 (PN 1476) 127-76 on . Senate Consumer Protection and Professional Licensure Committee reported it as committed 14-0 on and re-referred it to Communications and Technology same day; that committee re-reported it as amended (PN 3688) 11-0 on . Senate gave it first consideration and second consideration ; no action recorded since. The 2025-2026 session runs through .
What it requires
- As a controller, obtain opt in consent before processing the personal data of a known child under 13.
- As a controller, obtain opt in consent before processing a known minor's data under 16 for targeted advertising, sale, or profiling that produces legal or similarly significant effects.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Proposed: Pennsylvania Attorney General
Settledness
- As of
- Open questions
- Does the knowledge test in the targeted advertising and sale provision of Printer's Number 3688, which applies where a controller 'has actual knowledge and willfully disregards' that a consumer is younger than 16, require both actual knowledge and willful disregard, so that a controller that disregards a consumer's age without actual knowledge of it falls outside the provision?
What it reaches
Age threshold
16
Covered services
Controllers that would be subject to the proposed Pennsylvania Consumer Data Privacy Act processing data of a known child or minor
How the hook was established
express
What makes it apply
Data subject residence
What it makes you log
Logging duty
The minors provisions the row codes (section 5(a)(4) and (7) of Printer's Number 3688, consent for a known child's sensitive data and for a known under-16 consumer's targeted advertising or sale) state no log, record, retention period or regulator access. Section 7 of the same bill, a general data protection assessment duty for processing that presents a heightened risk of harm, is a documented record with Attorney General access, but it is not an age provision and the row does not cite it, so it is named here and not borrowed.
- Kind
- None
- As of
What this law does
Would require a controller to obtain opt in consent before processing the personal data of a known child under 13, and before processing a known minor's data under 16 for targeted advertising, sale, or profiling producing legal or similarly significant effects.
Passed the House 127 to 76 on , was reported by the Senate Consumer Protection and Professional Licensure Committee on and re-referred to the Senate Communications and Technology Committee, which re-reported it as amended on ; it received second consideration on and was laid on the table and removed from the table on , but has not passed the full Senate.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .