Pennsylvania

Any person who knowingly sells, distributes, disseminates, displays, or possesses for such a purpose, any artificially generated child sexual abuse material commits an offense, as does any person who intentionally views or knowingly possesses or controls it.

Artificially generated child sexual abuse material is defined as material that appears to authentically depict a child under 18 engaging in a prohibited sexual act that did not occur in reality, whose production was substantially dependent on technical means including artificial intelligence.

An artificial intelligence developer, or its authorized employee or contractor, who reports such material to the National Center for Missing and Exploited Children as soon as reasonably possible upon obtaining actual knowledge of it, in compliance with 18 U.S.C. §§ 2258A and 2258B, is excepted from the offense. Act 125 of 2024 added this material category to a statute that previously reached only genuine child sexual abuse material, effective 60 days after its October 29, 2024 signature.

A person commits the offense of unlawful dissemination of intimate image if, with intent to harass, annoy or alarm another, the person disseminates an artificially generated sexual depiction of an individual, defined as a visual depiction that appears to authentically depict the individual in a state of nudity or engaged in sexual conduct that did not occur in reality, and whose production was substantially dependent on technical means including artificial intelligence or photo editing software.

Consent of the person depicted is a defense. Act 125 of 2024 added this depiction category and the supporting artificial intelligence definitions to a statute that previously reached only genuine visual depictions, effective 60 days after its October 29, 2024 signature.

A person is guilty of digital forgery if, with intent to defraud or injure anyone, the person generates or creates and distributes a forged digital likeness as genuine, knowing or reasonably knowing it to be a forged digital likeness.

A forged digital likeness is a computer-generated visual representation or audio recording of an actual, identifiable individual that has been created or modified to closely resemble a genuine representation, materially misrepresents the individual's appearance, speech, or behavior, is likely to deceive a reasonable person into believing it is genuine, and is created and distributed without the individual's consent.

It is an affirmative defense that the actor took reasonable action to notify viewers or listeners that the forged digital likeness was not genuine, and the section does not reach a constitutionally protected activity, a law enforcement officer's official duties, a provider or developer of the underlying technology, or an information service or access software provider. Act 35 of 2025, signed July 7, 2025, added this section, effective 60 days after signature.

The Senate passed this measure 48-2 on June 10, 2026. The House passed the same printer's number 163-40 on October 7, 2026. The Governor approved the bill on October 22, 2026, and it became Act 99 of 2026.

As passed, an advertiser may not knowingly, recklessly or willfully create and disseminate, or cause to be created and disseminated, an advertisement that uses synthetic content in a manner that creates a false consumer perception about the nature, origin or authenticity of the goods or services being advertised, without clear and conspicuous disclosure. The disclosure must state that the advertisement contains content that was modified or generated using artificial intelligence.

It must be displayed in the first instance whenever the synthetic content is presented to the consumer, presented in the same medium as the synthetic content, and, to the extent technically feasible, permanent or extraordinarily difficult to remove from it. The disclosure requirement does not reach content that is evidently fictional based on the content or context of the depiction, parody, satire, commentary or criticism, or content limited to text.

The Attorney General or a district attorney may bring an action to restrain a prohibited act by temporary or permanent injunction. A court may award a civil fine that does not exceed $3,000, together with actual attorney fees and court costs. The act takes effect 60 days after approval.

An entity that maintains, stores, or manages computerized data including personal information must provide notice of a breach of the security of the system, without unreasonable delay, to any Pennsylvania resident whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person.

Personal information is name plus a Social Security number, driver's license or state ID number, a financial account number with access credential, medical information held by a state agency or contractor, health insurance information, or a username or email with a password or security question, and excludes publicly available information lawfully available from government records or widely distributed media (added by the June 28, 2024 amendment); it does not reach biometric identifiers as such.

An entity that notifies more than 500 persons at one time (section 5 was amended on June 28, 2024) must also notify nationwide consumer reporting agencies. A state agency's own breach separately requires Attorney General notice within seven business days. Since the June 28, 2024 amendment, an entity that must give notice to more than 500 affected individuals in the Commonwealth must also notify the Office of Attorney General concurrently.

An entity subject to the insurance data security chapter of Title 40 is exempt from that Attorney General notice duty. Since the June 28, 2024 amendment, an entity that determines a breach of the security of the system has occurred, and reasonably believes that an individual's name in combination with a Social Security number, bank account number, or driver's license or State ID number has been accessed, is subject to the credit reporting and monitoring requirements.

Those requirements are that the entity assume the cost of one independent credit report for an individual not eligible for a free one and of credit monitoring services for 12 months following notification, a requirement the entity may satisfy by notifying the individual that monitoring is available for 12 months at no cost.

A violation is deemed an unfair or deceptive practice under the Unfair Trade Practices and Consumer Protection Law, 73 P.S. secs. 201-1 to 201-9.3, but the Office of Attorney General has exclusive authority to bring that action, so the Act creates no private right of action even though its deeming clause would otherwise open a UDAP route the way Connecticut's breach statute does.

Section 4518(a) requires a licensee to notify the commissioner as promptly as possible, but in no event later than five business days from a determination that a cybersecurity event involving nonpublic information in the licensee's possession has occurred, when either of two criteria is met.

The first criterion in section 4518(a) is a cybersecurity event with a reasonable likelihood of materially harming a consumer residing in this Commonwealth or any material part of the licensee's normal operations, where this Commonwealth is the insurer's state of domicile or the insurance producer's home state.

The second criterion in section 4518(a) is the licensee's reasonable belief that the nonpublic information involves 250 or more consumers residing in this Commonwealth and that the event either requires notice to a governmental body, self-regulatory agency or other supervisory body under federal or state law or has a reasonable likelihood of materially harming a consumer or a material part of the licensee's normal operations.

Section 4518(b) requires the licensee to provide as much as possible of thirteen listed items of information about the event in electronic form, beginning with the date of the event and ending with the name of a contact person. Section 4518(c) gives the licensee a continuing obligation to update and supplement its notifications to the commissioner regarding material changes to previously provided information.

Section 4518(d) requires a licensee that must notify the commissioner to comply with section 3 of the Breach of Personal Information Notification Act and to provide the commissioner a copy of the notice sent to consumers. Section 4518(f) requires an assuming insurer to notify its affected ceding insurers and the commissioner of its state of domicile within three business days of making the determination that a cybersecurity event has occurred.

Section 4502 defines a licensee to include a person that is or is required to be licensed, authorized to operate or registered under the insurance laws of this Commonwealth. Section 4532(a) exempts a licensee with fewer than 10 employees, less than $5,000,000 in gross revenue or less than $10,000,000 in year-end total assets from sections 4512 through 4516, which do not include section 4518.

Section 4532(b) deems a licensee governed by the federal health privacy, security and breach notification rules, and that maintains nonpublic information in the same manner as protected health information, to comply with the chapter except for the notification requirements of section 4518(a), (b) and (c).

Section 4522 lets the commissioner, after notice and hearing, suspend or revoke a licensee's license, authorization to operate or registration, refuse to issue or renew it, or issue a cease and desist order. Section 4522 lets the commissioner impose a penalty of not more than $5,000 for each violation that a licensee knew or reasonably should have known was a violation, not to exceed $100,000 in a single calendar year.

Section 4522 lets the commissioner impose a penalty of not more than $1,000 for each violation that a licensee did not know nor reasonably should have known was a violation, not to exceed $20,000 in a single calendar year. Section 4534(a) provides that nothing in the chapter creates or implies a private cause of action for a violation of the chapter. Chapter 45 of Title 40 was added on June 14, 2023 by Act 2 of 2023, effective in 180 days.

Section 4517(d) requires a licensee to maintain records concerning all cybersecurity events for a period of at least five years from the date of the cybersecurity event. The licensee must produce those records upon demand of the commissioner. Section 4517(a) requires a licensee that discovers that a cybersecurity event has or may have occurred to conduct, or to have a designated outside vendor or service provider conduct, a prompt investigation.

Section 4516(a) requires each insurer domiciled in this Commonwealth to submit to the commissioner a written statement certifying that the insurer is in compliance. Section 4516(b)(1) requires each insurer to maintain all records, schedules and data supporting the certification for a period of five years and to make that information available for examination by the department.

Section 4502 defines a licensee to include a person that is or is required to be licensed, authorized to operate or registered under the insurance laws of this Commonwealth. Section 4532(a) exempts a licensee with fewer than 10 employees, less than $5,000,000 in gross revenue or less than $10,000,000 in year-end total assets from sections 4512 through 4516, a range that includes section 4516 but not section 4517.

Section 4521(a) gives the commissioner the powers of Article IX of The Insurance Department Act of 1921 to examine and investigate an insurer to determine whether it has violated section 4512, 4513, 4514, 4515 or 4516. Section 4521(b)(1) gives the commissioner the power to examine and investigate a licensee not subject to Article IX of that act to determine whether the licensee has violated the chapter.

Section 4522 lets the commissioner impose a penalty of not more than $5,000 for each violation that a licensee knew or reasonably should have known was a violation, not to exceed $100,000 in a single calendar year. Section 4522 lets the commissioner impose a penalty of not more than $1,000 for each violation that a licensee did not know nor reasonably should have known was a violation, not to exceed $20,000 in a single calendar year. Chapter 45 of Title 40 was added on June 14, 2023 by Act 2 of 2023, effective in 180 days.

Chapter 146a applies to nonpublic personal financial information about individuals who obtain or are claimants or beneficiaries of products or services primarily for personal, family or household purposes from licensees.

Section 146a.2 defines a licensee to include a licensed insurer, a producer and other persons or entities licensed or required to be licensed, authorized or registered under The Insurance Department Act of 1921 or The Insurance Company Law of 1921, including health maintenance organizations holding a certificate of authority.

Section 146a.11(a) requires a licensee to provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to a customer not later than when the licensee establishes a customer relationship. Section 146a.11(a) also requires that notice to a consumer before the licensee discloses nonpublic personal financial information about the consumer to any nonaffiliated third party, other than as authorized by the exceptions in sections 146a.32 and 146a.33.

Section 146a.12 requires a licensee to provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship. Section 146a.13 requires each privacy notice to include the categories of nonpublic personal financial information that the licensee collects and discloses, and the categories of affiliates and nonaffiliated third parties to whom the licensee discloses it.

Section 146a.21(a) bars a licensee from disclosing nonpublic personal financial information about a consumer to a nonaffiliated third party, directly or through an affiliate, unless it has given the initial notice and the opt out notice, has given the consumer a reasonable opportunity to opt out, and the consumer does not opt out. Section 146a.42 bars a licensee from unfairly discriminating against any consumer or customer because that person has opted out of the disclosure.

Section 146a.43 provides that violations of the chapter are deemed and defined by the Commissioner to be an unfair method of competition and an unfair or deceptive act or practice, subject to the applicable penalties or remedies of the Unfair Insurance Practices Act. Section 9 of the Unfair Insurance Practices Act lets the commissioner, after a hearing, order a person to cease and desist from a violation or, for a practice defined in section 5, suspend or revoke the person's license.

Section 11 of the Unfair Insurance Practices Act lets a court, in an action the commissioner files, impose a civil penalty of not more than $5,000 for each violation that the person knew or reasonably should have known was a violation, not to exceed $50,000 in any six month period.

Section 11 of the Unfair Insurance Practices Act also lets a court impose a civil penalty of not more than $1,000 for each violation that the person did not know nor reasonably should have known was a violation, not to exceed $10,000 in any six month period. Section 146a.44(a) provides that the chapter is effective July 1, 2001. Section 146a.1 was amended August 9, 2019, effective August 10, 2019.

Section 5(a) of the Confidentiality of HIV-Related Information Act provides that, except as section 6 provides with respect to the involuntary testing of a source patient, no HIV-related test shall be performed without first obtaining the informed documented consent of the subject. Section 5(a), as amended July 7, 2011, lets a health care provider offer opt-out HIV testing, where the subject is informed that the subject will be tested for HIV unless the subject refuses.

Section 3 defines confidential HIV-related information as information in the possession of a person who provides one or more health or social services, or who obtains it under a release, that concerns whether an individual has been the subject of an HIV-related test or has HIV, HIV-related illness or AIDS.

Section 3 defines an institutional health care provider to include a hospital, nursing home, hospice, clinic, blood bank, clinical laboratory and any health care institution required to be licensed in this Commonwealth, whether privately or publicly operated.

Section 7(a) bars a person or employee, or agent of such person, who obtains confidential HIV-related information in the course of providing any health or social service, or under a release, from disclosing or being compelled to disclose it except to the persons the subsection lists, among them the subject and any person specifically designated in a written consent.

Section 7(b) bars a person to whom confidential HIV-related information has been disclosed under the act from disclosing it to another person except as the act authorizes. Section 7(c) lists nine required elements of a written consent to disclosure, from the name of the person permitted to make the disclosure to the date, event or condition on which the consent expires.

Section 10 gives any person aggrieved by a violation of the act a cause of action against the person who committed the violation and the right to recover compensatory damages. Section 10 also lets an aggrieved person recover reasonable attorney fees and costs for a violation of section 6 by a source patient's physician or an employee of the physician.

Section 11 makes each disclosure of confidential HIV-related information in violation of the act, and each HIV-related test conducted in contravention of the act, separate for purposes of civil liability. Section 13 provides that the act takes effect in 90 days. Act 148 of 1990 is dated November 29, 1990.

Section 1(a) of the Privacy of Social Security Numbers Law provides that a person or entity or State agency or political subdivision shall not publicly post or publicly display in any manner an individual's Social Security number, print it on any card required for the individual to access products or services, require its transmission over the Internet unless the connection is secure or the number is encrypted, require its use to access an Internet website unless a password or other authentication device is also required, print it on materials mailed to the individual unless Federal or State law requires it, or disclose in any manner, except to the agency issuing the license, the Social Security number of an individual who applies for a recreational license.

Section 1(a)(5) bars printing an individual's Social Security number on any materials that are mailed to the individual unless Federal or State law requires the number to be on the document to be mailed. Section 1(c) lets an individual who receives the annual disclosure of a continuing prior use stop that use by written request, and requires the person or entity to discontinue the use within 30 days of receipt of the request, with no fee and no denial of services.

Section 1(g) deems a violation a summary offense punishable by a fine of not less than $50 and not more than $500 and, for every second or subsequent violation, by a fine of not less than $500 and not more than $5,000. Section 2 gives the district attorneys of the several counties and the Attorney General authority to investigate and to institute criminal proceedings for any violation of the act.

Section 4 provides that the act does not apply to a financial institution subject to Title V of the Gramm-Leach-Bliley Act or to a licensee as defined by the Insurance Department's privacy regulation, a covered entity under the federal health privacy rules, or an entity subject to the Fair Credit Reporting Act. Section 5 provides that the act takes effect in 180 days. The act is Act 60 of 2006, dated June 29, 2006.

Chapter 146b governs the treatment of all nonpublic personal health information about individuals by various licensees of the Department. Section 146b.11(a) bars a licensee from disclosing nonpublic personal health information about a consumer unless an authorization is obtained from the consumer whose information is sought to be disclosed.

Section 146b.11(b) provides that nothing in the section prohibits, restricts or requires an authorization for disclosure of nonpublic personal health information to the extent necessary for listed insurance functions, among them claims administration, claims adjustment, fraud detection and underwriting. Section 146b.21(a) provides that, irrespective of whether a licensee is subject to the federal regulation, a licensee that complies with the federal regulation is not subject to the chapter.

Section 146b.22 bars a licensee from unfairly discriminating against a consumer because that consumer has not granted authorization for the disclosure. Section 146b.23 provides that violations of the chapter are deemed and defined by the Commissioner to be an unfair method of competition and an unfair or deceptive act or practice, subject to the applicable penalties or remedies of the Unfair Insurance Practices Act. Chapter 146b was adopted on October 25, 2002.

Section 146b.24 requires a licensee to comply with the applicable requirements of the chapter by the corresponding compliance date applicable to the federal regulation.

A person commits unlawful use of a computer if, intentionally and without authorization, the person accesses or exceeds authorization to access, alters, interferes with the operation of, damages, or destroys a computer, computer system, computer network, computer software, computer database, or World Wide Web site (18 Pa.C.S. § 7611(a)(2)); bare unauthorized access to such a resource is itself the offense, with no separate showing of malice, deception, or resulting harm required.

Neighboring sections separately criminalize disruption of service including denial-of-service attacks (§ 7612), computer theft of data taken with intent to deprive the owner of it (§ 7613), unlawful duplication of computer data or software (§ 7614), computer trespass carried out with intent to remove or alter data, cause a malfunction, or effect an unauthorized funds transfer (§ 7615), and distribution of a computer virus (§ 7616).

Section 7605 provides a defense where the actor reasonably believed the owner had authorized or would have authorized the conduct, and defines authorization to include express or implied consent, including by trade usage, course of dealing, course of performance, or commercial programming practices.

Section 7606 states that nothing in this subchapter interferes with or prohibits the terms or conditions of a contract or license governing a computer, computer network, or database, preserving ordinary contract-based terms-of-service enforcement as a separate track from this statute. The chapter was added December 16, 2002, effective 60 days later.

Section 4512 requires a licensee to conduct a risk assessment that identifies reasonably foreseeable internal or external threats that could result in unauthorized access, transmission, disclosure, misuse, alteration or destruction of nonpublic information. Section 4513 requires each licensee to develop, implement and maintain a comprehensive written information security program based on the licensee's risk assessment.

A licensee must determine which security measures are appropriate and implement them, and the measures the section lists include effective controls, which may include multifactor authentication procedures, for any employees accessing nonpublic information.

The listed measures include protecting, by encryption or other appropriate means, all nonpublic information transmitted over an external network and all nonpublic information stored on a laptop computer or other portable computing or storage device or media.

Each licensee must establish and maintain a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information in its possession, its information systems or the continuing functionality of any aspect of its business or operations.

If a licensee has a board of directors, the board or an appropriate committee of the board must require the licensee's executive management or delegates to develop, implement and maintain the licensee's information security program.

A licensee must exercise due diligence in selecting its third-party service provider and require the provider to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider. Each insurer domiciled in Pennsylvania must submit to the commissioner each April 15 a written statement certifying that the insurer is in compliance with sections 4512 through 4515.

If a licensee discovers that a cybersecurity event has or may have occurred, the licensee or an outside vendor or service provider designated to act on its behalf must conduct a prompt investigation. A licensee must maintain records concerning all cybersecurity events for a period of at least five years from the date of the cybersecurity event and produce those records upon demand of the commissioner.

A licensee with fewer than 10 employees, less than $5,000,000 in gross revenue or less than $10,000,000 in year-end total assets is exempt from sections 4512 through 4516. A licensee is a person that is or is required to be licensed, authorized to operate or registered under the insurance laws of Pennsylvania. Act 2 of 2023 provides that the addition of the chapter takes effect in 180 days.

Chapter 101 requires a jurisdictional utility to develop and maintain appropriate written physical security, cyber security, emergency response and business continuity plans to protect the Commonwealth's infrastructure and ensure safe, continuous and reliable utility service. A jurisdictional utility is a utility subject to the reporting requirements of section 27.10, 29.43, 31.10, 33.103, 57.47, 59.48, 61.28, 63.36 or 65.19 of the Commission's regulations.

A cyber security plan must, at a minimum, include critical functions requiring automated processing, appropriate backup for application software and data, alternative methods for meeting critical functional responsibilities in the absence of information technology capabilities, and a recognition of the critical time period for each information system before the utility could no longer continue to operate. A jurisdictional utility must review and update these plans annually.

A jurisdictional utility must maintain and implement an annual testing schedule of these plans. A jurisdictional utility must demonstrate compliance through submittal of a Self Certification Form, which is available at the Secretary's Bureau and on the Commission's website. A utility under the Annual Financial Report requirements must file the Self Certification Form at the time each Annual Financial Report is filed.

The Commission may review a utility's cyber security plan, physical security plan, emergency response plan and business continuity plan. The chapter does not apply to an entity regulated by the Federal Railroad Safety Act and the Hazardous Materials Transportation Act that, by August 10, 2005, submitted a certification that it has its own plans in place and is in compliance with those Acts. Chapter 101 was adopted June 10, 2005, effective June 11, 2005.

Chapter 76 of the Crimes Code, which holds this section, was added December 16, 2002 by Act No. 226, the same day the Unsolicited Telecommunication Advertisement Act was approved.

The offense reaches a person who, without authority and with intent to falsify or forge electronic mail transmission or other routing information, uses a computer or computer network in connection with the transmission of unsolicited electronic mail through or into the network of an electronic mail service provider, an Internet service provider or its subscribers, or who sells, gives, distributes, or possesses with intent to distribute software primarily designed for that falsification, with only limited other commercially significant use, or marketed for it.

For this section, "electronic mail" is defined to include a facsimile and a wireless advertisement in addition to ordinary email.

The offense is ordinarily a misdemeanor of the third degree punishable by a fine of not more than $2,500; it is a misdemeanor of the first degree, punishable by a fine of not more than $10,000, where the violator's reckless disregard causes at least $2,500 in property damage to another, and a felony of the third degree, punishable by a fine of not more than $15,000, where the violator's malicious act causes that damage.

The section provides no civil action; the Attorney General has concurrent prosecutorial jurisdiction with the county district attorney for a violation of this chapter. No day on which the section came into force has been located.

The Act, approved December 16, 2002 and in force 90 days later, bars a person from initiating, conspiring to initiate, or assisting the transmission of an unsolicited commercial electronic mail message or fax from a computer or fax machine in Pennsylvania or to an electronic mail address, where the message uses a third party's Internet domain name in the return address without permission, carries false or misleading return-address information such that the recipient could not reply to the sender, carries false or misleading information in the subject line, or comes from a sender that fails to operate a valid return email address or toll-free number the recipient can use to ask it to stop.

A commercial electronic mail message is one sent to promote real property, goods or services, not counting one sent as a result of an established business relationship or one carrying an advertisement an interactive computer service attached, with the sender's agreement, in exchange for a free email account.

The Act also bars using a covered mobile telephone messaging system to transmit an unsolicited commercial electronic mail message, and bars falsifying or forging email, fax or wireless-advertisement routing information, misrepresenting or obscuring a message's point of origin or transmission path, and distributing software primarily designed to enable that falsification.

A wireless advertisement is a call or a text, graphic or image message sent through a wireless carrier to market goods or services, not counting one sent with the recipient's prior express invitation or permission or to a person with whom the caller has an established business relationship.

Its bars on a misused domain name and on false or misleading return-address, subject-line and routing information are framed as rules against falsity or deception, the kind of state email rule the CAN-SPAM Act's preemption clause leaves in force; the duty to operate a working return address or toll-free number is not framed that way. A violation is a violation of the Unfair Trade Practices and Consumer Protection Law, and the Attorney General may bring a civil-penalty and injunctive action.

An aggrieved Internet access provider, electronic mail service provider, or wireless telecommunication company, but not an individual message recipient, may sue to enjoin the violation and recover $1 to $10 for each unsolicited message received, each a separate violation, an amount the court may in its discretion increase up to $1,500,000 for a willful violation, plus reasonable attorney's fees and costs.

A person providing Internet access, electronic mail service, or wireless telecommunication service may, without incurring liability, block or filter mail it reasonably believes violates the Act.

Section 3 of the Consumer Protection Against Computer Spyware Act bars a person or entity that is not an authorized user, acting with actual knowledge, with conscious avoidance of actual knowledge or willfully, from causing computer software to be copied onto the computer of an authorized user in Pennsylvania, or procuring the copying, and using the software to do any of the acts it lists or any other acts deemed to be deceptive.

An authorized user is, with respect to a computer, a person who owns it or is authorized by the owner or lessee to use it. The Act was approved on October 27, 2010 and took effect 60 days later.

Computer software is a sequence of instructions written in any programming language that is executed on a computer, and the term does not include a text or data file, an Internet website or a data component of an Internet website that is not executable independently of the Internet website.

To cause software to be copied is to distribute, transfer or procure the copying of computer software or any component of it, and the term does not include transmission, routing, or the provision of intermediate temporary storage or caching of software, a storage or hosting medium through which a third party distributed the software, or an information location tool through which the user of the computer located the software.

Deception includes an intentionally and materially false or fraudulent statement, a statement or description that intentionally omits or misrepresents material information in order to deceive the authorized user, and an intentional and material failure to provide any notice to an authorized user regarding the download or installation of software in order to deceive the authorized user.

The section 3 acts include modifying through deceptive means the page that appears when a browser launches, the default provider or proxy used to access or search the Internet, or the authorized user's list of bookmarks.

They also include collecting through deceptive means personally identifiable information by a keystroke-logging function that records all keystrokes made by an authorized user and transfers them to another person, or that includes all or substantially all of the websites the user visits other than the software provider's own where the software was installed in a manner designed to conceal the installation from all authorized users.

Section 4 applies to the same class of person on the same knowledge standard and lists acts by which the software takes control of the authorized user's computer.

Section 5 bars a person or entity that is not an authorized user from inducing an authorized user to install a software component by misrepresenting that installing software is necessary for security or privacy reasons or in order to open, view or play a particular type of content, and from causing the copying and execution of a software component with the intent of causing an authorized user to use it in a way that violates that section.

Section 6 provides that nothing in section 4 or 5 applies to monitoring of or interaction with a user's Internet or other network connection or service, or a protected computer, by a cable operator, computer hardware or software provider or provider of information service or interactive computer service for network or computer security purposes, diagnostics, technical support, repair, authorized updates of software or system firmware, network management or maintenance, authorized remote system management, or detection or prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service or computer software, including scanning for and removing software the Act proscribes.

The district attorneys of the counties and the Attorney General each have authority to investigate and institute criminal proceedings for any violation of the Act. A person that violates sections 3(2) and 4(1)(i), (ii) and (iii) and (2) commits a felony of the second degree and is sentenced on conviction to imprisonment for not more than ten years or to pay a fine of not more than $25,000, or both.

The Act lets a provider of computer software adversely affected by a violation, an Internet Service Provider adversely affected by a violation, and a trademark owner whose trademark is used without authorization to deceive users in the course of the deceptive practices the Act prohibits bring a civil action against a person who violates it.

A permitted plaintiff may seek an injunction and damages equal to the greater of actual damages or up to $100,000 for each violation, as the court considers just.

Section 5771 bars any person, not only an investigative or law enforcement officer, from installing or using a pen register, a trap and trace device, or a telecommunication identification interception device without first obtaining a court order.

The prohibition does not apply to a provider of wire or electronic communication service using such a device to operate, maintain or test the service, to protect the provider's rights or property or its users from abuse or unlawful use, to record that a communication was initiated or completed in order to protect against fraudulent, unlawful or abusive use, or with the consent of the user of the service.

Subchapter E, which holds this section, provides no civil action for a violation; a person who intentionally and knowingly violates it commits a misdemeanor of the third degree. The provisions this entry describes came into force on different days.

Section 5703 makes it a felony of the third degree to intentionally intercept, disclose, or use the contents of a wire, electronic, or oral communication, or to procure another person to do so. Section 5704(4) excepts a person who intercepts a wire, electronic, or oral communication where all parties to the communication have given prior consent, so the consent of only one party, including a party's own consent, does not satisfy the Act.

The Third Circuit held in Popa v. Harriet Carter Gifts, Inc. that the Act has no exception for a party to the communication, save for law enforcement under specific conditions, so a website's third-party marketing vendor that received a visitor's communications through its script, and the website that used it, could not avoid liability on the ground that the visitor communicated directly with the vendor's servers.

It held that the place of interception is the point at which the signals were routed to the vendor's servers, rejecting the reading that a communication is intercepted only where a server receives it, which would let a company capture the data of people in other states by locating its servers elsewhere.

The court noted that, under the Pennsylvania Supreme Court's reading, prior consent can be implied where the person knew or should have known of the recording, and left to the trial court whether the website's privacy policy gave the visitor that notice.

An oral communication is covered only where the speaker expected, in circumstances justifying the expectation, that it would not be intercepted, and the term excludes an electronic communication; a wire or electronic communication carries no such condition.

The personnel of a business engaged in telephone marketing or telephone customer service may intercept those communications for the sole purpose of training, quality control or monitoring where one party has consented, may use the recordings only for training or quality control, and must destroy them within one year unless federal or State law requires otherwise.

A communication service provider's staff may intercept a communication in the normal course of employment where necessary to render the service or protect the provider's rights or property, but the provider may not use service observing or random monitoring except for mechanical or service quality control checks.

A person whose communication is intercepted, disclosed, or used in violation of the chapter has a civil action under section 5725 against any person who intercepts, discloses or uses it or procures another to do so, for actual damages, but not less than liquidated damages computed at $100 a day of violation or $1,000, whichever is higher, plus punitive damages and a reasonable attorney's fee and litigation costs.

Good faith reliance on a court order or on the chapter's provisions is a defense to that action. The provisions this entry describes came into force on different days.

Act 47 of 2026, approved July 20, 2026, rewrote the Telemarketer Registration Act with effect 90 days after its approval, so the amended text has governed since October 18, 2026, and this row describes the Act as that amendment leaves it.

A telemarketer, or the telemarketing business that employs it, must register with the Office of Attorney General at least 30 days before offering consumer goods or services for sale through any medium, with a $50,000 surety bond, and may not initiate or receive a telemarketing call or message with a Pennsylvania subscriber unless registered.

Registration does not apply to a person or business licensed by or registered with a federal or Commonwealth agency acting within that licence, a qualifying catalog seller, a business-to-business seller that has operated for three years under one name with at least half its sales volume in repeat sales, a seller calling its own past purchasers after three years under one name, and others the Act lists, while a business providing telemarketing services to others under the same ownership for less than five years must register regardless.

A telephone solicitation is a call, voicemail, ringless voicemail or text message to a residential, business or wireless subscriber to solicit the sale of consumer goods or services, or to obtain information for that purpose.

The term does not include a call or message made in response to the subscriber's prior express written consent, about an existing debt, contract, payment or performance, to a subscriber with whom the seller or telemarketer has had an established business relationship within the past 12 months, on behalf of an organization tax-exempt under section 501(c)(3), (5) or (8) of the Internal Revenue Code or a congressionally chartered veterans organization, or on behalf of a political candidate or party.

The Act bars a telephone solicitation on a Sunday, on a legal holiday, or after 7 p.m. or before 9 a.m., and one to a subscriber who has said they do not wish to receive solicitations from the seller or telemarketer, which for a text message a reply such as stop, quit, end, revoke, opt out, cancel or unsubscribe is enough to say.

A telemarketer may not call a number enrolled on the do-not-call list beginning 30 days after the quarterly list that first contains it, must obtain the list quarterly, and may use it only to remove numbers; written procedures, trained staff, a maintained list and a call made in error together are a defense.

It bars a robocall, an autodialed telephone solicitation delivering a prerecorded or artificial voice, to a residential, business or wireless line without the called party's prior express written consent, unless the call is for emergency purposes or otherwise exempt, and bars any unfair or deceptive practice used to obtain that consent.

Prior express written consent is a signed written agreement, which may use an electronic signature, that names the number, clearly and conspicuously discloses consent to solicitations including a robocall or text message, and states that consent is not a condition of purchase.

A telemarketer that uses robocalls must state at the start of the call how to opt out, offer an automated voice or key-press opt-out within two seconds of identifying the caller and the seller and throughout the call, remove an opting-out number immediately, never require written consent to opt out, and leave a toll-free number reaching that opt-out in any voicemail message.

A telemarketer must disclose promptly the purpose of the call, its name and what it is selling, give the caller's name and that of the person on whose behalf it calls and, on request, a contact number or address, end a solicitation when the called party indicates they want to end it, and may not take any action with the primary intent to prevent the transmission of its name or telephone number, to falsely identify them, or to circumvent, bypass or disable a product or service a subscriber uses to screen calls or messages.

The Act also bars using any technology or any synthetic or computer-generated messaging to defraud, deceive or mislead a subscriber, and makes a violation of the federal Telemarketing Sales Rule, of the federal Telephone Consumer Protection Act's bar on misleading caller identification, or of a Federal Communications Commission caller-identification rule a violation of the Act. Failing to register is a misdemeanor of the second degree.

A violation of the Act is also a violation of the Unfair Trade Practices and Consumer Protection Law, and the Attorney General may separately investigate and bring its own enforcement action.

That Law's private action under section 201-9.2 is available to a person who purchases or leases goods or services primarily for personal, family, or household purposes and suffers an ascertainable loss, for actual damages or $100, whichever is greater, which the court may in its discretion treble, plus costs and reasonable attorney's fees.