Pennsylvania

This measure passed the Pennsylvania House 203-0 on June 23, 2025 and was referred to the Senate Communications and Technology Committee on June 24, 2025; it has not been reported from that committee as of the date shown.

As passed by the House, a covered person is liable for fraudulent misrepresentation of a candidate if, within 90 days before an election and with willful or reckless disregard for the possibility of influencing its outcome, the person knowingly and intentionally disseminates a campaign advertisement containing an artificially generated impersonation of a candidate (a deepfake) intended to misrepresent the candidate's words, actions, or beliefs.

A covered person is not liable if the advertisement carries a clear and conspicuous disclosure in a prescribed form, in a size or manner readable or audible to the viewer or listener, and content bearing the disclosure must also carry embedded, tamper-evident digital content provenance identifying its creator and any subsequent editor.

An aggrieved candidate may seek an order for immediate removal of the advertisement, and a court may impose a civil penalty per day of dissemination of up to $15,000 for a municipal candidate, $50,000 for a state candidate, or $250,000 for a candidate for President, Vice President, the U.S. Senate, or the U.S. House, doubled for a political action committee that only makes independent expenditures.

This measure passed the Pennsylvania Senate 49-1 on March 17, 2026 and was referred to the House Communications and Technology Committee on March 18, 2026; it has not been reported from that committee as of the date shown.

As passed by the Senate, an operator of an AI companion platform must issue a clear and conspicuous notification that the AI companion is artificially generated and not human whenever a reasonable person interacting with it could be misled into believing otherwise; must maintain and publish a protocol, to the extent technologically feasible, to prevent the AI companion from producing suicidal ideation, suicide, or self-harm content, including a notification referring a user who expresses such content to a crisis line; and, for a user the operator knows or should have known is a minor, must give additional disclosures and safeguards.

The bill exempts an underlying AI model not directly offered as a companion, and several narrow categories including business-internal tools and video-game bots limited to game topics. The Attorney General has exclusive enforcement authority, with a civil penalty of up to $10,000 per violation; the bill states no private right of action. If enacted, it would take effect 120 days after signature.

House Bill 78, as amended by the Senate Communications and Technology Committee (Printer's No. 3688), would apply to a for-profit controller doing business in Pennsylvania that meets a revenue threshold of more than $10,000,000, or that alone or in combination buys, receives, sells, or shares for commercial purposes the personal information of at least 100,000 consumers, households, or devices (raised from 50,000 in the original bill), or that derives at least 50% of annual revenue from selling personal information.

Controllers must limit processing to purposes disclosed to the consumer and conduct data protection assessments for high-risk processing; processors act only on a controller's documented instructions. The bill establishes no lawful-basis regime distinct from this disclosed-purpose limitation; consent is required specifically for sensitive-data processing, not for processing generally.

This bill has not been enacted and binds nothing today; it passed the House 127-76 on 1 October 2025 and had second consideration in the Senate on 25 June 2026, with no Senate third-consideration vote or gubernatorial action as of 28 August 2026.

As amended (PN 3688), HB 78 would give the Attorney General exclusive authority to enforce the Act and would foreclose a private right of action twice over: subsection (b), strengthened by the 24 June 2026 Senate amendment, provides that nothing in the Act creates, is used as the basis or predicate for, or otherwise gives rise to a private right of action; and subsection (c) deems a violation an unfair or deceptive practice under the Unfair Trade Practices and Consumer Protection Law but makes that deeming enforceable exclusively by the Attorney General, closing the UDAP route the deeming clause would otherwise open, the same double-foreclosure shape as the enacted breach statute below.

This bill has not been enacted and binds nothing today.

As amended (PN 3688), HB 78 would define biometric data as data generated by automatic measurements of an individual's biological characteristics, including fingerprints, voiceprints, eye retinas, irises, or other unique biological patterns or characteristics used to identify a specific individual, but the definition excludes a digital or physical photograph, an audio or video recording, or any data generated from either, with no exception for data generated to identify a specific person, unconditionally, unlike Kentucky's, Maryland's, Minnesota's, or New Jersey's clawback-shaped equivalents.

A separate clause also excludes an irreversible mathematical representation (a template or hash that cannot be used to recreate the underlying capture), and 'personal data' itself separately excludes biometric data converted to such a representation.

Sensitive data, requiring opt-in consent, includes the processing of genetic or biometric data to uniquely identify an individual, alongside race or ethnicity, religion, health, sexuality, citizenship or immigration status, child data, precise geolocation, and, added by the 24 June 2026 amendment, Social Security number, driver's license number, and financial account number with access credentials. This bill has not been enacted and binds nothing today.

Pennsylvania has no enacted, freestanding biometric-privacy statute; a 2023-2024 session bill of that kind, HB 926, never advanced past introduction and has no confirmed 2025-2026 successor.

Would require a controller to obtain opt in consent before processing the personal data of a known child under 13, and before processing a known minor's data under 16 for targeted advertising, sale, or profiling producing legal or similarly significant effects.

Passed the House 127 to 76 on October 1, 2025, was reported by the Senate Consumer Protection and Professional Licensure Committee on February 4, 2026 and re-referred to the Senate Communications and Technology Committee, which re-reported it as amended on June 24, 2026; it received second consideration on June 25, 2026 but has not passed the full Senate.