Pennsylvania Consumer Data Privacy Act (House Bill 1126)

Pending legislation to establish comprehensive privacy rights for Pennsylvania residents. Would apply to businesses processing personal data that meet certain revenue or data volume thresholds. Establishes consumer rights including access, deletion, portability, and opt-out rights for certain processing activities. Creates consumer privacy fund from civil penalties. Requires businesses to conduct data protection assessments and maintain reasonable security practices. Proposed enforcement exclusively through attorney general.

JurisdictionPennsylvania
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Key Requirements

The Pennsylvania Consumer Data Privacy Act (PCDPA) establishes several key requirements for businesses:

  • Consumer Rights: The PCDPA grants Pennsylvania residents several rights regarding their personal data, including:
  • Right to access their personal data
  • Right to delete their personal data
  • Right to correct inaccuracies in their personal data
  • Right to opt-out of the sale of their personal data
  • Business Obligations: Covered entities must implement measures to protect consumer data, including:
  • Limiting data collection to what is necessary
  • Obtaining explicit consent for processing sensitive data
  • Conducting data protection assessments
  • Maintaining reasonable security practices

Compliance Challenges

Organizations face several challenges in complying with the PCDPA:

  • Consumer Rights Fulfillment: Establishing processes to respond to consumer requests for access, deletion, and correction of their data within required timeframes can be operationally challenging.
  • Data Security: Ensuring adequate security measures to protect consumer data from breaches and unauthorized access remains an ongoing challenge for many organizations.

Implementation Best Practices

To effectively implement PCDPA requirements, organizations should:

  • Enhance Data Security: Implement strong security measures to protect consumer data, including encryption and access controls.

Recent Updates

As of February 2025, the Pennsylvania Consumer Data Privacy Act is still pending legislation:

Related Regulations

The PCDPA is part of a broader trend of state-level privacy legislation in the US:

  • California Consumer Privacy Act (CCPA): The CCPA was one of the first comprehensive state privacy laws and served as a model for many others, including the PCDPA.
  • Virginia Consumer Data Protection Act (VCDPA): The VCDPA has similar provisions to the PCDPA, including consumer rights and business obligations.
  • General Data Protection Regulation (GDPR): While not a US law, the EU's GDPR has influenced many state privacy laws, including aspects of the PCDPA.

These regulations overlap in many areas, such as consumer rights and data protection principles, but may have different specific requirements and jurisdictional scopes.

Industry Impact

The PCDPA, if passed, would have significant impacts across various industries:

Sources

Recent developments

  • — OneTrust DataGuidance notes that Pennsylvania still **does not have a general consumer privacy act in force**, and references HB 78 (Consumer Data Privacy Act) as the current vehicle under Senate review, indicating that earlier proposals such as HB 1126 did not become operative law.[6] (source)
  • — FastDemocracy’s tracking for Pennsylvania’s consumer data privacy bill shows HB 78 (Act providing for consumer data privacy) as **introduced (Jan 14, 2025) and passed the House (Oct 1, 2025), but not yet passed the Senate or signed into law**, underscoring that Pennsylvania’s comprehensive privacy framework remains pending.[7] (source)
  • — A Pennsylvania House GOP release reports that HB 78, sponsored by Reps. Scialabba and Neilson, passed the House and would create the **Consumer Data Privacy Act** to modernize consumer data protections, marking a major step forward from prior efforts like HB 1126 but leaving final enactment to the Senate.[5] (source)
  • — Fisher Phillips analyzes the House’s passage of HB 78, detailing key features such as **consumer rights to access, correct, delete, and opt out of certain processing, consent requirements for sensitive data, privacy notice obligations, and AG-only enforcement**, and notes the law would take effect one year after enactment, signaling significant compliance impacts if passed.[4] (source)
  • — OneTrust DataGuidance reports that HB 78, titled the **Consumer Data Privacy Act**, was introduced and referred to the House Commerce Committee; the article explains the controller-focused scope and duties, showing how this newer bill supersedes earlier consumer-privacy proposals such as HB 1126.[2] (source)
  • — DataGuidance’s Pennsylvania jurisdiction update highlights amendments to the **Breach of Personal Information Notification Act** via SB 824 and SB 825, including expanded personal information definitions and mandatory free credit monitoring, illustrating that while broad privacy legislation (including the HB 1126 concept) has stalled, targeted data-security and breach rules are tightening.[6] (source)
  • — Termly’s overview of the Pennsylvania Consumer Data Privacy Act notes that the 2023 proposal (PCDPA/HB 1201) would have granted rights to **confirm, correct, delete, obtain a copy of, and opt out of the sale or targeted advertising use of personal data**, but also indicates the bill did not pass, reflecting industry anticipation yet continued uncertainty around comprehensive privacy obligations.[8] (source)
  • — Hinshaw & Culbertson’s “Privacy Bill Essentials” describes HB 1126 as a newly introduced **Pennsylvania Consumer Data Privacy Act** modeled in part on the CCPA, detailing consumer rights (know, delete, opt out, equal service) and AG enforcement plus a private right of action, and notes the Act would take effect immediately if approved, signaling an initially aggressive enforcement posture that contributed to business concern.[3] (source)
  • — FastDemocracy’s history for HB 1126 (2021–2022 session) records that the bill was introduced as an act providing for consumer data privacy and consumer rights related to personal information, but does not show final enactment, indicating that this specific **Pennsylvania Consumer Data Privacy Act (HB 1126)** did not become law despite early momentum.[9] (source)
  • — The Pennsylvania General Assembly’s HB 1126 page describes the bill as providing for **consumer data privacy, consumer rights, and business duties regarding personal information, with enforcement by the Attorney General**, but the legislative history confirms that it remained a proposal and has since been effectively overtaken by later initiatives like HB 78, leaving businesses to follow sectoral laws and monitor ongoing privacy bill activity.[1] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates