Pennsylvania Children’s Privacy Laws (2026)

HB 78, Printer's No. 3688 (2025-2026 Regular Session; Senate-amended)

Pending · Privacy law (minors) · binds operators

Ages: Known children under 13 (COPPA definition of child); under 16 for the targeted-advertising and sale consent rule (actual knowledge and willful disregard)

Requires: Would make personal data collected from a known child (under 13, as COPPA defines a child) sensitive data that a controller may process only in accordance with COPPA, let a parent or legal guardian exercise a known child's privacy rights, and treat compliance with COPPA's verifiable parental consent requirements as satisfying the act's parental-consent obligations. A controller could not process a consumer's personal data for targeted advertising or sell it without consent where it has actual knowledge and willfully disregards that the consumer is under 16, and precise geolocation data is sensitive data that needs consent. Attorney General enforcement only, as an unfair trade practice, with a time-limited 60-day cure period and no private right of action.

Timing: would take effect one year after enactment

Litigation: None; not enacted. Passed the House 127-76 on 2025-10-01. In the Senate it was re-reported as amended by the Communications and Technology Committee on 2026-06-24 (Printer's No. 3688) and given second consideration on 2026-06-25; it still needs Senate final passage and a House vote to concur in the Senate amendments. Dies if not enacted before the 2025-2026 session ends on 2026-11-30 (PA Const. art. II, secs. 2 and 4).

Entry last reviewed 2026-10-01

SB 1090, Printer's No. 1423 (2025-2026 Regular Session)

Pending · AI companion · binds operators

Ages: All users for the non-human disclosure and the suicide, self-harm and violence protocol; minors under 18 the operator knows, or should have known, are minors for the AI disclosure, break reminders and sexual-content measures

AI chatbot access for minors: Safeguards only (proposed in a pending bill, not law).

Requires: Would require operators of AI companion platforms to give a clear and conspicuous notice that the companion is artificially generated and not human wherever a reasonable person could be misled, and to maintain and publish a protocol that, as far as technologically feasible, keeps the companion from producing suicidal-ideation, suicide or self-harm content or content directly encouraging violence, with a crisis-line referral when a user expresses suicidal ideation or self-harm. For a user the operator knows, or should have known, is a minor, the operator must disclose that the user is talking to AI, by default remind the user at least every three hours to take a break and that the companion is not human, and take reasonable measures to keep the companion from producing visual material of sexually explicit conduct or directly instructing the minor to engage in it; a service offered to users the operator knows are minors must also disclose that AI companions may not be suitable for some minors. Customer-service, productivity and internal-use systems, game-limited bots and stand-alone voice-assistant speakers that do not sustain a relationship are excluded. Attorney General enforcement, with a civil penalty not to exceed $10,000 per violation.

Timing: would take effect 120 days after enactment

Litigation: None; not enacted. Passed the Senate 49-1 on 2026-03-17 and was referred to the House Communications and Technology Committee on 2026-03-18, with no House committee report or floor vote since. Dies if not enacted before the 2025-2026 session ends on 2026-11-30 (PA Const. art. II, secs. 2 and 4).

Entry last reviewed 2026-10-01

HB 2006, Printer's No. 3747 (2025-2026 Regular Session)

Pending · AI companion · binds operators

Ages: All users for age assurance, the crisis protocols and the non-human rules; minors under 18 need verifiable parental consent before access and get the sexual-content and isolation safeguards

AI chatbot access for minors: Parental consent required (proposed in a pending bill, not law).

Requires: Would require an operator, before anyone in Pennsylvania can use an AI companion, to request age information and determine whether the person is a minor by commercially available methods such as age inference, commercial age or identity databases, or verified-email data, without requiring government ID; a minor may have access only after verifiable parental consent, and personal information gathered for age assurance or consent may be used only for those purposes, shared only with a contracted provider, and kept no longer than 24 hours. For all users, operators must maintain and publish crisis protocols (a 988 referral for suicidal ideation, self-harm including eating disorders, or intent to harm others, and no assisting or encouraging suicide or violence), prevent AI-generated child sexual abuse material and any claim to be human, and, where a user could be misled, show a continuous on-screen non-human notice plus a notice at the start and at least every two hours that pauses the interaction for two minutes. For minors, operators must take reasonable measures against sexual images, dialogue and role-play and against outputs that promote isolation from family or friends or secrecy from a parent or other trusted adult. Only customer-service and internal-use systems are excluded from the AI companion definition. Attorney General enforcement, with civil penalties of no more than $100,000 per day for each violation plus injunctive relief.

Timing: would take effect 180 days after enactment

Litigation: None; not enacted. Passed the House 133-70 on 2026-09-28 (third consideration and final passage of Printer's No. 3747) and was sent to the Senate. Dies if not enacted before the 2025-2026 session ends on 2026-11-30 (PA Const. art. II, secs. 2 and 4).

Entry last reviewed 2026-10-01