(The Center Square) – A bill aimed at protecting consumers’ data online is set to take a fourth lap around the Pennsylvania House this session with Rep. Ed Nielson, D-Philadelphia, proposal to establish a Consumer Data Privacy Act.
“Unlike other states, Pennsylvania has no safeguard to protect our constituents’ privacy,” Neilson said.
Currently 20 states have consumer data privacy laws with differing language and methods of enforcement. In previous bills proposed in Pennsylvania, the state’s attorney general would have sole responsibility for upholding the law.
The bill is supported by Rep. Stephenie Scialabba, R-Cranberry, who co-sponsored similar legislation in the past and comes to the House with a background in data privacy law.
In the 2019 and 2021 session, House Bills 1049 and 1126 both stalled after being referred to the House Consumer Affairs committee. In 2023, House Bill 1201 finally passed the House but died in the Senate’s Communications and Technology committee. Each bill enjoyed bipartisan support.
“As technology advances, our laws need to follow suit,” said Scialabba in floor remarks last year. “The average person would be absolutely stunned to know what data exists about them, let alone that it is often sold for profit. It is not just an IP address or your browsing history. It is personal preferences, dislikes, projections on your future behaviors and interests. It’s a dossier on you.
Consumers leave a trail of data as they move their way through different websites and applications on the Internet which is then available for companies to feed through predictive algorithms. The data ranges from the personal – like their name, location, and other identifying information to the preferential – like websites they’ve visited and items they’ve purchased.
Once that information has been collected, people living in Pennsylvania have no visibility into where it goes or how it’s used. Often, data is sold to third parties or used for targeted advertising. Altogether, a person’s data creates a digital footprint that they can’t personally access, correct, or erase.
Data protection laws go beyond the basic option to accept or reject cookies enabled on many sites and give people the chance to opt out of data collection. Previous iterations of the law have included giving individuals visibility into whether a business is collecting their data and the right to access, amend, and delete their data.
“Pennsylvanians should be able to interact online without worrying how their information is used; they deserve the option to protect themselves from targeted advertising and other nefarious ways their information can be used,” said Nielson.
There are no federal consumer data privacy laws, a stark contrast to the European Union’s approach to data protection, which gives consumers ultimate control over their personal information.
U.S. companies that operate internationally have already had to comply with the EU’s laws, which went into full effect in 2018. Since then, transgressions have come with hefty fines. Meta was forced to pay $1.3 billion for violations in 2023.