HB 1879 — An Act providing for duties of covered entities to protect the best interests of children that use online services, products or features and for data protection impact assessments; prohibiting certain actions by covered entities; and imposing penalties.

PRIOR PRINTER'S NO.

2359 THEPRINTER'S GENERALNO. ASSEMBLY OF PENNSYLVANIA HOUSE BILL Session of No.

3304 THE GENERAL ASSEMBLY OF PENNSYLVANIA HOUSE BILL Session of No.

BROWN, FRIEL, ORTITAY, DALEY, DAWKINS, ROZZI, METZGARMETZGAR, MERCURI AND MERCURI,GREEN, DECEMBER 5, 2023 REFERREDAS TOREPORTED FROM COMMITTEE ON CHILDREN AND YOUTH, DECEMBERHOUSE 5,OF 2023REPRESENTATIVES, AS AMENDED, JUNE 11, 2024 AN ACT Providing for duties of covered entities to protect the best interestsfeatures ofand childrenfor thatdata useprotection onlineimpact services,assessments;ucts products or prohibiting certain actions by covered entities;

"Best interests of a child." A child's privacy, safety, <-- mental and physical health, access to information, freedom to participate in society, meaningful access to digital technologies and well-being.

"BEST INTERESTS OF CHILDREN." THE USE, BY A COVERED ENTITY <-- THAT PROVIDES AN ONLINE PRODUCT THAT IS REASONABLY LIKELY TO BE ACCESSED BY CHILDREN, OF THE PERSONAL DATA OF CHILDREN OR THE DESIGN OF THE ONLINE PRODUCT IN A WAY THAT WILL NOT INFRINGE ON A CHILD'S ACCESS TO INFORMATION AND WILL NOT PRIORITIZE THE COVERED ENTITY'S COMMERCIAL INTERESTS OVER A CHILD'S INTERESTS IN A WAY THAT WOULD CAUSE:

(1) REASONABLY FORESEEABLE AND MATERIAL PHYSICAL OR FINANCIAL HARM TO CHILDREN;

(2) SEVERE AND REASONABLY FORESEEABLE PSYCHOLOGICAL OR EMOTIONAL HARM TO CHILDREN;

(3) A REASONABLY FORESEEABLE AND HIGHLY OFFENSIVE INTRUSION ON CHILDREN'S REASONABLE EXPECTATION OF PRIVACY AND THE RISK OF FOREGOING SUCH HARMS WAS KNOWN TO THE COVERED ENTITY ON THE BASIS OF A DATA PROTECTION IMPACT ASSESSMENT FOR SUCH ONLINE PRODUCT UNDER THIS ACT;

OR (4) UNLAWFUL DISCRIMINATION AGAINST CHILDREN BASED ON 20230HB1879PN3304 - 2 - RACE, COLOR, RELIGION, NATIONAL ORIGIN, DISABILITY, GENDER IDENTITY, SEX OR SEXUAL ORIENTATION.

The term does not include an individual acting in a commercial or employment context or as an employee, owner, 20230HB1879PN2359 - 2 - director, officer or contractor of a company, partnership, sole proprietorship, nonprofit entity or State agency whose communications or transactions with a covered entity occur solely within the context of that individual's role with the company, partnership, sole proprietorship, nonprofit entity or State agency.

"Dark pattern." A user interface knowingly designed with the intended purpose of subverting or impairing user decision-making 20230HB1879PN3304 - 3 - or choice.

"Likely to be accessed by a child." It is reasonable to 20230HB1879PN2359 - 3 - expect, based on the following indicators, that an online service, product or feature would be accessed by a child:

"Online service, product or feature." The term does not 20230HB1879PN3304 - 4 - include any of the following:

(3) BROADBAND INTERNET ACCESS SERVICE AS DEFINED IN 47 <-- CFR 54.400 (RELATING TO TERMS AND DEFINITIONS).

"PROCESS." TO PERFORM AN OPERATION OR SET OF OPERATIONS BY <-- MANUAL OR AUTOMATED MEANS ON PERSONAL DATA, INCLUDING COLLECTING, USING, STORING, DISCLOSING, ANALYZING, DELETING OR MODIFYING PERSONAL DATA.

"PROCESSOR." A NATURAL OR LEGAL ENTITY THAT PROCESSES PERSONAL DATA ON BEHALF OF A CONTROLLER OF PERSONAL DATA.

20230HB1879PN2359"PUBLICLY -AVAILABLE 4INFORMATION." -ANY SectionOF 4.THE FOLLOWING:

<-- (1) INFORMATION THAT IS LAWFULLY MADE AVAILABLE THROUGH 20230HB1879PN3304 - 5 - FEDERAL, STATE OR LOCAL GOVERNMENT RECORDS.

(2) INFORMATION THAT A BUSINESS OR ORGANIZATION HAS A REASONABLE BASIS TO BELIEVE IS LAWFULLY MADE AVAILABLE TO THE GENERAL PUBLIC THROUGH WIDELY DISTRIBUTED MEDIA BY A CONSUMER OR BY A PERSON TO WHOM THE CONSUMER HAS DISCLOSED THE INFORMATION, UNLESS THE CONSUMER HAS RESTRICTED THE INFORMATION TO A SPECIFIC AUDIENCE.

"SALE OF PERSONAL DATA." THE EXCHANGE OF PERSONAL DATA FOR MONETARY CONSIDERATION BY A CONTROLLER OF THE PERSONAL DATA TO A THIRD PARTY.

THE TERM DOES NOT INCLUDE ANY OF THE FOLLOWING:

(1) THE DISCLOSURE OF PERSONAL DATA TO A PROCESSOR THAT PROCESSES THE PERSONAL DATA ON BEHALF OF A CONTROLLER OF THE PERSONAL DATA.

(2) THE DISCLOSURE OF PERSONAL DATA TO A THIRD PARTY FOR THE PURPOSE OF PROVIDING A PRODUCT OR SERVICE REQUESTED BY A CONSUMER.

(3) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO AN AFFILIATE OF A CONTROLLER OF THE PERSONAL DATA.

(4) THE DISCLOSURE OF INFORMATION THAT A CONSUMER:

(I) INTENTIONALLY MADE AVAILABLE TO THE GENERAL PUBLIC VIA A CHANNEL OF MASS MEDIA;

AND (II) DID NOT RESTRICT TO A SPECIFIC AUDIENCE.

(5) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO A THIRD PARTY AS AN ASSET THAT IS PART OF A PROPOSED OR ACTUAL MERGER, ACQUISITION, BANKRUPTCY OR OTHER TRANSACTION IN WHICH THE THIRD PARTY ASSUMES CONTROL OF ALL OR PART OF THE ASSETS OF A CONTROLLER OF THE PERSONAL DATA.

"THIRD PARTY." A NATURAL OR LEGAL PERSON, PUBLIC AUTHORITY, AGENCY OR BODY OTHER THAN A CONSUMER, CONTROLLER OF PERSONAL DATA, PROCESSOR OR AN AFFILIATE OF THE PROCESSOR OR THE 20230HB1879PN3304 - 6 - CONTROLLER.

Section 4.

Nothing in this paragraph shall be construed to require the covered entity to disclose information to the 20230HB1879PN3304 - 7 - Office of Attorney General in a manner that would disclose 20230HB1879PN2359 - 5 - the covered entity's trade secrets.

(ii) An assessment of the necessity and proportionality of the processing operations in relation 20230HB1879PN3304 - 8 - to the purpose of the processing.

For the purpose of this 20230HB1879PN2359 - 6 - subparagraph, a single assessment may address a set of similar processing operations that present similar risks.

20230HB1879PN3304 - 9 - (1) Use the personal information of a child likely to 20230HB1879PN2359 - 7 - access the online service, product or feature in a way that the covered entity knows is likely to result in high risk to the child on the basis of a data protection impact assessment required under section 4(1) if the high risk has not been suitably mitigated through measures identified in the data protection impact assessment.

(3) Collect, retain, process or disclose the personal information of a child in a manner that has been identified as high risk to the child on the basis of a data protection 20230HB1879PN3304 - 10 - impact assessment required under section 4(1) if the high 20230HB1879PN2359 - 8 - risk has not been suitably mitigated through measures identified in the data protection impact assessment.

(iii) Take any action that the covered entity knows is not in the best interests of a child reasonably likely 20230HB1879PN3304 - 11 - to access the online service, product or feature.

20230HB1879PN2359 - 9 - Section 7.

(d) Cured violation.--If, within 90 days of receipt of the written notice required under subsection (c), the covered entity cures an alleged violation specified in the written notice and provides the Office of Attorney General with written evidence that the alleged violation has been cured and the covered entity has taken sufficient measures to prevent a future violation of 20230HB1879PN3304 - 12 - this act, the covered entity shall not be civilly liable for the 20230HB1879PN2359 - 10 - alleged violation.

1936) and the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5, 123 20230HB1879PN3304 - 13 - Stat.