A House bill which would establish new business guidelines and consumer protections for the handling of personal data passed unanimously in the Senate Technology and Communications Committee Wednesday.

Sponsored by Democratic Rep. Ed Neilson of Philadelphia County, the bill will now be sent to the full Senate.

“A lot of time and effort has been put into this,” said Sen. Nick Miller of Lehigh County, the top Democrat on the committee. “It’s long overdue.”

Already 20 other states including Maryland, Delaware and New Jersey have enacted comprehensive privacy laws to protect consumers from unknowingly giving away information online and having it sold to third parties. The bill would also provide consumers with ways to opt out of targeted ads, correct any mistakes they find in their recorded data, and even request that businesses delete their data entirely.

“In today’s economy, personal data is not just an afterthought. It is valuable, sensitive, and too often handled without enough transparency or accountability,” said Republican Sen. Tracy Pennycuick of Montgomery County, chair of the committee.”This is a commonsense step to strengthen consumer trust, protect our constituents, and make clear that responsible data stewardship should be the standard.”

Companies like Google and Facebook have been ‘stewarding’ data for years, continually tracking factors like search history, shopping habits and ad clicks in order to create detailed customer profiles and sell them to the highest bidder.

Today, individuals don’t even need to interact directly with these businesses to have their personal information disclosed to third parties. With the existence of data brokers, buying an individual’s personal data has never been easier, as these companies make it their sole purpose to find and compile information most consumers were never aware they had given away in the first place.

This bill could change that.

“House Bill 78 represents a meaningful step forward in protecting the personal data of Pennsylvania,” said Pennycuick. “Ensuring that companies are held to a basic standard of responsibility when they collect, use, and share that information.”

If passed, the bill would affect both companies which directly receive personal data and those, like data brokers, who obtain it through third parties. In both cases, companies would be required to only gather data relevant to the consumer’s purposes and provide evidence of data deletion when a consumer revokes their consent to have their information shared.

As of 2025, approximately 96% of Americans are online. The national government, however, has never passed a comprehensive data protection law. It’s most recent attempt, the American Privacy Rights Act, gained initial traction in 2024, but has so far failed to receive any further attention.

“In the absence of federal action, it is up to the General Assembly to act,” Pennycuick said.

Since its first proposal, the bill has seen bipartisan support and investment, a rare occurrence in Harrisburg where deep-running partisan loyalties have successfully kept most bills from ever seeing the light of day.

“We’ve been trying to do this a few years now, and I’m just grateful that we could all bring these parties together,” said Neilson, the bill’s sponsor. “We have had some good teams, and we worked hard to get this to where it is today.”