An Act providing for consumer data privacy, for duties of controllers and for duties of processors; and imposing penalties.

SB 112, the Consumer Data Privacy Act, establishes new rules for how businesses handle personal data in Pennsylvania. It requires businesses (like online services or retailers meeting revenue or data volume thresholds) to get clear, affirmative consent from Pennsylvania residents before collecting or selling their data, bans deceptive "dark patterns" that trick users into sharing information, and prohibits selling data for targeted advertising without consent. The law defines personal data broadly to include location and biometric information (but excludes de-identified data or publicly available information) and imposes penalties for violations. It directly affects Pennsylvania consumers by giving them more control over their data and businesses that process their information.