Law note · Pennsylvania
House Bill 78, sensitive data and biometric data definitions
As amended (PN 3688), HB 78 would define biometric data as data generated by automatic measurements of an individual's biological characteristics, including fingerprints, voiceprints, eye retinas, irises, or other unique biological patterns or characteristics used to identify a specific individual, but the definition excludes a digital or physical photograph, an audio or video recording, or any data generated from either, with no exception for data generated to identify a specific person, unconditionally, unlike Kentucky's, Maryland's, Minnesota's, or New Jersey's clawback-shaped equivalents.
A separate clause also excludes an irreversible mathematical representation (a template or hash that cannot be used to recreate the underlying capture), and 'personal data' itself separately excludes biometric data converted to such a representation.
Sensitive data, requiring opt-in consent, includes the processing of genetic or biometric data to uniquely identify an individual, alongside race or ethnicity, religion, health, sexuality, citizenship or immigration status, child data, precise geolocation, and, added by the 2026-06-24 amendment, Social Security number, driver's license number, and financial account number with access credentials. This bill has not been enacted and binds nothing today.
Pennsylvania has no enacted, freestanding biometric-privacy statute; a 2023-2024 session bill of that kind, HB 926, never advanced past introduction and has no confirmed 2025-2026 successor.
What it asks of an app
- This bill has not been enacted; do not treat its biometric-data definition as binding.
- If HB 78 is enacted as currently amended, a faceprint or voiceprint deliberately extracted from a public photograph, video, or audio recording to identify someone would not be biometric data under this bill, unlike under BIPA or Wisconsin's breach statute, which carry no such exclusion.
- If enacted, obtain opt-in consent before processing sensitive data, including biometric or genetic data collected to uniquely identify an individual.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, crawls_web, trains_models
Primary source: official Pennsylvania bill text, House Bill 78, Senate Printer's No. 3688, Pennsylvania General Assembly website