An Act providing for consumer data privacy, for duties of controllers and for duties of processors; and imposing penalties.

This bill establishes the Consumer Data Privacy Act to protect the personal information of Pennsylvania residents by setting specific rules for businesses that collect and use consumer data. It defines who must comply as "controllers," which are companies doing business in the state with over $10 million in annual revenue, those selling consumer data for half their income, or those handling data from at least 50,000 consumers. The law requires these companies to obtain clear, affirmative consent from individuals before processing their data and prohibits deceptive design tactics known as dark patterns that trick users into sharing information. Additionally, the act outlines strict penalties for violations and grants consumers the right to know how their data is used, particularly in high-risk situations like targeted advertising or automated decision-making.