Regulon — PA-HB-1430 · PA HB 1430 (Protecting Minors on Social Media)

WHAT THIS BILL REGULATES · 4 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Attorney General enforcement. The Pennsylvania Attorney General has exclusive jurisdiction to bring civil actions for violations of the consent (Subchapter C) and data (Subchapter D) provisions, and authority to impose fines for hateful conduct reporting violations (Subchapter B). No private right of action. A good-faith defense is available for consent-related violations.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

Tiered civil penalties across three subchapters. Subchapter B (hateful conduct): up to $1,000 per day in violation. Subchapter C (consent): first offense up to $2,500 per minor, second offense up to $5,000, third or subsequent up to $50,000; multi-minor first offense up to greater of $5,000,000 or violations × $2,500; repeated intentional violations may result in injunction barring operation in Pennsylvania. Subchapter D (data prohibitions): first offense up to $10,000 per minor, second up to $50,000, third or subsequent up to $500,000; multi-minor first offense up to greater of $50,000,000 or violations × $10,000; court may order data scrubbing at company's cost; repeated intentional violations may result in prohibition from operating minor accounts. Section 1134 deletion violations: strict liability of $10,000 per day per website. Civil penalties deposited into School Safety and Security Fund for mental health services.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

50 Pa.C.S. § 1101

Scope of chapter

This chapter relates to protecting minors on social media.

This section establishes the scope of Chapter 11 as relating to protecting minors on social media. It creates no independent compliance obligation.

50 Pa.C.S. § 1102

Legislative intent

(1)–(8) The General Assembly finds and declares as follows: (1) Social media use among American teenagers is nearly universal. According to the Pew Research Center, 95% of teens report using YouTube and 67% of teens have used TikTok, with 16% using TikTok almost constantly. (2) According to the Pew Research Center, 54% of teens say it would be difficult to give up social media entirely. (3) Social media use is linked to negative feelings among teens. A growing body of research, described in the International Journal of Adolescence and Youth and elsewhere, has found that increased social media use is associated with greater rates of depression and anxiety in teens. Additional research published in the Children and Youth Services Review describes a trend in which social media use can trigger and accelerate offline violence. (4) Rates of suicide and self-harm among American teenagers have grown dramatically in recent years. The Centers for Disease Control and Prevention has found that, in 2021, three in five girls felt persistently sad and hopeless, while more than one in four girls reported seriously considering attempting suicide. These rates have increased significantly since 2011. (5) Federal and State policymakers are beginning to recognize the risks that social media use places on American youth. A number of recent policy proposals provide parents and guardians of teenagers with greater oversight over their children's social media use. (6) In May 2023, the United States Surgeon General released a health advisory finding that "more research is needed to fully understand the impact of social media; however, the current body of evidence indicates that while social media may have benefits for some children and adolescents, there are ample indicators that social media can also have a profound risk of harm to the mental health and well-being of children and adolescents." The advisory recommends a range of policies to consider, including "policies that further limit access - in ways that minimize the risk of harm - to social media for all children, including strengthening and enforcing age minimums." (7) In addition to empowering parents and guardians to protect children against these risks, policymakers are establishing mechanisms to hold social media companies accountable for harm to children and youth. (8) Greater oversight of social media platforms will enable families in this Commonwealth to use online tools in a more productive and healthy fashion.

This section contains legislative findings regarding the prevalence of social media use among teenagers, associated mental health risks including rising rates of suicide and self-harm, and the policy rationale for greater oversight of social media platforms to protect minors. It creates no compliance obligations.

50 Pa.C.S. § 1103

Definitions

The following words and phrases when used in this chapter shall have the meanings given to them in this section unless the context clearly indicates otherwise: "Account." Any means of registration by which an individual may engage in one or more functions of a social media platform. "Dark pattern." A user interface designed or manipulated with the effect of subverting or impairing user autonomy, decision making or choice. The term includes any practice the Federal Trade Commission categorizes as a dark pattern. "Delete." To remove personal information such that the information is not retrievable by anyone and cannot be retrieved in the normal course of business. "Mine." The activity or process of searching through large amounts of information for specific data or patterns. "Minor." Except as provided in section 1131 (relating to definitions), an individual who is under 16 years of age. "Online video game." A video game that connects to the Internet and allows a user to do any of the following: (1) Create and upload content other than content that is incidental to game play, including character or level designs created by the user, preselected phrases or short interactions with other users. (2) Engage in microtransactions within the game. (3) Communicate with other users. "Personal information." As defined in 15 U.S.C. § 6501 (relating to definitions). "Personalized recommendation system." A fully or partially automated system that is based on a user's historical activity data and which suggests, promotes or ranks information that is presented or displayed to users. "School entity." A school district, intermediate unit, area career and technical school, charter school or private residential rehabilitative institution. "Social media company." A person that owns or operates one or more social media platforms. "Social media platform." A public or semipublic Internet-based service, application or online video game that has users in this Commonwealth and that meets all of the following criteria: (1) A primary function of the service, application or online video game is to connect users in order to allow users to interact socially with each other within the service, application or online video game, except that a service, application or online video game that provides email or direct messaging services, cloud computing or commercial transactions shall not be considered to meet this criterion solely on the basis of that function. (2) The service, application or online video game allows users to do all of the following: (i) Construct a public or semipublic profile for purposes of signing into and using the service, application or online video game. (ii) Populate a list of other users with whom an individual shares a social connection within the system. (iii) Create or post content viewable by other users, including, but not limited to, on message boards, in chat rooms or through a landing page or main feed that presents the user with content generated by other users.

This section defines key terms used throughout Chapter 11, including social media platform, social media company, minor (under 16 for this chapter, except Subchapter D), dark pattern, personalized recommendation system, and personal information (cross-referencing the federal COPPA definition at 15 U.S.C. § 6501). It creates no independent compliance obligation.

50 Pa.C.S. § 1111

Definitions (Hateful Conduct)

The following words and phrases when used in this subchapter shall have the meanings given to them in this section unless the context clearly indicates otherwise: "Hateful conduct." The use of a social media platform to vilify, humiliate or incite violence against a group or a class of persons on the basis of race, color, religion, ethnicity, national origin, disability, sex, sexual orientation, gender identity or gender expression.

This section defines hateful conduct for purposes of Subchapter B as the use of a social media platform to vilify, humiliate, or incite violence against a group or class of persons on enumerated protected bases. It creates no independent compliance obligation.

50 Pa.C.S. § 1112

Reporting incidents of hateful conduct

Deployer

(a) 1 Mechanism.--A social media platform that conducts business in this Commonwealth shall provide and maintain a clear and easily accessible mechanism for individual users to report incidents of hateful conduct. The mechanism shall meet all of the following criteria: (1) Be clearly accessible to users of the social media platform and easily accessed from other social media platforms' applications and Internet websites. (2) Allow the social media platform to provide a direct response to a user reporting an incident of hateful conduct for the purpose of informing the user on how the matter is being resolved.

(b) 2 Policies.--A social media platform shall have a clear and concise policy readily available and accessible on the social media platform's Internet website and application, which shall include how the social media platform will respond and address reports of incidents of hateful conduct on the social media platform.

This section imposes two obligations on social media platforms operating in Pennsylvania. First, platforms must provide and maintain a clear, easily accessible mechanism for users to report incidents of hateful conduct, with the ability for the platform to respond directly to the reporting user. Second, platforms must publish a clear and concise policy on their website and application describing how the platform will respond to and address hateful conduct reports.

Compliance actions 2 items

Social media platforms must provide and maintain a clear, easily accessible mechanism for users to report incidents of hateful conduct, accessible from the platform's applications and websites, with the ability to provide a direct response to the reporting user on how the matter is being resolved.

—

Social media platforms must publish a clear and concise policy on their website and application describing how the platform will respond to and address reports of hateful conduct.

—

50 Pa.C.S. § 1113

Construction

(1)–(2) Nothing in this subchapter shall be construed: (1) as an obligation imposed on a social media platform that adversely affects the rights or freedoms of an individual, including the exercise of the right of free speech under the First Amendment to the Constitution of the United States; or (2) to add to or increase the liability of a social media platform for any action other than the failure to provide a mechanism for a user to report an incident of hateful conduct to the social media platform and to receive a response to the report from the social media platform.

This savings clause clarifies that Subchapter B shall not be construed to adversely affect individual rights including free speech under the First Amendment, and that platform liability under the subchapter is limited to failure to provide a reporting mechanism and respond to reports. It creates no new compliance obligation.

50 Pa.C.S. § 1114

Penalties (Hateful Conduct)

The Attorney General shall impose a fine on a social media company that knowingly violates the provisions of this subchapter in an amount not to exceed $1,000 for each day the social media platform is in violation of this subchapter. In determining whether the social media platform is in violation of this subchapter, the Attorney General may take proof, consider the relevant facts and issue subpoenas in accordance with the laws and rules of civil procedure. A determination by the Attorney General under this section shall be subject to the provisions of 2 Pa.C.S. Ch. 7 Subch. A (relating to judicial review of Commonwealth agency action).

This section establishes the penalty framework for Subchapter B violations. The Attorney General may impose a fine of up to $1,000 per day on a social media company that knowingly violates the hateful conduct reporting requirements. The AG may take proof, consider relevant facts, and issue subpoenas. Determinations are subject to judicial review under the Administrative Agency Law. This is an enforcement provision that creates no independent compliance obligation.

50 Pa.C.S. § 1121

Applicability (Consent to Open an Account)

This subchapter shall apply to accounts opened on or after the effective date of this section.

This section limits Subchapter C to accounts opened on or after the effective date of the section. It creates no independent compliance obligation.

50 Pa.C.S. § 1122

Age assurance

Deployer

3 Utilizing commercially available best practices, a social media company shall make commercially reasonable efforts to verify the age of users upon the creation of an account, with a level of certainty appropriate to the risks that arise from the information management practices of the social media company, or apply the accommodations afforded to minors under this chapter to all account holders.

This section requires social media companies to make commercially reasonable efforts to verify the age of users at account creation, using commercially available best practices and with a level of certainty appropriate to the company's information management risk profile. As an alternative, a company may apply all minor accommodations to all account holders.

Compliance actions 1 item

Social media companies must make commercially reasonable efforts to verify the age of users at account creation using commercially available best practices, or alternatively apply all minor-protective accommodations to all account holders.

MN-01.1

50 Pa.C.S. § 1123

Duties of social media platforms and companies

Deployer

(a) 4 Required consent.--A social media company may not permit a minor residing in this Commonwealth to become an account holder on a social media platform unless the minor has the express consent of the minor's parent or legal guardian. A social media company may obtain express consent from a minor's parent or legal guardian through any of the following means: (1) By providing a completed form from a minor's parent or legal guardian to sign and return to the social media company via mail or electronic means. (2) Through a toll-free telephone number for a minor's parent or legal guardian to call. (3) Allowing a minor's parent or legal guardian to provide consent by responding to an email. (4) Any other commercially reasonable methods of obtaining consent in light of available technology.

(b) 5 Documentation.--A social media company shall maintain documentation as to the manner in which the social media company has obtained express consent from a minor's parent or legal guardian. The social media company may delete the documentation when the minor is no longer a minor or within the established time frame by the social media company for maintaining data. The Office of Attorney General shall develop a standard form with the necessary information to allow a minor's parent or legal guardian to provide consent under this section.

(c) 6 Social media companies.--A social media company shall post in a conspicuous place on each of the social media company's social media platforms notice that express consent by a minor's parent or legal guardian shall be required prior to opening an account. An electronic consent form on a social media platform for the purposes of this section shall include the necessary information on the form developed by the Office of Attorney General under subsection (b).

(d) 7 Failure to obtain consent.--To the extent possible, if a minor opens a social media account without express consent by the minor's parent or legal guardian, the social media company shall, within a reasonable time after discovery of the failure to obtain the express consent: (1) suspend the social media account; and (2) notify the minor's parent or legal guardian that the minor has attempted to open a social media account without their consent.

(e) 8 Social media access.--To the extent possible, a social media company shall provide a minor's parent or legal guardian who has given express consent for the minor to become an account holder with a means for the minor's parent or legal guardian to initiate account supervision. Account supervision may include: (1) allowing the minor's parent or legal guardian the ability to view privacy settings of the minor's account; and (2) allowing a minor the option of providing notifications to the minor's parent or legal guardian if the minor reports a person or an issue to the social media platform.

(f) 8 Notification.--A social media platform shall provide clear notice to the minor on the features of the minor's account to which the minor's parent or legal guardian may have access.

(g) 4 No account required.--A social media platform may not require a parent or legal guardian to have the parent or legal guardian's own account as a condition of a minor being able to open an account.

(h) 6 Notice of alleged violation.--A social media company shall develop and post notice on its publicly accessible Internet website of the methods, including electronic and telephonic means, by which a minor's parent or legal guardian may notify the social media company that the minor has opened a social media account on its social media platform without the required consent.

This is the central consent-and-parental-oversight section of Subchapter C. It requires social media companies to obtain express parental or guardian consent before allowing a minor under 16 to open an account, through enumerated or commercially reasonable consent methods. Companies must maintain consent documentation, post conspicuous notice of the consent requirement, and use the AG-developed standard form. If a minor opens an account without consent, the company must suspend the account and notify the parent. Companies must provide parental supervision tools including privacy-setting visibility and optional report notifications. The platform must notify minors of which account features parents can access, and must not require parents to hold their own account as a prerequisite. Companies must also post notice of methods by which parents may report unconsented accounts.

Compliance actions 5 items

Social media companies must obtain verifiable parental or guardian consent before permitting a minor under 16 to become an account holder, through any of the enumerated consent methods or any other commercially reasonable method. The platform may not require a parent or guardian to hold their own account as a condition of a minor opening an account.

MN-01.2

Social media companies must maintain documentation of how express parental or guardian consent was obtained for each minor account holder. Documentation may be deleted when the minor reaches age 16 or within the company's established data retention timeframe.

G-01.3

Social media companies must post conspicuous notice on each platform that parental or guardian consent is required before a minor may open an account, and must post on their public website notice of the methods by which a parent or guardian may report an unconsented minor account.

MN-01.2

Social media companies must, within a reasonable time after discovering that a minor has opened an account without parental or guardian consent, (1) suspend the account and (2) notify the minor's parent or guardian of the unauthorized account creation.

MN-01.9

Social media companies must provide parents or guardians who have consented to a minor's account with tools to initiate account supervision, including viewing the minor's privacy settings and optional report notifications. The platform must provide clear notice to the minor of which account features the parent or guardian may access.

MN-01.3

50 Pa.C.S. § 1124

Revocation of consent

Deployer

(a) 9 Time.--A minor's parent or legal guardian who has provided express consent under this subchapter may revoke the consent at any time.

(b)(1)–(2) 9 Duties of social media company.-- (1) A social media company shall take reasonable steps to provide a parent or legal guardian who has provided express consent for a minor to open a social media account with the ability to revoke the consent. (2) A social media company that receives a revocation of consent under subsection (a) shall, to the extent possible, within a reasonable time frame from receipt of the revocation, suspend, delete or disable the account of the minor for whom consent was revoked.

This section grants parents and guardians the right to revoke consent at any time. Social media companies must take reasonable steps to provide the ability to revoke and, upon receiving revocation, must suspend, delete, or disable the minor's account within a reasonable timeframe.

Compliance actions 1 item

Social media companies must provide parents or guardians with the ability to revoke consent at any time, and upon receiving a revocation, must suspend, delete, or disable the minor's account within a reasonable timeframe.

MN-01.9

50 Pa.C.S. § 1125

Violations (Consent)

(a)–(d) Action.--The Attorney General shall have jurisdiction to bring an action against a social media company that knowingly, intentionally or negligently allows for a minor to open a social media account without express consent of the minor's parent or legal guardian. The Attorney General may bring multiple cases at one time against a social media company for violations of this chapter. (b) Civil penalties.-- (1) For a first offense for an action brought on behalf of a single minor, a civil penalty not to exceed $2,500. (2) For a second offense for an action brought on behalf of the same single minor under paragraph (1), a civil penalty not to exceed $5,000. (3) For a third or subsequent offense for an action brought on behalf of the same single minor under paragraph (1), a civil penalty not to exceed $50,000. (4) For a first offense for an action brought on behalf of multiple minors, a civil penalty not to exceed the greater of $5,000,000 or the total number of violations multiplied by the maximum civil penalty under paragraph (1). (5) If a court of competent jurisdiction determines that there have been repeated intentional violations of this chapter by a social media company, the court may enter an order enjoining the social media company from operating in this Commonwealth. (c) Use of recovered civil penalties.--Civil penalties collected under subsection (b) shall be deposited into the School Safety and Security Fund to be used exclusively for mental health-related services for school entities. (d) Good faith.--It shall be a defense to an action under subsection (a) if a social media company allows for the creation or opening of an account for a minor based on a good faith belief that the minor has obtained the express consent required under this subchapter.

This section establishes the enforcement framework for Subchapter C. The Attorney General has jurisdiction to bring actions against social media companies that knowingly, intentionally, or negligently allow a minor to open an account without parental consent. Civil penalties escalate by offense and by whether the action covers a single or multiple minors, up to the greater of $5,000,000 or violations × $2,500. Repeated intentional violations may result in an injunction barring operation in Pennsylvania. Civil penalties are deposited into the School Safety and Security Fund for mental health services. A good-faith defense is available. This section is an enforcement-only provision creating no independent compliance duty.

50 Pa.C.S. § 1131

Definitions (Data)

The following words and phrases when used in this subchapter shall have the meanings given to them in this section unless the context clearly indicates otherwise: "Minor." An individual who is under 18 years of age. "Precise geolocation." Data that is derived from a device and used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet. "Process" or "processing." To conduct or direct an operation or a set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, including the collection, use, storage, disclosure, analysis, deletion, modification or otherwise handling of personal data. "Qualified individual." Any of the following: (1) A parent or guardian of a minor. (2) An adult individual from whom data was collected when the individual was a minor. "Sale" or "sell." The exchange of personal information for monetary consideration by the business to a third party. The term does not include: (1) The disclosure of personal information to a processor that processes the personal information on behalf of the business. (2) The disclosure of personal information to a third party for purposes of providing a product or service requested by the consumer. (3) The disclosure or transfer of personal information to an affiliate of the business. (4) The disclosure of information that the consumer: (i) intentionally made available to the general public via a channel of mass media; and (ii) did not restrict to a specific audience. (5) The disclosure or transfer of personal information to a third party as an asset that is part of a merger, acquisition, bankruptcy or other transaction in which the third party assumes control of all or part of the business's assets. "Targeted advertising." The displaying of advertisements to a consumer where the advertisement is selected based on personal information obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict such consumer's preferences or interests. The term does not include: (1) advertisements based on activities within a social media company's own websites or online applications; (2) advertisements based on the context of a consumer's current search query, visit to a website or online application; (3) advertisements directed to a consumer in response to the consumer's request for information or feedback; or (4) processing personal information processed solely for measuring or reporting advertising performance, reach or frequency. "Third party." An individual or legal entity, public authority, agency or body, other than the consumer, business or processor or an affiliate of the processor or the business.

This section defines terms for Subchapter D, including a higher age threshold for minor (under 18, compared to under 16 for the rest of the chapter), precise geolocation, process, qualified individual, sale (with five enumerated carve-outs), targeted advertising (with four enumerated carve-outs), and third party. It creates no independent compliance obligation.

50 Pa.C.S. § 1132

Prohibitions (Data)

Deployer

(a) 10 Mining.--A social media company may not mine data related to a minor who has opened a social media account, notwithstanding if the account was opened with the express consent of the minor's parent or legal guardian. This subsection shall not apply to any of the following: (1) Data regarding age and location for purposes of personalized recommendations related to age-appropriate content. (2) The mining of data necessary to protect minors from viewing harmful content. (3) Mining of data which is adequate, relevant and reasonably necessary in relation to the purpose for which the data is processed, as disclosed.

(b) 11 Sale of data.--A social media company may not sell or profit from personal information related to a minor who has opened a social media account, or engage in targeted advertising based on a minor's age, gender or interests, notwithstanding if the account was opened with the express consent of a minor's parent or legal guardian.

(c) 12 Personalized recommendations.--A social media platform may provide a prominent, accessible and responsive tool for a user who is a minor to opt in to the use of search and watch history for use in personalized recommendation systems. A social media platform may not use a personalized recommendation system unless a minor opts in.

(d) 13 Processing by default.--A social media platform may not process the precise geolocation information of a minor by default unless the processing of the precise geolocation information: (1) is strictly necessary for the social media company to provide the service, product or feature requested by the minor consumer; or (2) is only for the amount of time necessary to provide the service, product or feature.

(e) 13 Conspicuous signal.--A social media platform may not process the precise geolocation information of a minor without providing a conspicuous signal to the minor consumer for the duration of the processing.

(f) 14 Dark patterns.--A social media platform may not use dark patterns.

(g) 15 Unknown adult contact.--A social media platform may not permit, by default, an unknown adult to contact a minor consumer on the social media platform without the minor consumer first initiating the contact.

This section contains the bill's core data-protection prohibitions applicable to minors under 18. It prohibits data mining of minors (with narrow carve-outs for age-appropriate content, harmful content protection, and purpose-limited processing), prohibits selling minor personal information or engaging in targeted advertising based on a minor's age, gender, or interests, requires opt-in consent before using personalized recommendation systems for minors, restricts default processing of minor precise geolocation data, requires a conspicuous signal during geolocation processing, prohibits dark patterns, and prohibits unknown adults from contacting minors by default.

Compliance actions 6 items

Social media companies must not mine data related to a minor account holder, except for (1) age and location data for age-appropriate content recommendations, (2) data necessary to protect minors from harmful content, or (3) data that is adequate, relevant, and reasonably necessary for the disclosed processing purpose.

D-01.4

Social media companies must not sell or profit from personal information of a minor account holder, and must not engage in targeted advertising based on a minor's age, gender, or interests, regardless of whether parental consent was obtained.

MN-01.7

Social media platforms must not use personalized recommendation systems for minor users unless the minor has affirmatively opted in to the use of search and watch history for recommendations.

D-01.6

Social media platforms must not process a minor's precise geolocation information by default unless strictly necessary to provide a requested service, product, or feature and only for the duration necessary. When processing a minor's precise geolocation, the platform must provide a conspicuous signal to the minor for the duration of the processing.

D-01.4

Social media platforms must not use dark patterns when interacting with minor users.

CP-01.3

Social media platforms must not permit, by default, an unknown adult to contact a minor on the platform unless the minor initiates the contact first.

MN-01.8

50 Pa.C.S. § 1133

Violations (Data Prohibitions)

(a)–(d) Actions.--The Attorney General shall have jurisdiction to bring an action against a social media company that knowingly, intentionally or negligently violates a prohibition under section 1132 (relating to prohibitions). (b) Civil penalties.-- (1) For a first offense for an action brought on behalf of a single minor, a civil penalty not to exceed $10,000. (2) For a second offense for an action brought on behalf of the same single minor under paragraph (1), a civil penalty not to exceed $50,000. (3) For a third or subsequent offense for an action brought on behalf of the same single minor under paragraph (1), a civil penalty not to exceed $500,000. (4) For a first offense for an action brought on behalf of multiple minors, a civil penalty not to exceed the greater of $50,000,000 or the total number of violations multiplied by the maximum civil penalty under paragraph (1). (5) For a violation of paragraphs (1), (2), (3) and (4), a court of competent jurisdiction may order data collected as a result of a violation of a prohibition under section 1132 to be scrubbed and removed from the Internet. The cost of removal shall be paid by the social media company. (6) If a court of competent jurisdiction determines that there has been repeated intentional violations of a prohibition under section 1132 by a social media company, the court may prohibit the social media company from operating accounts for minors in this Commonwealth. (c) Use of recovered civil penalties.--Civil penalties collected under this section shall be deposited into the School Safety and Security Fund to be used for mental-health-related services for school entities. (d) Good faith.--It shall be a defense to an action under subsection (a) if a social media company takes good faith actions to limit the personal information mined from a minor or acts in good faith to prohibit the sale of personal information of a minor.

This section establishes the enforcement framework for Subchapter D data prohibitions. The Attorney General has jurisdiction over knowing, intentional, or negligent violations. Civil penalties escalate up to $500,000 per minor for third-plus offenses, and up to the greater of $50,000,000 or violations × $10,000 for multi-minor first offenses. Courts may order data scrubbing at the company's cost and may prohibit repeated intentional violators from operating minor accounts in Pennsylvania. Civil penalties are deposited into the School Safety and Security Fund. A good-faith defense is available. This is an enforcement provision that creates no independent compliance duty.

50 Pa.C.S. § 1134

Removal

Deployer

(a) 16 Process.--In response to a request from a qualified individual, a social media platform shall provide the individual the ability to correct or delete personal information that the qualified individual has provided to the social media platform or that the social media platform obtained about the qualified individual. De-identified information may be considered deleted for purposes of this subchapter.

(b) 16 Fulfilling requests.--To help fulfill requests from a qualified individual, a social media platform may: (1) require the qualified individual to reasonably identify the activities to which the qualified individual's request relates; and (2) provide automated tools that allow qualified individuals to correct or delete personal information under subsection (a).

(c) 17 Notice.--A social media company that has mined or collected personal information from a minor or retains personal information about a minor shall prominently display notice on the website of how a qualified individual can request that the social media platform delete the personal information in the possession of the social media platform that was collected from or about the individual when the individual was a minor.

(d) 16 Deletion.--Upon a request of a qualified individual, a social media company shall, no later than 30 days after the request, delete personal information in the possession of the social media company that was mined or collected from or about the individual when the individual was a minor.

(e) 16 Confirmation.--Within 90 business days of personal information being deleted by the social media company, the social media company shall provide, by written communication, notice to the qualified individual that personal information has been deleted.

(f) Violations.--A social media company that fails to delete personal information when a request to delete personal information is made by a qualified individual shall be strictly liable for a civil penalty of $10,000 per day per website until the personal information has been removed. If a social media company has received consent from a parent or guardian to collect personal information of a minor, the consent shall be an absolute defense to a violation of this section. The Attorney General shall have exclusive jurisdiction to bring an action under this section.

This section grants qualified individuals (parents/guardians and adult former-minors) the right to correct or delete personal information collected from or about the individual when they were a minor. Social media platforms must provide deletion tools, prominently display notice on their website of how to request deletion, complete deletion within 30 days, and confirm deletion in writing within 90 business days. Failure to delete triggers strict liability of $10,000 per day per website. Prior parental consent to collect is an absolute defense. The Attorney General has exclusive enforcement jurisdiction.

Compliance actions 2 items

Social media platforms must, upon request from a qualified individual (parent/guardian or adult former-minor), provide the ability to correct or delete personal information collected from or about the individual when they were a minor, complete deletion within 30 days of the request, and provide written confirmation of deletion within 90 business days. Prior parental consent to collect is an absolute defense to enforcement of the deletion obligation.

D-01.2

Social media companies that have mined, collected, or retain personal information about a minor must prominently display on their website notice of how a qualified individual can request deletion of the minor's personal information.

MN-01.9

Minor Safety Parental consent · controls · termination workflows

9 items

MN-01.1

MN-01.2

MN-01.9

MN-01.3

MN-01.9

MN-01.7

MN-01.8

Social media platforms must not permit, by default, an unknown adult to contact a minor on the platform unless the minor initiates the contact first.

MN-01.9

Data Controls Data sale restrictions · deidentification

4 items

D-01.4

D-01.6

Social media platforms must not use personalized recommendation systems for minor users unless the minor has affirmatively opted in to the use of search and watch history for recommendations.

D-01.4

D-01.2

Deceptive Conduct AI-generated likeness · consent requirements

1 item

CP-01.3

Social media platforms must not use dark patterns when interacting with minor users.

Governance Risk management · accountability programs

1 item

G-01.3

—

Other

2 items

—

Social media platforms must publish a clear and concise policy on their website and application describing how the platform will respond to and address reports of hateful conduct.

Passage Likelihood

Low

Status Introduced

Chamber No passage

Committee No action

Majority party Yes

Bipartisan No

Prior session None

Legislative History

2025-05-08 Referred to Communications & Technology

Sources

Full Text ↗

Entry Last Reviewed

2026-05-20

AI generated