An Act amending the act of December 17, 1968 (P.L.1224, No.387), known as the Unfair Trade Practices and Consumer Protection Law, further providing for definitions and for unlawful acts or practices and exclusions; and providing for conduct relating to reproductive health data and sexual health data.

PRINTER'S NO. 1777
THE GENERAL ASSEMBLY OF PENNSYLVANIA
SENATE BILL
No. 1350
Session of
2026
INTRODUCED BY COLLETT, KANE, COMITTA, FONTANA, SANTARSIERO,
COSTA, SAVAL, CAPPELLETTI, HAYWOOD, TARTAGLIONE AND SCHWANK,
JUNE 5, 2026
REFERRED TO CONSUMER PROTECTION AND PROFESSIONAL LICENSURE,
JUNE 5, 2026
AN ACT
Amending the act of December 17, 1968 (P.L.1224, No.387),
entitled "An act prohibiting unfair methods of competition
and unfair or deceptive acts or practices in the conduct of
any trade or commerce, giving the Attorney General and
District Attorneys certain powers and duties and providing
penalties," further providing for definitions and for
unlawful acts or practices and exclusions; and providing for
conduct relating to reproductive health data and sexual
health data.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Section 2(4) of the act of December 17, 1968
(P.L.1224, No.387), known as the Unfair Trade Practices and
Consumer Protection Law, is amended by adding a subclause to
read:
Section 2. Definitions.--As used in this act.
* * *
(4) "Unfair methods of competition" and "unfair or deceptive
acts or practices" mean any one or more of the following:
* * *
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
(xx.1) Conduct prohibited under section 9.5.
* * *
Section 2. Section 3 of the act is amended by adding
subsections to read:
Section 3. Unlawful Acts or Practices; Exclusions.--* * *
(d) The Attorney General shall:
(1) During the period beginning July 1, 2027, and ending
December 31, 2027, and, prior to initiating an action for a
violation of section 9.5, issue a notice of violation to the
covered entity or processor if the Attorney General determines
that a cure is possible. If the covered entity or processor
fails to cure the violation within sixty days of receipt of the
notice of violation, the Attorney General may initiate an action
under this section.
(2) Beginning January 1, 2027, in determining whether to
grant a covered entity or processor the opportunity to cure an
alleged violation under clause (1), consider all of the
following:
(i) The number of violations.
(ii) The size and complexity of the covered entity or
processor.
(iii) The nature and extent of the processing activities of
the covered entity or processor.
(iv) The substantial likelihood of injury to the public.
(v) The safety of persons or property.
(vi) Whether the alleged violation was likely caused by
human or technical error.
(e) Nothing in subsection (d) shall be construed as
providing the basis for a private right of action for a
violation of the provisions of this act.
20260SB1350PN1777 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Section 3. The act is amended by adding a section to read:
Section 9.5. Conduct Relating to Reproductive Health Data
and Sexual Health Data.--(a) A covered entity or processor may
not collect or process reproductive health data or sexual health
data unless the covered entity or processor:
(1) provides the consumer whose reproductive health data or
sexual health data is being collected with a copy of the covered
entity or processor's privacy policy;
(2) obtains consent from the consumer to collect or process
the consumer's reproductive health data or sexual health data;
and
(3) collects or processes the reproductive health data or
sexual health data permitted under subsection (b).
(b) A covered entity or processor may collect or process
reproductive health data or sexual health data only to:
(1) Provide a product, service or service feature to the
consumer to whom the reproductive health data or sexual health
data pertains when that consumer requested the product, service
or service feature by subscribing to, creating an account with
or otherwise contracting with the covered entity or processor.
(2) Initiate, manage, execute or complete a financial or
commercial transaction or to fulfill an order for a specific
product or service requested by a consumer to whom the
reproductive health data or sexual health data pertains,
including associated routine administrative, operational and
account servicing activity such as billing, shipping, storage
and accounting.
(3) Comply with an obligation under Federal or State law.
(4) Protect public safety or public health.
(c) A covered entity or processor shall provide on the
20260SB1350PN1777 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
covered entity or processor's publicly accessible Internet
website a clear and conspicuous method that enables a consumer
to request access to and deletion of the consumer's reproductive
health data and sexual health data.
(d) A covered entity or processor may not:
(1) Collect more precise or retain reproductive health data
and sexual health data than is necessary to perform a purpose
described in subsection (a).
(2) Derive from reproductive health data or sexual health
data any information that is not necessary to perform a purpose
described in subsection (a).
(3) Disclose, cause to disclose, assist with the disclosure
of or facilitate the disclosure of a consumer's reproductive
health data or sexual health data to a third party, including
when the data is part of a merger, acquisition, bankruptcy or
other transaction or a proposed merger, acquisition, bankruptcy
or other transaction, unless the disclosure is:
(i) necessary to perform a purpose described under
subsection (a);
(ii) performed with valid consent obtained from the consumer
to whom the reproductive health data or sexual health data
pertains; and
(iii) if the third party is Federal, State or local law
enforcement:
(A) served to the covered entity or processor with a valid
warrant or establishes the existence of an exigent circumstance;
(B) disclosed by a mandate under Federal or State law; or
(C) disclosed at the request of the consumer to whom the
reproductive health data pertains.
(e) Beginning June 30, 2027, a covered entity or processor
20260SB1350PN1777 - 4 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
may not sell or offer to sell reproductive health data or sexual
health data unless the covered entity or process obtains valid
consent in accordance with subsection (f) from the consumer to
whom the reproductive health data or sexual health data
pertains.
(f) Consent to collect, sell or offer to sell reproductive
health data or sexual health data under subsection (e) must be
in writing, in plain language and contain all of the following
to be valid:
(1) The specific reproductive health data or sexual health
data pertaining to the consumer that the covered entity or
processor intends to sell.
(2) The name and contact information of the covered entity
or processor collecting and selling the reproductive health data
or sexual health data.
(3) A description of the purpose for the sale, including how
the reproductive health data or sexual health data is gathered
by the covered entity or processor and how the reproductive
health data or sexual health data is used by the person
purchasing the reproductive health data or sexual health data.
(4) A statement that the provision of goods and services
offered by the covered entity or processor is not conditioned on
the consumer signing the consent.
(5) A statement that the consumer, or an authorized
representative of the consumer, may revoke the consent at any
time and contain a description of how to submit a revocation of
consent.
(6) A statement that the reproductive health data or sexual
health data sold in accordance with valid consent, obtained
according to this subsection, is subject to redisclosure and
20260SB1350PN1777 - 5 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
valid for one transaction. A valid consent shall be required for
each transaction.
(7) The signature of the consumer providing consent and the
date on which the consent was signed by the consumer.
(8) An expiration date for the consent, which may expire no
earlier than one year after the consumer's signature.
(g) Consent is not valid if:
(1) the expiration date of the consent has passed;
(2) the consent does not contain all of the information
required under subsection (f);
(3) the consent has been revoked by the consumer;
(4) the consent has been combined with a consent for other
documents; and
(5) the good or service is used in a manner contrary to what
the consumer knows or should have known when the consumer
provided consent.
(h) A copy of the valid consent must be provided to the
consumer by the covered entity or processor selling or offering
to sell the reproductive health data or sexual health data.
(i) A covered entity, processor or purchaser that sells,
offers to sell or purchase reproductive health data or sexual
health data shall retain a copy of the valid consent for not
less than six years after the date that the consent is signed by
the consumer or the date when the consent was last in effect,
whichever is later.
(j) A covered entity or processor that sells reproductive
health data or sexual health data shall provide a clear and
conspicuous method on the covered entity's or processor's
publicly accessible Internet website that enables a consumer, or
a person authorized by the consumer, to revoke the consumer's
20260SB1350PN1777 - 6 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
consent to sell reproductive health data or sexual health data
at any time.
(k) A covered entity or processor selling a consumer's
reproductive health data or sexual health data and the purchaser
of the reproductive health data or sexual health data must enter
into a written agreement governing the purchaser's processing of
the consumer's reproductive health data and sexual health data.
The written agreement shall:
(1) State the nature and purpose of the sale, the type of
reproductive health data or sexual health data subject to the
sale, the duration of processing and the rights and obligations
of the parties.
(2) Require the purchaser to adhere to the requirements that
a covered entity or service provider must adhere to this
section.
(3) Restrict how the purchaser may process the reproductive
health data or sexual health data.
(4) Require the purchaser to destroy, delete or return all
reproductive health data and sexual health data to the covered
entity or service provider at the end of the service or on
revocation of consent by the consumer, unless retention of the
reproductive health data or sexual health data is required by
law.
(l) A covered entity or processor may not implement a
geofence around an entity that provides in-person reproductive
health services if the geofence:
(1) identifies or tracks a consumer seeking reproductive
health services;
(2) collects reproductive health data or sexual health data
from the consumer; or
20260SB1350PN1777 - 7 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(3) sends a notification, message or advertisement to the
consumer related to the consumer's reproductive health data or
sexual health data.
(m) Nothing in this section shall be construed to apply to a
covered entity or processor regarding protected health
information under HIPAA and the regulations promulgated under
HIPAA including 45 CFR Pts. 160 (relating to general
administrative requirements) and 164 (relating to security and
privacy).
(n) As used in this section:
"Collect" means to buy, rent, gather, obtain, receive or
access reproductive health data or sexual health data about an
individual in any manner, including, by receiving data from the
individual, actively or passively or by tracking the
individual's online activity.
"Consent" means, in a relation to an individual, an
affirmative act signifying the individual's freely given,
specific, informed and unambiguous agreement to allow the
processing of personal data relating to the individual. The term
includes a written statement including by electronic means. The
term does not include:
(1) Acceptance of terms of use without requiring the
individual to read the terms of use.
(2) Acceptance of a document that contains a general
description of personal data processing along with additional
unrelated information.
(3) Acceptance of terms of use by hovering over, muting,
pausing or closing a given piece of content or an agreement
obtained through the use of dark patterns.
"Controller" means either of the following:
20260SB1350PN1777 - 8 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(1) A sole proprietorship, partnership, limited liability
company, corporation, association or other legal entity that
meets the following criteria:
(i) is organized or operated for the profit or financial
benefit of shareholders or other owners;
(ii) alone or jointly with others, determines the purposes
and means of the processing of personal information of an
individual;
(iii) conducts business in this Commonwealth; and
(iv) satisfies one of the following thresholds:
(A) has annual gross revenues more than ten million dollars
($10,000,000);
(B) annually buys, receives, sells or shares for commercial
purposes, personal information of at least fifty thousand
(50,000) consumers, households or devices;
(C) derives at least fifty percent (50%) of annual revenues
from the sale of personal data; or
(2) an entity that controls or shares common branding with a
sole proprietorship, partnership, limited liability company,
corporation, association or other legal entity that meets the
criteria of clause (1).
"Covered entity" means a public, private, operated for profit
or not operated for profit business or organization that
provides reproductive health care, placement or services and
collects reproductive health data or sexual health data from an
individual and operates in this Commonwealth. The term includes
a business or organization that licenses or certifies the
provision of reproductive health care, placement or services.
"Dark pattern" means a user interface designed or manipulated
with the substantial effect of subverting or impairing user
20260SB1350PN1777 - 9 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
autonomy, decision making or choice, including unfair methods of
competition prohibited under 15 U.S.C. § 45 (relating to unfair
methods of competition unlawful; prevention by Commission).
"Geofence" means technology that uses global positioning
coordinates, cell tower connectivity, cellular data, radio
frequency identification, Wi-Fi data or any other form of
spatial or location detection used to establish a virtual
boundary around a specific physical location or to locate an
individual within a virtual boundary of no more than one
thousand eight hundred and fifty feet (1,850).
"HIPAA" means the Health Insurance Portability and
Accountability Act of 1996 (Public Law 104-191, 42 U.S.C. Ch. 7
Subch. XI Pt. C).
"Neural data" means information obtained by neurotechnology.
The term does not include data inferred from nonneural
information.
"Neurotechnology" means a device capable of recording,
interpreting or altering the response of an individual's central
or peripheral nervous system to internal or external environment
of the device.
"Personal data" means information related to an individual's
physical or mental health status, healthcare provision or health
outcomes. The term includes medical history, diagnoses,
treatment plans, medications, laboratory test results and other
health-related information that can identify an individual or
provide insights into the health status of the individual.
"Process" or "processing" means an operation or set of
operations performed, whether by manual or automated means, on
personal data or on sets of reproductive health data or sexual
health data, including the collection, use, storage, disclosure,
20260SB1350PN1777 - 10 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
analysis, deletion or modification of reproductive health data
or sexual health data.
"Processor" means an individual, partnership, corporation,
limited liability company, association, governmental entity or
other legal entity that collects, processes, retains, transfers
or sells reproductive health data or sexual health data on
behalf or direction of a covered entity.
"Reproductive health data" means as follows:
(1) Information relating to the reproductive or sexual
health data of an individual, including:
(i) Efforts to research or obtain reproductive or sexual
health information services or supplies, including location
information unless the individual provides consent.
(ii) Reproductive health conditions, status, diseases or
diagnoses, including pregnancy, menstruation, ovulation, ability
to conceive a pregnancy, whether an individual is sexually
active or engages in unprotected sex.
(iii) Reproductive and sexual-health-related surgeries and
procedures, including termination of a pregnancy.
(iv) Use or purchase of contraceptives, birth control or
other medication related to reproductive health, including
abortifacients.
(v) Bodily functions, vital signs, measurements or symptoms
related to menstruation or pregnancy, including basal
temperature, cramps, bodily discharge or hormone levels.
(vi) Information about diagnoses or diagnostic testing,
treatments, medications or the use of any product or service
relating to the matters described in subclauses (i), (ii),
(iii), (iv) and (v).
(vii) Neural data.
20260SB1350PN1777 - 11 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(viii) Information described in in this clause that is
derived from non-health-related information such as proxy,
derivative, inferred, emergent or algorithmic data.
(2) The term does not include health information that is
protected under HIPAA, health records for the purposes of 49 Pa.
Code § 16.95 (relating to medical records) or patient-
identifying records for the purposes of 42 U.S.C. § 290dd-2
(relating to confidentiality of records).
"Reproductive health services" means a health care service or
product that supports or relates to an individual's reproductive
system, pregnancy status or sexual well-being, including:
(1) Individual health conditions, status, diseases or
diagnoses.
(2) Social, psychological, behavioral and medical
interventions.
(3) Health-related surgeries or procedures, including
abortions.
(4) Bodily functions, vital signs, symptoms or measurements.
(5) Diagnoses or diagnostic testing, treatment or
medication.
(6) Medical or nonmedical services related to and provided
in conjunction with an abortion, including associated
diagnostics, counseling, supplies and follow-up services.
"Sale of personal data" means as follows:
(1) The exchange of personal data for monetary or other
valuable consideration by a controller to a third party.
(2) The term does not include the following:
(i) The disclosure of personal data to a processor that
processes the personal data on behalf of a controller.
(ii) The disclosure of personal data to a third party for
20260SB1350PN1777 - 12 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
the purpose of providing a product or service requested by an
individual.
(iii) The disclosure or transfer of personal data to an
affiliate of a controller.
(iv) The disclosure of personal data when an individual
directs a controller to disclose the individual's personal data
or intentionally uses the controller to interact with a third
party.
(v) The disclosure of personal data that an individual
intentionally:
(A) made available to the general public via a channel of
mass media; and
(B) did not restrict to a specific audience.
(vi) The disclosure or transfer of personal data from a
controller to a third party as an asset that is part of a
merger, acquisition, bankruptcy or other transaction or a
proposed merger, acquisition, bankruptcy or other transaction,
in which the third party assumes control of all or part of the
controller's assets.
"Sexual health data" means information pertaining to an
individual's sexual health, including sexual behavior, sexually
transmitted infections, contraceptive use, sexual orientation
and reproductive health. The term includes medical records,
treatment histories and health surveys that analyze the
individual's sexual well-being and access to sexual and
reproductive health services.
"Third party" means a person, including Federal, State or
local law enforcement or a Federal, State or local agency, other
than a controller or processor or an affiliate of the processor
or the controller.
20260SB1350PN1777 - 13 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Section 4. This act shall take effect in one year.
20260SB1350PN1777 - 14 -
1