PA HB2108

Requires businesses that knowingly process children's (under 18) personal information to complete data protection impact assessments before offering new online services, products, or features likely to be accessed by children

Prohibits covered entities from using dark patterns to encourage children to provide excessive personal information or forego privacy protections, and bars default profiling or precise geolocation tracking of children unless specific conditions are met

Mandates high-privacy default settings for children's accounts and restricts collection, retention, and disclosure of children's personal information identified as high-risk in impact assessments

Authorizes the Office of Attorney General to bring civil actions with penalties up to $2,500 per affected child for negligent violations and $7,500 per affected child for intentional violations

Takes effect December 31, 2027, and would be preempted by any future federal law regulating online privacy protections for individuals under 18