1. What is your state’s law on the use of CBD oil in products to be sold to the public, i.e. cosmetics, etc.?

Pennsylvania has no state-specific law on the use of CBD oil in consumer products, one way or the other. Foods and other products containing CBD oil are widely and readily available on the market. However, such foods remain prohibited under Federal law and are regulated by the FDA. The FDA has taken enforcement action against certain CBD purveyors under the Federal Food, Drug and Cosmetic Act for claims that CBD oil can treat diseases or medical conditions.
Pennsylvania allows cultivation of industrial hemp for purposes of producing hemp products with a permit, including CBD oil.

2. Regarding privacy issues, has your state adopted its own version of GDPR or how is your state dealing with GDPR requirements? What other privacy laws has your state adopted recently in response to concerns about the lack of protections for consumers?

Pennsylvania has not adopted its own version of GDPR and has not specifically addressed GDPR requirements in its law.
Pennsylvania has a “Breach of Personal Information Notification Act” that requires notification in the event of a security breach where personal information is accessed. 73 P.S. § 2301, et seq. Recently, the Pennsylvania Supreme Court found that an employer/data holder owed a duty of care to employee’s whose data was stolen in a breach and that the employees could recover damages for the breach. Dittman v. UPMC, 196 A.3d 1036 (Pa. 2018).