Law / Wisconsin

Wisconsin

age

Wisconsin has not enacted an age-gating statute in any of the four families as of this date, despite significant 2025-2026 legislative activity. An adult content age verification bill (AB 105) passed both the Assembly and Senate but was vetoed by Governor Evers on April 3, 2026, and a veto override failed on May 13, 2026.

A social media age verification and parental consent bill (AB 963, SB 936) passed the Assembly but failed in the Senate in March 2026, and a companion app store accountability bill (AB 962, SB 937) passed the Assembly but did not complete Senate passage before the session adjourned. A legislator introduced a draft age appropriate design code (LRB-5458) in January 2026 that had not yet received a bill number.

privacy

Wisconsin has never enacted a comprehensive controller or processor personal-data statute.

Its most advanced attempt, 2023 Assembly Bill 466 (the Wisconsin Data Privacy Act), passed the Assembly on 2023-11-14 but failed to concur in the Senate on 2024-04-15 and died with the close of the 2023-2024 biennium; its 2025-2026 successors, Senate Bill 166 and Assembly Bill 172, failed even more decisively, both auto-failed under Senate Joint Resolution 1 on 2026-03-23 without ever receiving a floor vote in either chamber, and are not marquee bills recorded here.

Wisconsin's only enacted personal-data statute of general application is its breach-notification statute, Wis. Stat. sec. 134.98, which folds both a DNA profile and unique biometric data, including a fingerprint, voiceprint, or retina or iris image, directly into its definition of personal information, on exactly the same footing as a Social Security number, with no exclusion anywhere in the section for an identifier derived from a photograph, video, or audio recording.

That is the opposite shape from AB 466's dead, never-enacted biometric data definition, which would have excluded a recording-derived identifier unconditionally, the same shape Indiana's, Florida's, Pennsylvania's proposed, and West Virginia's dead bills share.

Wisconsin's breach statute creates no private right of action; unusually in this wave, that finding rests not on a foreclosure clause in the statute's own text but on the statute's own official annotation, which cites a decided federal case, Fox v. Iowa Health System, 399 F. Supp. 3d 780 (2019), directly on the codified page.

7 instruments named 2 researched in detail As of 2026-08-28

Instruments

Each one links to its LexLint note, which carries what it requires and what it flags on.

Breach notification

Notice of unauthorized acquisition of personal information

cite Wis. Stat. sec. 134.98 stage IMMINENT commencement not set source official Wisconsin statute text, Wis. Stat. sec. 134.98, current through 2025 Wis. Act 247, Wisconsin State Legislature website

An entity whose principal place of business is in Wisconsin, or that maintains or licenses personal information in Wisconsin, that knows personal information in its possession has been acquired by an unauthorized person must make reasonable efforts to notify each affected individual within a reasonable time, not to exceed 45 days after learning of the acquisition.

Personal information includes an individual's name combined with, among other elements, a Social Security number, a DNA profile, or unique biometric data such as a fingerprint, voiceprint, or retina or iris image, each on the same footing as the others, with no exclusion anywhere in the section for an identifier derived from a photograph, video, or audio recording. If a single incident requires notifying 1,000 or more individuals, the entity must also notify consumer reporting agencies.

GLBA-compliant and HIPAA-covered entities are exempt outright. The statute's own official annotation states directly that the section does not create a private right of action, citing Fox v. Iowa Health System, 399 F. Supp. 3d 780 (2019).

No separate civil-penalty or forfeiture amount specific to a section 134.98 violation appears within the section itself; Wis. Stat. sec. 134.99 addresses only accomplice or conspirator liability for a chapter violation carrying a forfeiture, without stating the amount or who may bring the action, and this document does not trace the underlying enforcement mechanism further into Wisconsin's general consumer-protection authority under chs. 93 or 100.

What it asks of an app →

Comprehensive regime

Wisconsin Data Privacy Act, AB 466 (2023-2024 Regular Session)

cite 2023 Wis. AB 466, secs. 1-10, as passed by Assembly stage WITHDRAWN no longer proceeding source official Wisconsin bill text, 2023 Assembly Bill 466, as introduced, Wisconsin State Legislature website

2023 Assembly Bill 466, as introduced, would have applied to a controller processing personal data of at least 100,000 consumers, or deriving over 50% of revenue from data sales while processing at least 25,000 consumers' data, the same threshold shape as several other Virginia-model states in this wave and identical in structure to West Virginia's dead HB 2987. Its own effective-date clause specified January 1, 2025, which never took hold since the bill did not become law.

As introduced, biometric data would have meant data from automatic measurements of biological characteristics used to identify a specific individual, but excluded a physical or digital photograph, a video or audio recording, or data generated from either, unconditionally, with no exception for data generated to identify someone; the bill was later amended (Assembly Amendment AA1-AB466) before passing the Assembly on 2023-11-14, and this document treats the quoted definitions as the introduced baseline rather than confirmed as-passed text.

The bill failed to concur in the Senate on 2024-04-15 and died with the close of the 2023-2024 biennium; its 2025-2026 successors, SB 166 and AB 172, both auto-failed on 2026-03-23 under Senate Joint Resolution 1 without a floor vote in either chamber and are not recorded as instruments.

The bill would have foreclosed a private right of action broadly, reaching violations of the bill itself 'or under any other law,' the same broad foreclosure language West Virginia's dead HB 2987 uses, after a 30-day Attorney General cure period, with civil forfeiture up to $7,500 per violation available to the Attorney General alone.

What it asks of an app →

This summary covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted above and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.