WI AB1161

Covered businesses (those generating majority revenue from online services likely accessed by users under 18) must set default privacy settings to maximum protection for minors, including hiding accounts from adult users, disabling direct messaging with adults, blocking location sharing, and disabling push notifications

Businesses are prohibited from collecting, selling, or retaining minor's personal data beyond what's necessary for the requested service, using personal data for algorithmic recommendations (with limited exceptions), or sending push notifications between midnight and 6 a.m.

Companies owe a "minimum duty of care" to minors, requiring that their data use and product design not result in foreseeable emotional distress, compulsive use, or discrimination based on protected characteristics

Age verification data must be deleted immediately after determining a user's age range, cannot be used for other purposes, and businesses must provide an appeals process for age determinations

Violations constitute unfair trade practices enforceable by the Department of Justice through investigations and injunctions; the act takes effect January 1, 2027