WI AB172

Applies to businesses controlling/processing personal data of at least 100,000 Wisconsin consumers, or 25,000+ consumers if deriving over 50% of gross revenue from data sales

Grants consumers five core rights: confirm/access their data, correct inaccuracies, delete personal data, obtain portable copies, and opt out of targeted advertising, data sales, and certain profiling

Requires controllers to provide clear privacy notices, limit data collection to disclosed purposes, obtain consent for sensitive data (including biometric data, health information, precise geolocation, and data from children under 13), and conduct data protection assessments for high-risk processing activities

Enforcement authority rests exclusively with DATCP and DOJ—no private right of action—with civil forfeitures of $100 to $10,000 per violation; includes a 30-day cure period before enforcement action through July 1, 2031

Takes effect July 1, 2027, and preempts local ordinances regulating personal data collection, processing, or sale; exempts government entities, nonprofits, financial institutions under Gramm-Leach-Bliley, HIPAA-covered entities, and higher education institutions