WI SB166

Controllers processing personal data of at least 100,000 Wisconsin consumers, or 25,000 consumers if over 50% of revenue comes from data sales, must comply with new privacy requirements effective July 1, 2027

Consumers gain rights to access, correct, delete, and obtain copies of their personal data, plus the ability to opt out of targeted advertising, data sales, and profiling that produces legal or significant effects

Controllers must provide clear privacy notices, obtain consent before processing sensitive data (including racial/ethnic origin, health diagnoses, biometric data, and precise geolocation), and conduct data protection assessments for high-risk processing activities

Violations carry civil forfeitures of $100 to $10,000 per violation, enforceable exclusively by DATCP and DOJ with no private right of action; a 30-day cure period applies until July 1, 2031

Exemptions include government entities, financial institutions subject to Gramm-Leach-Bliley, HIPAA-covered entities, nonprofits, higher education institutions, and data regulated by federal laws like FERPA and the Fair Credit Reporting Act