WI SB978

Covered businesses (those generating majority revenue from online services likely accessed by minors under 18) must set all default privacy settings to the highest level, including hiding minor accounts from known adults, disabling direct messaging with adults, and blocking push notifications

Businesses are prohibited from collecting, selling, or retaining minor personal data unnecessary for active service use, using personal data for algorithmic content recommendations (with limited exceptions), and sending push notifications to minors between midnight and 6 a.m.

Businesses owe a minimum duty of care requiring that their data use and product design not cause reasonably foreseeable emotional distress, compulsive use, or discrimination against minors based on protected characteristics

Age assurance data must be minimized, immediately deleted after age determination (except age range), and cannot be used for other purposes or shared with third parties; the Department of Justice must promulgate rules on age verification methods

Violations constitute unfair trade practices enforceable by the Department of Justice through investigation and injunctive action; the act takes effect January 1, 2027