Read the full stored bill text
Wisconsin Legislature: AB1161: Bill Text
Skip navigation
Home
Documents
Senate
Assembly
Committees
Service Agencies
Docs
Options
Help
2025 Biennium
Statutes
Admin. Rules
Indices
Miscellaneous
Archives
Home
Bill, Rule, and Appointment Histories
Senators
Representatives
Committees
Text of Introduced Proposals
Amendment Text
Acts
Veto Messages
Enrolled Bills
Votes
Assembly and Senate Floor Calendars
Schedule of Committee Activities
Assembly and Senate Journals
Committee Records (ROCPs)
Legislative Rules
All Session-Related Documents
Subject Index to Acts
Subject Index to Legislation
Subject Index to Journals
Author Index to Legislation
Subject Index to Clearinghouse Rules
Miscellaneous Budget Documents
Executive Orders
Rulings of the Chair
Wisconsin Supreme Court Rules
Opinions of the Attorney General
Town Law Forms
Law
Districts
Session
Drafting Files
Feeds
Preferences
Show tree
Hide tree
Feedback
Help
Home
Senate Home
Senators
Committees
Session
Chief Clerk
Sergeant at Arms
Civics Education
Human Resources
Assembly Home
Representatives
Committees
Session
Chief Clerk
Sergeant at Arms
Human Resources
Schedule
Joint
Senate
Assembly
Study
Legislative Audit Bureau
Legislative Council
Legislative Fiscal Bureau
Legislative Human Resources Office
Legislative Reference Bureau
Legislative Technology Services Bureau
Menu
»
2025
»
Related Documents
»
Proposal Text
»
AB1161: Bill Text
Up
Up
2025 - 2026 LEGISLATURE
LRB-5458/1
ARG:emw&cjs
2025 ASSEMBLY BILL 1161
March 13, 2026 - Introduced by Representatives
Joers
,
Billings
,
Mayadev
,
Andraca
,
Clancy
,
DeSanto
,
DeSmidt
,
Emerson
,
Fitzgerald
,
Goodwin
,
Madison
,
Miresse
,
Neubauer
,
Roe
,
Sinicki
,
Snodgrass
,
Stubbs
,
Udell
and
Vining
, cosponsored by Senators
Smith
,
Hesselbein
,
Roys
,
Wall
and
Spreitzer
. Referred to Committee on Consumer Protection.
AB1161,1,2
1
An Act
to create
100.80 of the statutes;
relating to:
online services accessed
2
by minors, minors’ personal data, and granting rule-making authority.
Analysis by the Legislative Reference Bureau
This bill creates requirements and restrictions related to data collection and use and product design for certain businesses that provide online services to minors.
The bill defines a “covered business” as a business that 1) conducts business in this state; 2) generates a majority of its annual revenue from online services; 3) provides online services, products, or features that are reasonably likely to be accessed by an individual who is less than 18 years of age (minor); 4) collects consumers’ personal data or has consumers’ personal data collected on its behalf; and 5) alone or jointly with others determines the purposes and means of the processing of consumers’ personal data. With exceptions, a “consumer” is an individual who is a resident of this state, and a “covered minor” is a consumer who a covered business knows is a minor or labels as a minor in accordance with rules promulgated by the Department of Justice (discussed below). With exceptions, “personal data” is any information that is linked or reasonably linkable to an identified or identifiable individual or a device of such an individual or of a member of the individual’s household. “Processing” means any operation performed on personal data, including its collection, use, storage, disclosure, analysis, or other handling. With exceptions, an “online service, product, or feature” is a digital product that is accessible to the public by means of the Internet, including through a website or mobile application.
Under the bill, a covered business generally may not 1) collect, sell, share, or retain any personal data of a covered minor that is not necessary to provide an online service, product, or feature with which the covered minor is actively and knowingly engaged; 2) use previously collected personal data of a covered minor for any purpose other than a purpose for which the personal data was collected; 3) permit any individual, including a parent, to monitor the online activity of a covered minor or to track the location of the covered minor without providing a conspicuous signal to the covered minor when the covered minor is being monitored or tracked; 4) with exceptions, use the personal data of a covered minor to select, recommend, or prioritize media for the covered minor; or 5) send push notifications to a covered minor between midnight and 6 a.m.
Also under the bill, a covered business that processes a covered minor’s personal data owes a minimum duty of care to the covered minor that is not satisfied unless its use of the covered minor’s personal data and the design of its online service, product, or feature will not result in 1) reasonably foreseeable emotional distress to the covered minor; 2) reasonably foreseeable compulsive use of the online service, product, or feature by the covered minor; or 3) discrimination against the covered minor based on race, ethnicity, sex, disability, sexual orientation, gender identity, gender expression, religion, or national origin.
The bill defines “age assurance” as methods used to determine, estimate, or communicate the age or age range of an online user. A “processor” is a person who processes personal data on behalf of a covered business or another processor. The bill imposes the following requirements on covered businesses and processors during the process of conducting age assurance: 1) they may collect only the personal data of a user that is strictly necessary for age assurance; 2) upon determining whether a user is a covered minor, they must immediately delete any personal data about the user that they collected for age assurance, except the determination of the user’s age range; 3) they may not use any personal data about a user that they collected for age assurance for any purpose other than age assurance; 4) they may not combine the personal data about a user that they collected for age assurance with any other personal data about the user, except with respect to the determination of the user’s age range; 5) they may not disclose the personal data about a user that they collected for age assurance to a third party that is not a processor; and 6) they must implement a review procedure to allow users to appeal their age determination.
The bill requires a covered business to configure all default privacy settings provided to a covered minor to the highest level of privacy, including all of the following default settings on a social media platform: 1) not displaying the existence of the covered minor’s account, or media created or posted by the covered minor, to a known adult user unless the covered minor has allowed a specific known adult user to view the account or media or has chosen to make public the account or media; 2) not permitting a known adult user to comment or provide feedback on the covered minor’s media unless the covered minor has enabled this function; 3) not permitting direct messaging between the covered minor and a known adult user unless the covered minor chooses to allow direct messaging with a specific known adult user; 4) not displaying the covered minor’s location to other users unless the covered minor shares the covered minor’s location with a specific user; 5) not displaying the users connected to the covered minor unless the covered minor chooses to share the information; 6) disabling search engine indexing of the covered minor’s account profile; and 7) not sending push notifications to the covered minor. In addition, a covered business may not provide a covered minor with a single setting that makes all default privacy settings less protective at once. A covered business also may not request or prompt a covered minor to make privacy settings less protective unless the change is strictly necessary for the covered minor to access an online service, product, or feature that the covered minor has requested. The bill further requires a covered business to provide a prominent tool to allow a covered minor to request that the covered minor’s account on a social media platform be unpublished or deleted and to honor such a request no later than 15 days after receiving the request.
The bill requires a covered business to prominently and clearly provide on its website or mobile application all of the following: 1) the covered business’s terms of service, privacy policies and information, and community standards; 2) for each algorithmic recommendation system used, its purpose and specified information about its inputs, including how each input uses the personal data of covered minors and influences recommendations; and 3) specified information about each feature of a service that uses the personal data of covered minors.
The bill requires DOJ to promulgate rules with respect to certain matters, including identifying commercially reasonable and technically feasible methods for covered businesses and processors to determine if a user is a covered minor and providing privacy protections for age assurance data.
The bill specifies that a covered business or processor that violates the bill’s provisions or rules promulgated under the bill commits an unfair trade practice. DOJ may investigate an alleged violation and may commence an action for a temporary or permanent injunction.
The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:
AB1161,1
1
Section
1
.
100.80 of the statutes is created to read:
AB1161,2,3
2
100.80
Age-appropriate design for online services accessed by
3
minors.
(1)
Definitions.
In this section:
AB1161,3,2
4
(a) “Algorithmic recommendation system” means a system that uses an
5
algorithm to select, filter, and arrange media on a covered business’s website or
1
mobile application for the purpose of selecting, recommending, or prioritizing media
2
for a user.
AB1161,3,8
3
(b) 1. Except as provided in subd. 2., “biometric data” means data generated
4
from the technological processing of an individual’s unique biological, physical, or
5
physiological characteristics that allow or confirm the unique identification of the
6
individual, including iris or retina scans; fingerprints; facial or hand mapping,
7
geometry, or templates; vein patterns; voice prints or vocal biomarkers; and gait or
8
personally identifying physical movement or patterns.
AB1161,3,12
9
2. “Biometric data” does not include a digital or physical photograph; an audio
10
or video recording; or any data generated from a digital or physical photograph or
11
an audio or video recording unless the data is generated to identify a specific
12
individual.
AB1161,3,14
13
(c) “Business entity” has the meaning given in s. 13.62 (5) and also includes
14
any affiliate, as defined in s. 138.14 (1) (a), of the business entity.
AB1161,3,18
15
(d) “Collect,” with respect to data, means buying, renting, gathering,
16
obtaining, receiving, or accessing any data by any means, including receiving data
17
from the consumer, either actively or passively, or by observing the consumer’s
18
behavior.
AB1161,3,22
19
(e) “Compulsive use” means a covered minor’s repetitive use of a covered
20
business’s online service, product, or feature that materially disrupts one or more
21
major life activities of the covered minor, including sleeping, eating, learning,
22
reading, concentrating, communicating, or working.
AB1161,3,24
23
(f) 1. Except as provided in subd. 2., “consumer” means an individual who is a
24
resident of this state.
AB1161,4,1
1
2. “Consumer” does not include any of the following:
AB1161,4,2
2
a. An individual acting in a commercial or employment context.
AB1161,4,7
3
b. An individual acting as an employee, owner, director, officer, or contractor
4
of a business entity, nonprofit organization, or government agency whose
5
communications or transactions with a covered business occur solely within the
6
context of that individual’s role with the business entity, nonprofit organization, or
7
government agency.
AB1161,4,9
8
(g) “Covered business” means a business entity to which all of the following
9
apply:
AB1161,4,10
10
1. The business entity conducts business in this state.
AB1161,4,12
11
2. The business entity generates a majority of its annual revenue from online
12
services.
AB1161,4,14
13
3. The business entity’s online services, products, or features are reasonably
14
likely to be accessed by a minor.
AB1161,4,16
15
4. The business entity collects consumers’ personal data or has consumers’
16
personal data collected on its behalf by a processor.
AB1161,4,18
17
5. The business entity, alone or jointly with others, determines the purposes
18
and means of the processing of consumers’ personal data.
AB1161,4,20
19
(h) “Covered minor” is a consumer who a covered business actually knows is a
20
minor or labels as a minor in accordance with rules promulgated under sub. (7) (b).
AB1161,4,22
21
(i) “Default” means a preselected option adopted by a covered business for an
22
online service, product, or feature.
AB1161,5,4
23
(j) “De-identified data” means data that does not identify and cannot
24
reasonably be used to infer information about, or otherwise be linked to, an
1
identified or identifiable individual or to a device that identifies, is linked to, or is
2
reasonably linkable to one or more identified or identifiable individuals in a
3
household to the extent a covered business that possesses the data does all of the
4
following:
AB1161,5,7
5
1. Takes reasonable measures, including the de-identification requirements
6
set forth under
45 CFR 164.514
, to ensure that the data cannot be used to reidentify
7
the individual and cannot be associated with the individual or device.
AB1161,5,9
8
2. Publicly commits to process the data only in a de-identified fashion and
9
does not attempt to reidentify the individual or device.
AB1161,5,11
10
3. Contractually obligates any recipient of the data to comply with all
11
provisions of this section.
AB1161,5,15
12
(k) “Derived data” means data that is created by the derivation of information,
13
data, assumptions, correlations, inferences, predictions, or conclusions from facts,
14
evidence, or another source of information or data about a minor or a minor’s
15
device.
AB1161,5,16
16
(L) “Genetic data” means any of the following:
AB1161,5,23
17
1. Any data, regardless of its format, that results from the analysis of a
18
biological sample of an individual, or from another source enabling equivalent
19
information to be obtained, and concerns genetic material, including
20
deoxyribonucleic acids, ribonucleic acids, genes, chromosomes, alleles, genomes,
21
alterations or modifications to deoxyribonucleic acids or ribonucleic acids, single
22
nucleotide polymorphisms, epigenetic markers, and uninterpreted data that results
23
from analysis of a biological sample or other source.
AB1161,6,2
1
2. Any information extrapolated, derived, or inferred from data described in
2
subd. 1.
AB1161,6,4
3
(m) “Government agency” includes any federal, state, tribal, or local
4
government entity.
AB1161,6,8
5
(n) “Identified or identifiable individual” means an individual who can be
6
readily identified, directly or indirectly, including by reference to an identifier such
7
as a name, an identification number, specific geolocation data, or an online
8
identifier.
AB1161,6,10
9
(o) “Known adult” is a consumer who a covered business actually knows is an
10
adult or labels as an adult in accordance with rules promulgated under sub. (7) (b).
AB1161,6,11
11
(p) “Minor” means an individual who is less than 18 years of age.
AB1161,6,14
12
(q) 1. Except as provided in subd. 2., “online service, product, or feature”
13
means a digital product that is accessible to the public by means of the Internet,
14
including through a website or mobile application.
AB1161,6,15
15
2. “Online service, product, or feature” does not include any of the following:
AB1161,6,16
16
a. Telecommunications service, as defined in
47 USC 153
(53).
AB1161,6,17
17
b. A broadband Internet access service, as defined in
47 CFR 54.400
.
AB1161,6,18
18
c. A physical product.
AB1161,6,21
19
(r) 1. Except as provided in subd. 2., “personal data” means any information,
20
including derived data and unique identifiers, that is linked or reasonably linkable,
21
alone or in combination with other information, to any of the following:
Down
Down
/2025/related/proposals/ab1161
true
proposaltext
/2025/related/proposals/ab1161
proposaltext/2025/REG/AB1161
proposaltext/2025/REG/AB1161
section
true
Menu
»
2025
»
Related Documents
»
Proposal Text
»
AB1161: Bill Text
×
Details for
PDF view
Link
(Permanent link)
Bookmark this location
View toggle
Go to top of document
Search in this chapter
Search in this section
Search in this agency
Search in this chapter group
Search in this chapter
Search in this section
Cross references for section
Acts affecting this section
References to this
1970 Statutes Annotations
Appellate Court Citations
Administrative Code Index
Reference lines
Clear highlighting