This is the preview version of the Wisconsin State Legislature site.
Please see http://docs.legis.wisconsin.gov for the production version.
2023 - 2024 LEGISLATURE
SENATE AMENDMENT 1,
TO SENATE BILL 642
December 12, 2023 - Offered by Senator Quinn.
SB642-SA1,1,11 At the locations indicated, amend the bill as follows:
SB642-SA1,1,2 21. Page 3, line 1: delete “134.985" and substitute “100.75".
SB642-SA1,1,3 32. Page 3, line 2: delete “134.985" and substitute “100.75".
SB642-SA1,1,5 43. Page 3, line 12: after “rights" insert “, or is an individual with authority to
5exercise such rights of a consumer,".
SB642-SA1,1,7 64. Page 3, line 17: after “therefrom" insert “unless such data is generated to
7identify a specific individual".
SB642-SA1,1,9 85. Page 4, line 4: after “action." insert ““Consent” does not include any of the
9following:
SB642-SA1,1,1210 1. Acceptance of a general terms-of-use document or similar document that
11contains descriptions of personal data processing along with other, unrelated
12information.
SB642-SA1,2,1
12. Hovering over, muting, pausing, or closing a given piece of content.
SB642-SA1,2,22 3. Agreements obtained by using dark patterns.".
SB642-SA1,2,3 36. Page 4, line 12: after that line insert:
SB642-SA1,2,6 4“(jd) “Dark pattern” means a user interface designed or manipulated with the
5substantial effect of subverting or impairing user autonomy, decision making, or
6choice.”.
SB642-SA1,2,9 77. Page 4, line 21: after “indirectly" insert “, in particular by reference to an
8identifier such as a name, an identification number, specific geolocation data, or an
9online identifier".
SB642-SA1,2,10 108. Page 6, line 14: after “monetary" insert “or other valuable".
SB642-SA1,2,11 119. Page 6, line 20: after that line insert:
SB642-SA1,2,14 12“2m. The disclosure of personal data based on the consumer directing the
13controller to disclose the personal data or intentionally using the controller to
14interact with a 3rd party.”.
SB642-SA1,2,15 1510. Page 7, line 12: after “obtained" insert “or inferred".
SB642-SA1,2,16 1611. Page 8, line 5: after “consumer" insert “or a consumer's authorized agent".
SB642-SA1,2,21 1712. Page 9, line 3: after “consumer." insert “A consumer may exercise the
18consumer's rights through user-enabled global privacy controls, such as a browser
19plugin or privacy setting, device setting, or other mechanism, that communicate or
20signal the consumer's choice to opt out of processing for the purpose of targeted
21advertising or sale of the consumer's personal data.".
SB642-SA1,2,22 2213. Page 10, line 21: delete “attorney general" and substitute “department".
SB642-SA1,3,2
114. Page 11, line 18: delete the material beginning with “the consumer" and
2ending with “sub. (2) (a) 5. or" on line 19.
SB642-SA1,3,5 315. Page 12, line 25: after “account." insert “A controller that recognizes
4signals approved by other states shall be considered in compliance with this
5paragraph. Such means shall include all of the following:
SB642-SA1,3,86 1. A clear and conspicuous link on the controller's website to a webpage that
7enables a consumer or an agent of a consumer to opt out of the targeted advertising
8or sale of the consumer's personal data.
SB642-SA1,3,139 2. On or after July 1, 2026, an opt-out preference signal sent, with a consumer's
10consent, by a platform, technology, or mechanism to the controller indicating the
11consumer's intent to opt out of any processing of the consumer's personal data for the
12purpose of targeted advertising or sale of the consumer's personal data. Such
13platform, technology, or mechanism shall do all of the following:
SB642-SA1,3,1414 a. Not unfairly advantage one controller over another.
SB642-SA1,3,1615 b. Require the consumer to make an affirmative and unambiguous choice to opt
16out of any processing of the consumer's personal data.
SB642-SA1,3,1717 c. Be easy to use by the average consumer.
SB642-SA1,3,2018 d. Enable the controller to accurately determine whether the consumer is a
19resident of this state and whether the consumer has made a legitimate request to opt
20out of any targeted advertising or sale of the consumer's personal data.”.
SB642-SA1,3,21 2116. Page 15, line 1: after “shall" insert “regularly".
SB642-SA1,3,22 2217. Page 15, line 17: after that line insert:
SB642-SA1,3,24 23“6. The processing of personal data related to any good, service, or product
24feature likely to be accessed by a child.”.
SB642-SA1,4,2
118. Page 16, line 3: on lines 3, 5 and 7, delete “attorney general" and substitute
2“department".
SB642-SA1,4,4 319. Page 16, line 3: delete the material beginning with “a civil" and ending
4with “under" on line 4.
SB642-SA1,4,5 520. Page 16, line 4: delete “(a)".
SB642-SA1,4,7 621. Page 16, line 6: delete the material beginning with “attorney" and ending
7with “general" on line 7 and substitute “department”.
SB642-SA1,4,8 822. Page 16, line 11: delete “attorney general" and substitute “department".
SB642-SA1,4,10 923. Page 22, line 3: after “society," insert “entity regulated by the federal Farm
10Credit Administration,".
SB642-SA1,4,13 1124. Page 23, line 23: after “et seq." insert “and the information is not collected,
12maintained, disclosed, sold, communicated, or used except as authorized by the
13federal Fair Credit Reporting Act.".
SB642-SA1,4,15 1425. Page 24, line 17: delete the material beginning with that line and ending
15with page 25, line 23, and substitute:
SB642-SA1,4,17 16(9) Violations. (a) The department and the department of justice shall have
17authority to enforce violations of this section.
SB642-SA1,5,218 (b) 1. The department or the department of justice shall, at least 30 days before
19initiating any action under this section, provide a controller or processor written
20notice that identifies the specific provisions of this section the department or the
21department of justice alleges have been or are being violated. If within the 30 days
22the controller or processor cures the noticed violation and provides the department
23or the department of justice an express written statement that the alleged violations

1have been cured and that no such further violations shall occur, no action shall be
2initiated against the controller or processor.
SB642-SA1,5,63 2. Notwithstanding subd. 1., if a controller or processor continues to violate this
4section in breach of an express written statement provided to the department or the
5department of justice under subd. 1., the department or the department of justice
6may initiate an action under this section.
SB642-SA1,5,87 (c) Nothing in this section shall be construed as providing the basis for, or being
8subject to, a private right of action to violations of this section or under any other law.
SB642-SA1,5,21 9(10) Enforcement; penalties. (a) The department or the department of justice
10has exclusive authority to enforce violations of this section. The department or the
11department of justice may commence an action in any court of competent jurisdiction
12in the name of this state to restrain by temporary or permanent injunction the
13violation of this section and any order issued under this section and to recover a civil
14forfeiture of not less than $100 and not more than $10,000 for each violation of this
15section or of any order, including an injunction, issued under this section. The court
16may in its discretion, prior to the entry of final judgment, make such orders or
17judgments as may be necessary to restore any person any pecuniary loss suffered
18because of the acts or practices involved in the action, provided proof thereof is
19submitted to the satisfaction of the court. The department may use its authority in
20ss. 93.14 and 93.15 to investigate violations of this section and any order issued
21under this section.
SB642-SA1,6,422 (b) The department of justice may issue a civil investigative demand to any
23controller or processor believed to be engaged in, or about to engage in, any violation
24of this section, and by the civil investigative demand the department of justice may
25compel the attendance of any officers or agents of the controller or processor, examine

1the officers or agents of the controller or processor under oath, require the production
2of any books or papers that the department of justice deems relevant or material to
3the inquiry, and issue written interrogatories to be answered by the officers or agents
4of the controller or processor.
SB642-SA1,6,125 (c) The department or the department of justice may serve a complaint, notice,
6order, civil investigative demand, or other process in the manner provided for service
7of a summons, or a subpoena as provided by s. 885.03, and either may be served by
8registered mail to an address that the controller or processor previously furnished
9to the department, the department of justice, or the department of financial
10institutions. Service may be proved by affidavit. Service in any event may also be
11by registered mail addressed to the controller or processor and proved by post office
12return receipt, in which case the time of service is the date borne by the receipt.
SB642-SA1,6,1613 (d) Notwithstanding s. 814.04 (1), the department or the department of justice
14may recover reasonable expenses incurred in investigating, preparing, and
15prosecuting the case, including attorney fees, of any action initiated under this
16section.”.
SB642-SA1,6,17 1726. Page 25, line 25: after that line insert:
SB642-SA1,6,19 18 Section 1g. 100.75 (9) (b) 1. of the statutes, as created by 2023 Wisconsin Act
19.... (this act), is repealed.
SB642-SA1,1r 20Section 1r. 100.75 (9) (b) 2. of the statutes, as created by 2023 Wisconsin Act
21.... (this act), is renumbered 100.75 (9) (b) and amended to read:
SB642-SA1,7,222 100.75 (9) (b) 2. Notwithstanding subd. 1., if If a controller or processor
23continues to violate violates this section in breach of an express written statement

1provided to the consumer under subd. 1.
, the department or the department of justice
2may initiate an action under this section.”.
SB642-SA1,7,3 327. Page 26, line 1: delete lines 1 and 2 and substitute:
SB642-SA1,7,5 4 Section 2m. Effective dates. This act takes effect on July 1, 2025, except as
5follows:
SB642-SA1,7,7 6(1) The repeal of s. 100.75 (9) (b) 1. and the renumbering and amendment of s.
7100.75 (9) (b) 2. take effect on July 1, 2029.”.
Loading...
Loading...