SB977,14,9 2. Subdivision 1. does not require a business to provide the link described in subd. 1. a. on the homepage of an Internet site that the business makes available to the public generally, if all of the following apply:

SB977,14,11 a. The business maintains a separate and additional Internet site that the business dedicates to consumers.

SB977,14,13 b. The Internet site under subd. 2. a. satisfies the requirements under subd. 1. a.

SB977,14,16 c. The business takes reasonable steps to ensure that consumers in this state are directed to the Internet site under subd. 2. a. and not the homepage of the Internet site made available to the public generally.

SB977,14,21 (c) 1. a. A business may not sell personal information that the business collects about a consumer to a 3rd party if the consumer is 16 years of age or older and the consumer directs the business not to sell the consumer's personal information, unless the consumer subsequently provides express authorization for the business to sell the personal information.

SB977,15,2 b. A consumer may authorize another person to, as provided in subd. 1. a., direct a business not to sell the consumer's personal information. A representative authorized under this subd. 1. b. may not subsequently provide express authorization on behalf of the consumer for the business to sell the consumer's personal information.

SB977,15,5 2. A business may not sell personal information that the business collects about a consumer to a 3rd party if the business has actual knowledge that the consumer is under 16 years of age unless any of the following applies:

SB977,15,8 a. The consumer is at least 13 years of age and under 16 years of age and the consumer affirmatively authorizes the business to sell the consumer's personal information.

SB977,15,10 b. The consumer is under 13 years of age and the consumer's parent or guardian affirmatively authorizes the business to sell the consumer's personal information.

SB977,15,12 3. A business that willfully disregards the age of a consumer is considered to have actual knowledge of the consumer's age.

SB977,15,17 4. A business may not request authorization from a consumer or the consumer's parent or guardian to sell the consumer's personal information within 12 months of the most recent occasion that the consumer, parent, or guardian directed the business not to sell the personal information or denied the business's request for authorization to sell the personal information.

SB977,15,21 5. A business that collects the personal information of a consumer in connection with receiving a direction under subd. 1. to not sell the consumer's personal information may use the personal information only for the purposes of implementing the consumer's direction not to sell the personal information.

SB977,16,2 (d) 1. A 3rd party may not sell personal information about a consumer that has been sold to the 3rd party by a business unless the 3rd party provides explicit notice to the consumer that the consumer's personal information has been sold to the 3rd party and that the 3rd party intends to sell the information and the 3rd party satisfies par. (b) 1. a. to c.

SB977,16,6 2. A 3rd party may not sell information about a consumer that has been sold to the 3rd party by a business if the consumer directs the 3rd party not to sell the consumer's personal information, unless the consumer subsequently provides express authorization for the 3rd party to sell the personal information.

SB977,16,8 (e) A business may not require a consumer to create an account in order to direct the business not to sell the consumer's personal information under par. (c).

SB977,16,11 (f) A business shall, to protect the personal information of consumers, implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information.

SB977,16,16 (5) Deletion of information. (a) Except as provided in par. (b), a business that receives a verifiable consumer request from a consumer to delete the consumer's personal information shall delete the personal information that the business has collected from the consumer from its records and direct any of the business's service providers to delete the consumer's personal information from their records.

SB977,16,19 (b) A business or its service provider is not required to delete a consumer's personal information if it is necessary for the business or its service provider to maintain the consumer's personal information for any of the following purposes:

SB977,16,24 1. To complete the transaction for which the personal information was collected, to provide a good or service requested by the consumer or reasonably anticipated to be requested by the consumer within the context of the business's ongoing relationship with the consumer, or to otherwise perform a contract between the business and the consumer.

SB977,17,2 2. To detect security incidents, to protect against malicious, deceptive, fraudulent, or illegal activity, or to prosecute a person responsible for that activity.

SB977,17,4 3. To debug to identify and repair errors that impair existing or intended functionality.

SB977,17,6 4. To exercise free speech, to ensure the right of another consumer to exercise free speech, or to exercise another right provided by law.

SB977,17,11 5. If the consumer provides informed consent, to engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, if the business's deletion of the personal information is likely to render impossible or seriously impair the achievement of that research.

SB977,17,14 6. To enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer's relationship with the business.

SB977,17,15 7. To comply with a legal obligation.

SB977,17,18 8. To otherwise use the consumer's personal information internally in a lawful manner that is compatible with the context in which the consumer provided the information.

SB977,17,23 (6) Discrimination prohibited. (a) 1. A business may not discriminate against a consumer because the consumer makes a verifiable consumer request under sub. (3) (a) or (c) or (5) or because under sub. (4) (c) the personal information of the consumer was not permitted to be sold by the business, including by doing any of the following:

SB977,17,24 a. Denying goods or services to the consumer.

SB977,18,2 b. Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.