SB977,11,16 (c) 1. Upon receiving a verifiable consumer request from a consumer, a business that has sold or disclosed for a business purpose personal information about that consumer shall disclose to the consumer the following information:

SB977,11,19 a. If the business has collected personal information in the preceding 12 months, the categories of personal information that the business collected about the consumer.

SB977,11,21 b. If the business sold the consumer's personal information in the preceding 12 months, the categories of the personal information that the business sold.

SB977,11,24 c. If the business sold the consumer's personal information in the preceding 12 months, for each 3rd party to whom the business sold the personal information, the categories of personal information that the business sold to the 3rd party.

SB977,12,3 d. If the business disclosed the consumer's personal information for a business purpose in the preceding 12 months, the categories of the personal information that the business disclosed.

SB977,12,5 2. A business shall identify the information required to be disclosed under subd. 1. c. separately from the information required to be disclosed under subd. 1. d.

SB977,12,9 3. A business shall make available to consumers 2 or more methods for submitting verifiable consumer requests for a disclosure under this paragraph including, at a minimum, a toll-free telephone number and, if the business maintains an Internet site, an Internet address.

SB977,12,15 4. a. Except as provided in subd. 4. b., a business shall deliver the disclosure required under this paragraph within 45 days of receiving a verifiable consumer request from a consumer. A business shall promptly take steps to determine whether a request received is a verifiable consumer request. The time that a business spends determining whether a request received is a verifiable consumer request is included in the 45-day deadline under this subd. 4. a.

SB977,12,19 b. A business may deliver the disclosure required under this paragraph within 90 days after receiving a verifiable consumer request if reasonably necessary and if the business notifies the consumer of the delayed delivery before the time period under subd. 4. a. expires.

SB977,13,3 5. A business shall deliver personal information under this paragraph in writing and through the consumer's account with the business, if the consumer maintains an account with the business. If the consumer does not maintain an account with the business, the business shall deliver personal information under this paragraph by mail or electronically, at the choice of the consumer. If the business provides information under this paragraph electronically, the business shall provide the information in a portable and, to the extent technically feasible, a readily useable format that allows the consumer to transmit the information to another entity without hindrance.

SB977,13,6 6. A business may not require a consumer to create an account in order to submit a verifiable consumer request for a disclosure of personal information required under this paragraph.

SB977,13,10 (4) Selling or collecting information. (a) A business may not collect a consumer's personal information or use the personal information for a particular purpose unless the business informs the consumer, at or before the point of collecting the information, about all of the following:

SB977,13,12 1. That the business will collect that category of personal information about the consumer.

SB977,13,14 2. The purpose for which the business will use the category of personal information collected.

SB977,13,16 (b) 1. A business may not sell a consumer's personal information to 3rd parties unless the business satisfies all of the following:

SB977,13,21 a. If the business has an Internet site, the business provides a clear and conspicuous link on the homepage of the Internet site, titled “Do Not Sell My Personal Information,” to an Internet page that enables a consumer or person authorized by the consumer to object to the sale of the consumer's personal information.

SB977,14,2 b. The business includes a statement explaining that a consumer may object to the sale of the consumer's personal information and a link to the Internet page required under subd. 1. a. in its online privacy policy or policies, if the business has an online privacy policy or policies, and any Wisconsin-specific description of consumers' privacy rights.

SB977,14,6 c. The business ensures that each individual responsible for handling consumer inquiries about the business's privacy practices or compliance with this section is informed of the requirements in this subdivision and par. (c) and of how to direct consumers to object to the sale of their personal information under par. (c).

SB977,14,9 2. Subdivision 1. does not require a business to provide the link described in subd. 1. a. on the homepage of an Internet site that the business makes available to the public generally, if all of the following apply:

SB977,14,11 a. The business maintains a separate and additional Internet site that the business dedicates to consumers.

SB977,14,13 b. The Internet site under subd. 2. a. satisfies the requirements under subd. 1. a.

SB977,14,16 c. The business takes reasonable steps to ensure that consumers in this state are directed to the Internet site under subd. 2. a. and not the homepage of the Internet site made available to the public generally.

SB977,14,21 (c) 1. a. A business may not sell personal information that the business collects about a consumer to a 3rd party if the consumer is 16 years of age or older and the consumer directs the business not to sell the consumer's personal information, unless the consumer subsequently provides express authorization for the business to sell the personal information.

SB977,15,2 b. A consumer may authorize another person to, as provided in subd. 1. a., direct a business not to sell the consumer's personal information. A representative authorized under this subd. 1. b. may not subsequently provide express authorization on behalf of the consumer for the business to sell the consumer's personal information.

SB977,15,5 2. A business may not sell personal information that the business collects about a consumer to a 3rd party if the business has actual knowledge that the consumer is under 16 years of age unless any of the following applies:

SB977,15,8 a. The consumer is at least 13 years of age and under 16 years of age and the consumer affirmatively authorizes the business to sell the consumer's personal information.

SB977,15,10 b. The consumer is under 13 years of age and the consumer's parent or guardian affirmatively authorizes the business to sell the consumer's personal information.

SB977,15,12 3. A business that willfully disregards the age of a consumer is considered to have actual knowledge of the consumer's age.

SB977,15,17 4. A business may not request authorization from a consumer or the consumer's parent or guardian to sell the consumer's personal information within 12 months of the most recent occasion that the consumer, parent, or guardian directed the business not to sell the personal information or denied the business's request for authorization to sell the personal information.