Wis. Rep ‘Super Cautiously Optimistic’ About Signing Comprehensive Privacy Bill This Year
Wisconsin Rep. Shannon Zimmerman (R) aims to fast-track comprehensive privacy legislation when state legislators return from summer recess, he said in an interview last week with Privacy Daily. The lawmaker is hopeful that he will find bipartisan support and that the bill will pass in 2025 after it hit roadblocks in prior legislative sessions, he said.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
“This is not the first cycle that I have led this charge,” acknowledged Zimmerman. “We've taken a couple runs at this, and it has been successful the past couple sessions” in clearing one side of the legislature -- the Assembly -- but not the Senate. Going into Wisconsin’s fall session, Zimmerman believes “we have effectively kind of resolved what were some of the barriers” and “I hope it will be the final time that we have to run this thing.”
Zimmerman reintroduced his comprehensive privacy bill (AB-172) in April. Since then, it’s been pending in the Assembly Consumer Protection Committee. Meanwhile, Wisconsin Sen. Romaine Quinn (R) introduced a companion measure (SB-166) with similar text in the Senate. It's in the Regulatory Reform Committee. More than 30 Republicans across both chambers have signed as co-sponsors (see 2503280051).
“As the collection and usage of personally identifiable information continues to grow, the avenues and possibility for misuse will also grow,” Quinn said in a statement emailed to us last week. “Some states have already implemented data protection policies and many more states are considering legislation to assure consumers that they have control over their personal data. Wisconsin should join those states to provide consumers in our state [with] the tools to better manage their data.” Quinn will request a hearing this fall, a spokesperson said.
On the Assembly side, Zimmerman said a hearing is likely in August or September. “I'm going to be moving to … fast-track it: Let's get this thing rolling.” Zimmerman would have moved it earlier in the year, he said, but as a member of the Joint Finance Committee his first focus was the state budget. “That is now done, and so now, once we come out of summer recess, my singular attention will be focused on getting passage of this privacy legislation.”
One reason why Zimmerman is optimistic about getting it through the Senate this year is the public's growing awareness about privacy violations and how “people are manipulated when … their personal data is compromised.” AI large language models learning from massive amounts of personal data has only increased people’s concerns, he added. “It's a bit of a fear factor that is playing in my favor right now.”
Zimmerman said he hasn’t “spoken directly” to Gov. Tony Evers (D) about the legislation. But he has worked with the governor’s office, the Wisconsin DOJ and other agencies, “who all have their fingerprints on this now.” As a result, Zimmerman said he is "super cautiously optimistic that this will be supported by our governor and be a great bipartisan bill.”
The argument that a federal privacy law would be better than separate state statutes is one reason previous iterations failed, but that approach has “weakened over time.” The Republican lawmaker said he doesn’t disagree that one national privacy law would be best, “but, with all due respect to the federal government, they don't get a lot done." Doing nothing in the state would mean "continuing to allow Wisconsinites to be potentially in harm's way," said Zimmerman: Besides, about 20 states have coalesced around “some slightly different variations of data privacy,” so now there’s a “groundswell.”
The other thing that’s held back the bill was that retailers “just don’t want to have to do extra work” to comply, said Zimmerman: While they raised concerns about potential negative impacts on their loyalty programs, the lawmaker thinks “that’s BS -- they just didn't want to have to do the work.”
Following Other States
The 2025 bill includes “three or four minor changes” from previous editions, noted Zimmerman. They don’t “really materially change the bill,” but they perhaps sharpen or clarify its requirements, he added.
If enacted, the proposed Wisconsin privacy bill would take effect July 1, 2027. Without a private right of action, the bill would give the Wisconsin DOJ and the Department of Agriculture, Trade and Consumer Protection (DATCP) exclusive enforcement authority. SB-166 includes a 30-day right to cure that would expire July 1, 2031. Violators of the proposed law could pay up to $10,000 per violation.
A June fiscal estimate on AB-172 said the Wisconsin DATCP has procedures to review and respond to potential consumer privacy complaints “but may not be resourced to handle the volume of complaints resulting from implementation of this bill. Due to the number of notification and data retention requirements, along with the right to cure, mediation and investigation of complaints … will be more complex and require more time to resolve.”
The Wisconsin legislation follows a model that's similar to privacy laws in states besides California. It would apply to controllers that handle or process personal data of at least 100,000 consumers or that control or process the personal data of at least 25,000 consumers and derive more than 50 percent of their gross revenue from the sale of personal data.
The bill contains consumer rights to (1) confirm whether a controller is processing personal data and access that data; (2) correct inaccuracies; (3) delete personal data provided by or about the consumer; (4) obtain a copy of personal data that the consumer previously provided; and (5) opt out of the processing of personal data for targeted advertising, data sale and certain forms of automated processing. The bill would support opt-out preference signals starting July 1, 2028.
While many state legislatures have ended their 2025 sessions, comprehensive privacy bills also remain pending in Michigan, Massachusetts and Pennsylvania.
Pennsylvania’s HB-78 “is awaiting further consideration” by the full House, a spokesperson for sponsor Rep. Ed Neilson (D) emailed. “We are hopeful that HB78 will be considered sometime later this session,” which ends Dec. 31. The House amended the bill in April (see 2504230037).
In Massachusetts, a comprehensive privacy bill including a private right of action and Maryland-like data-minimization requirements seemed to gain steam in May (see 2505130041). The Senate Ways and Means Committee is weighing that and other privacy bills “and we do not have any indication on when they’ll act on them,” said a spokesperson for S-2516 sponsor Sen. Michael Moore (D).