Law / United States / 
Wisconsin
Notice of unauthorized acquisition of personal information
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
Commencement not set.
A breach notification rule binding public and private bodies.
As of 28 August 2026.
What it requires
- Make reasonable efforts to notify each affected Wisconsin individual of an unauthorized acquisition of their personal information within a reasonable time, not to exceed 45 days after learning of it.
- Notify consumer reporting agencies if a single incident requires notifying 1,000 or more individuals.
- Treat a recording-derived voiceprint or faceprint as unique biometric data under this statute. It carries no exclusion for an identifier derived from a photograph, video, or audio recording, unlike the dead AB 466's comprehensive-act-style definition.
- Do not expect an individual to be able to sue you directly for a violation of this section. Its own official annotation states that it creates no private right of action.
If you get it wrong
Private right of actionNo
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
An entity whose principal place of business is in Wisconsin, or that maintains or licenses personal information in Wisconsin, that knows personal information in its possession has been acquired by an unauthorized person must make reasonable efforts to notify each affected individual within a reasonable time, not to exceed 45 days after learning of the acquisition.
Personal information includes an individual's name combined with, among other elements, a Social Security number, a DNA profile, or unique biometric data such as a fingerprint, voiceprint, or retina or iris image, each on the same footing as the others, with no exclusion anywhere in the section for an identifier derived from a photograph, video, or audio recording. If a single incident requires notifying 1,000 or more individuals, the entity must also notify consumer reporting agencies.
Gramm-Leach-Bliley Act (GLBA)-compliant and Health Insurance Portability and Accountability Act (HIPAA)-covered entities are exempt outright. The statute's own official annotation states directly that the section does not create a private right of action, citing Fox v. Iowa Health System, 399 F. Supp. 3d 780 (2019).
No separate civil-penalty or forfeiture amount specific to a section 134.98 violation appears within the section itself; Wis. Stat. sec. 134.99 addresses only accomplice or conspirator liability for a chapter violation carrying a forfeiture, without stating the amount or who may bring the action, and the underlying enforcement mechanism is not traced further here into Wisconsin's general consumer-protection authority under chs. 93 or 100.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachprocesses_biometricsprocesses_voice
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.