Regulations › US states › Florida
FDBR
Florida Digital Bill of Rights
WhenIn effect since 1 July 2024
Who enforces itFlorida Attorney General
Who it applies toMainly very large businesses: the core obligations apply to companies with more than $1 billion in global revenue that meet additional criteria, though some provisions reach more businesses.
ThresholdsFor-profit businesses with over $1 billion global revenue that also earn 50%+ from online ads,…
Universal opt-outNo requirement to honor universal opt-out or global privacy signals
Cure periodDiscretionary 45-day cure at the Department of Legal Affairs' option
Request deadline45 days, extendable once by 15 days with notice
Maximum penaltyUp to $50,000 per violation, tripled for child-related, deletion or correction failures, and s…
Private actionNo private cause of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
0
For-profit businesses with over $1 billion global revenue that also earn 50%+ from online ads, run a smart speaker service, or run a 250,000-app store.Fla. Stat. § 501.702(9) · source ↗
Exemptions
0
Entity-level exemptions for GLBA financial institutions, HIPAA covered entities and business associates, nonprofits, postsecondary schools and state agencies, plus data-level carve-outs.Fla. Stat. §§ 501.703(2), 501.704 · source ↗
Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Sensitive data and minors
Sensitive data
1
Opt-in consent to process or sell sensitive data (race, religion, health, sexual orientation, immigration, genetic, biometric, known child, precise geolocation).Fla. Stat. §§ 501.702(31), 501.71(2)(d), 501.715 · source ↗
Consumers also have a right to opt out of sensitive data processing, § 501.705(2)(f). Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Children and teens
3
Child means under 18; under-13 data follows COPPA, and ages 13 to 17 must give affirmative authorization to process or sell sensitive data.Fla. Stat. §§ 501.702(6), 501.71(2)(d), 501.715 · source ↗
Treble penalties for violations involving known children (§ 501.72(1)(a)). Separate online-platform duties for minors in Fla. Stat. § 501.1735 were not read in this pass. Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Data minimization
1
Collection limited to what is adequate, relevant and reasonably necessary for disclosed purposes.Fla. Stat. § 501.71(1)(a) · source ↗
Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Consumers' rights
Rights
3
Access, correct, delete, portability, opt out of sale, targeted ads, profiling, sensitive data processing, and voice or facial recognition collection (9 rights).Fla. Stat. § 501.705(2)(a)-(g) · source ↗
Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Request deadline
2
45 days, extendable once by 15 days with notice; compliance confirmation within 60 days.Fla. Stat. § 501.706(2), (4) · source ↗
Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Appeals
1
Internal appeal; controller must answer in writing within 60 days. No AG contact route is required in the appeal section.Fla. Stat. § 501.707 · source ↗
Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Universal opt-out
0
No requirement to honor universal opt-out or global privacy signals.Fla. Stat. Part V, ch. 501 (no provision) · source ↗
Absence confirmed for §§ 501.71 and 501.705 only. Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Business duties
Assessments
2
Documented assessments for targeted ads, sale, risky profiling, sensitive data and other heightened-risk processing.Fla. Stat. § 501.713 · source ↗
Applies to processing generated on or after July 1, 2023. Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Processor contracts
2
Contract must set instructions, data, duration, confidentiality, deletion, compliance information, assessments, and written subcontractor flow-down.Fla. Stat. § 501.712(2)-(3) · source ↗
No controller notice or objection right for subcontractors. Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Privacy notice
3
Annual notice update plus mandatory 'NOTICE: This website may sell your sensitive/biometric personal data' statements and sale or targeted ads disclosure.Fla. Stat. § 501.711 · source ↗
Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Loyalty programs
3
Bona fide loyalty programs allowed; financial incentives need prior consent describing material terms and must not be coercive or usurious.Fla. Stat. § 501.71(2)(c), (3) · source ↗
Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
De-identified data
3
Deidentified data must stay deidentified with contract and process controls; pseudonymous data exempt with separation; disclosers must oversee contracts.Fla. Stat. § 501.714 · source ↗
No public commitment requirement found. Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Enforcement
Who enforces
2
Department of Legal Affairs (Attorney General) enforces exclusively and must adopt rules; annual public enforcement report.Fla. Stat. § 501.72(1), (4), (5) · source ↗
Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Cure period
1
Discretionary 45-day cure at the Department of Legal Affairs' option; none for violations involving known children.Fla. Stat. § 501.72(2) · source ↗
Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Maximum penalty
3
Up to $50,000 per violation, tripled for child-related, deletion or correction failures, and selling after opt-out.Fla. Stat. § 501.72(1) · source ↗
Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Private action
0
No private cause of action.Fla. Stat. § 501.72(8) · source ↗
Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Rulemaking
2
Department must adopt rules on authenticated requests, enforcement, data security and authorized agents.Fla. Stat. § 501.72(5) · source ↗
Status of adopted rules not confirmed in this pass; level 2 assigned. Unofficial reproduction of the Florida Statutes text (florida.public.law); official text at flsenate.gov.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws