Privacy Law Library

Florida Digital Bill of Rights

FDBR

Comprehensive privacy · Children · Biometric · Location

Florida's comprehensive privacy law, enacted in SB 262 (2023). Unlike most state privacy laws, its core consumer-rights duties reach only very large companies (over $1 billion in revenue plus an ad-revenue, smart-speaker, or app-store test), but its rule against selling sensitive data without consent applies to for-profit businesses of any size. It also bars devices from surveilling users through voice, facial, video, or audio features when not in active use, and requires search engines to disclose ranking parameters, including political prioritization. The Attorney General's first enforcement action, against Roku (filed October 2025), was resolved in June 2026 with Roku committing to child-protection changes estimated at $25 million and no civil fine.

Where
Florida
Citation
Fla. Stat. ch. 501, part V (ss. 501.701-501.722)
Status
In force
In force since
2024-07-01
Last amended
2026-04-23
Enforced by
Florida Department of Legal Affairs (Attorney General), exclusively (501.72(1))
People can sue
No
Penalties
Violations are unfair and deceptive trade practices enforceable only by the Department of Legal Affairs, with civil penalties up to $50,000 per violation, tripled for violations involving a known child, failure to delete or correct after an authenticated request, or continued selling or sharing after an opt-out. The department may grant a discretionary 45-day cure period (not for known-child violations) (501.72(1)-(2)).
Applies to
  • Most duties (consumer rights, notices, assessments) apply only to a 'controller': a for-profit business that conducts business in Florida, collects consumers' personal data, determines purposes and means of processing, has over $1 billion in global gross annual revenue, and either earns 50% or more of revenue from online ad sales, operates a consumer smart speaker and voice-command service, or operates an app store with at least 250,000 apps; plus entities that control or are controlled by such a controller (501.702(9))
  • The ban on selling sensitive data without consent (501.715) reaches any for-profit business that conducts business in Florida and collects consumers' personal data, regardless of revenue (501.702(9)(a)1.-3.)
  • Processors acting on behalf of controllers (501.712)
  • Excludes state agencies and political subdivisions, GLBA financial institutions and data, HIPAA covered entities and business associates, nonprofits, and postsecondary institutions (501.703(2))

What a privacy notice must say

  • Post a clear privacy notice, updated at least annually, listing categories of data processed, purposes, how to exercise and appeal rights, and categories of data shared and third-party recipients; disclose sale and targeted advertising and how to opt out.Fla. Stat. 501.711(1), (4)
  • A business that sells sensitive data must display 'NOTICE: This website may sell your sensitive personal data.' A controller that sells biometric data must display a parallel biometric notice.Fla. Stat. 501.711(2)-(3); 501.715(2) · Only if: Only if the business sells sensitive or biometric personal data
  • A controller that operates a search engine must publish a plain-language description of the main ranking parameters, including any prioritization or deprioritization based on political partisanship or ideology.Fla. Stat. 501.71(4) · Only if: Only for controllers operating a search engine

Rights it gives people

  • Consumers may confirm processing and access, correct, delete, and obtain a portable copy of their personal data; opt out of targeted advertising, sale, and significant-effect profiling; opt out of collection or processing of sensitive data (including precise geolocation); and opt out of collection through voice or facial recognition features.Fla. Stat. 501.705(2)

Practices it requires

  • Obtain consent before processing sensitive data; for a known child aged 13-17 obtain the child's affirmative authorization, and follow COPPA for a known child under 13.Fla. Stat. 501.71(2)(d)
  • Any for-profit business that does business in Florida and collects consumers' personal data may not sell sensitive data without prior consent (or, for a known child, the authorization required by the statute), whether or not it meets the $1 billion controller threshold.Fla. Stat. 501.715(1)
  • Authenticate consumer and authorized-agent requests using a commercially reasonable method, weighing the right requested, data sensitivity, possible harm, and cost; do not charge a fee to authenticate.Fla. Admin. Code R. 2-3.004; see also R. 2-3.001 (authorized persons), 2-3.002 (data security), 2-3.003 (enforcement) · From 2024-07-18
  • Devices with voice, facial, video, audio, or other data-collecting features may not use them for surveillance by the controller, processor, or affiliate when not in active use by the consumer, unless the consumer expressly authorizes it.Fla. Stat. 501.705(3)
  • Respond to consumer requests within 45 days (one 15-day extension with notice), confirm compliance within 60 days, and respond free of charge at least twice a year.Fla. Stat. 501.706(2), (4)-(5)
  • Limit collection to data adequate, relevant, and reasonably necessary for disclosed purposes; do not process for incompatible purposes without consent; do not discriminate against consumers for exercising rights.Fla. Stat. 501.71(1)(a), (2)(a), (2)(c)
  • Processors must follow controller instructions and help the controller meet rights-request, security, and breach-notice duties.Fla. Stat. 501.712(1)

Security duties

  • Maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the data.Fla. Stat. 501.71(1)(b)

Other duties

  • Conduct and document data protection assessments for targeted advertising, sale, risky profiling, sensitive data, and other heightened-risk processing.Fla. Stat. 501.713(1)-(2)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: last_amended reflects ch. 2026-52, a conforming public-records change to s. 501.722; the substantive sections (501.701-501.721) have not been amended since ch. 2023-201 per the 2026 statute history notes. | The substantive text of Fla. Admin. Code R. 2-3.001-2-3.004 was not read in full; the rule 2-3.004 summary comes from the rule listing and search snippets of the rule text.

Research reference, not legal advice.