Florida Digital Bill of Rights (FDBR): An Overview

Florida became the tenth state in the United States to approve a consumer privacy bill, SB 262, which went into effect on July 1, 2024. Its passage on June 6, 2023 gave organizations slightly over a year to prepare for FDBR compliance.

Florida's data privacy law is unique, as SB 262 was drafted with three main parts:

• Florida Digital Bill of Rights, which covers consumer data privacy and security
• Protection of children in online spaces
• Prohibiting government-directed content moderation of social media platforms

What Is the Florida Digital Bill of Rights (FDBR)?

The Florida Digital Bill of Rights (FDBR) is a state-level data privacy law that protects the digital privacy and personal data of over 23 million residents in Florida. It establishes data privacy requirements for businesses operating in the state, or offering goods and services to Florida residents, that process consumers' personal data.

Unlike other U.S. state-level data privacy laws, it focuses on major tech companies, emerging consumer technologies, and online social media platforms. For this reason, it is considered narrower in scope and less comprehensive than many of the recent U.S. state-level privacy regulations passed.

Florida defines a consumer as someone who is a resident of or domiciled in the state and is acting on an individual or household basis rather than on a commercial or employment basis.

Florida follows an opt-out model, like most other U.S. state-level privacy laws, meaning that consumer consent isn't required before data collection or processing in many cases. There are some exceptions where prior consumer consent is required, particularly when dealing with personal data belonging to a known child. Florida's law differs from others by defining a child as anyone under 18, unlike the more common age limit of 13.

Businesses that fall under the scope of the Florida data privacy law must clearly inform consumers about their data collection and processing activities, outline consumer rights, and explain how to exercise those rights.

Definitions Under the Florida Digital Bill of Rights

The FDBR is more detailed in defining key terms than some other recent U.S. privacy laws.

Personal Data and Personal Information Under the FDBR

Personal data is defined as "any information, including sensitive data, which is linked or reasonably linkable to an identified or identifiable individual. The term includes pseudonymous data when the data is used by a controller or processor in conjunction with additional information that reasonably links the data to an identified or identifiable individual."

The definition excludes deidentified data or publicly available information.

The provisions of the FDBR that deal with the protection of children in online spaces define personal information separately as "information that is linked or reasonably linkable to an identified or identifiable child, including biometric information and unique identifiers to the child."

Extension of the Florida Information Protection Act

Since 2014, the Florida Information Protection Act (FIPA) has defined and covered various forms of data, including electronic information stored by businesses. Its requirements for reasonable data security and breach reporting are fairly standard compared to more recent comprehensive privacy laws.

The FDBR broadens the definition of personal information under FIPA, which already covered Social Security numbers, financial details, and personal contact information, to now include biometric and geolocation data, among other emerging technologies.

Sensitive Data Under the FDBR

Sensitive data under the Florida privacy law includes categories of personal data that could cause harm if misused, including any of:

• Racial or ethnic origin
• Religious beliefs
• Mental or physical health diagnosis
• Sexual orientation
• Citizenship or immigration status
• Genetic or biometric data processed for the purpose of uniquely identifying an individual
• Data from a known child (under 18 years of age)
• Precise geolocation data (to within 1,750 feet / 533.4 meters)

Consent Under the FDBR

The FDBR defines consent as "a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. The term includes a written statement, including a statement written by electronic means, or any other unambiguous affirmative act."

The Florida privacy law explicitly excludes the following from valid consent:

• Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal data processing along with other, unrelated information
• Hovering over, muting, pausing, or closing a given piece of content
• Agreement obtained through the use of dark patterns

Florida's privacy law also requires that consumers be able to revoke their consent at any time.

Controller Under the FDBR

The FDBR provides a more detailed definition of controller than most other regulations, largely because it folds several requirements, including compliance thresholds, directly into the definition itself, which is uncommon.

A controller under the FDBR is a sole proprietorship, partnership, limited liability company, corporation, association, or legal entity that meets the following requirements:

• Is organized or operated for the profit or financial benefit of its shareholders or owners
• Conducts business in Florida
• Collects personal data about consumers, or is the entity on behalf of which such information is collected
• Determines the purposes and means of processing personal data about consumers, alone or jointly with others
• Makes in excess of USD 1 billion in global gross annual revenue

The entity must also satisfy at least one of the following:

• Derives 50 percent or more of its global gross annual revenue from the sale of advertisements online, including providing targeted advertising or the sale of ads online
• Operates a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation (the law specifies that this excludes a motor vehicle, speaker, or device associated with or connected to a vehicle operated by a motor vehicle manufacturer or its subsidiary or affiliate)
• Operates an app store or a digital distribution platform that offers at least 250,000 different software applications for consumers to download and install

Processor Under the FDBR

A controller may share personal data for processing purposes with a third party, known under the law as a processor, or "a person who processes personal data on behalf of a controller."

Sale of Personal Data Under the FDBR

The Florida data privacy law defines sale as "the sharing, disclosing, or transferring of personal data for monetary or other valuable consideration by the controller to a third party."

It excludes disclosure of personal data:

• To a processor who processes the personal data on the controller's behalf
• To a third party for purposes of providing a product or service requested by the consumer
• That the consumer intentionally made available to the general public through a mass media channel, without restricting it to a specific audience
• To a third party as an asset that is part of a merger or acquisition, including transfer of such personal data

Targeted Advertising Under the FDBR

The FDBR defines targeted advertising as "displaying to a consumer an advertisement selected based on personal data obtained from that consumer's activities over time across affiliated or unaffiliated websites and online applications used to predict the consumer's preferences or interests."

The definition excludes ads that are:

• Based on the consumer's activities within a controller's own websites or apps
• Directed to a consumer's search query on the controller's own website or app, in response to the consumer's request for information or feedback

Surveillance Under the FDBR

Surveillance covers the use of assorted technologies, specifically "a device that has a voice recognition feature, a facial recognition feature, a video recording feature, an audio recording feature, or any other electronic, visual, thermal, or olfactory feature that collects data may not use those features for the purpose of surveillance by the controller, processor, or affiliate of a controller or processor when such features are not in active use by the consumer, unless otherwise expressly authorized by the consumer."

The FDBR does not include a specific definition of surveillance, and the absence of a legal definition could complicate matters for tech companies whose products rely on increasingly common "smart" technologies. Without a clear definition, drafting consumer privacy and consent notices could become legally challenging.

Who Has to Comply With the Florida Digital Bill of Rights?

The FDBR applies to businesses that operate in Florida, or offer products and services specifically aimed at Florida residents, and that collect or process consumers' personal data. As outlined in the definition of "controller," the regulation's compliance requirements differ somewhat from many other U.S. state-level privacy laws.

A business must comply with the FDBR if it makes more than USD 1 billion in global gross annual revenue and satisfies at least one of the following:

• Derives 50 percent or more of its global gross annual revenue from the sale of advertisements online, including providing targeted advertising or the sale of ads online
• Operates a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation
• Operates an app store or a digital distribution platform that offers at least 250,000 different software applications for consumers to download and install

Notably, the FDBR sets a revenue threshold at USD 1 billion in global gross annual revenue, clearly targeting larger corporations. By comparison, other states have set the bar much lower. The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) requires compliance at just USD 25 million in gross annual revenue. Meanwhile, many of the newer state privacy laws have no revenue-only threshold at all.

Fewer than 6,000 businesses operating in Florida surpass the USD 1 billion revenue mark. Factoring in the additional criteria narrows that number further.

The law also includes provisions that specifically target major tech companies involved in digital advertising, smart speaker technologies, voice commands, and digital distribution platforms. These are rules unique to Florida that would affect companies like Apple and Alphabet (Google), which operate these technologies and manage major app stores.

Exemptions to FDBR Compliance

The Florida data privacy law exempts certain institutions from complying, including:

• State government agencies
• Financial institutions, and entities and affiliates subject to the Gramm-Leach-Bliley Act (GLBA)
• Insurance companies
• Postsecondary education institutions
• Nonprofit organizations

Data-related exemptions include:

• Health records
• Data used to provide financial services
• Research data for human subjects covered by federal laws or standards
• Data processed or maintained for employment purposes
• Data created for or collected pursuant to several federal laws

These exemptions are largely in line with those of other U.S. data privacy regulations, mainly deferring to existing federal laws, including:

• Health Insurance Portability and Accountability Act (HIPAA)
• Health Information Technology for Economic and Clinical Health Act
• Patient Safety and Quality Improvement Act
• Fair Credit Reporting Act (FCRA)
• Children's Online Privacy Protection Act (COPPA)
• Family Educational Rights and Privacy Act
• Driver's Privacy Protection Act
• Farm Credit Act
• Airline Deregulation Act

Consumers' Rights Under the Florida Digital Bill of Rights

Consumers have several rights under the Florida data privacy law, in line with rights granted in other global and U.S. data privacy regulations.

• Right to access: Consumers can confirm if the controller is processing their personal data and access that data, with certain exceptions
• Right to correction: Consumers can request that inaccurate data the controller holds is corrected, taking into account the nature of the personal data and the purposes of its processing
• Right to delete: Consumers can request the deletion of any personal data the controller has about or from them, with certain exceptions
• Right to portability: Consumers have the right to obtain a copy of their personal data in a readily usable format, with some exceptions
• Right to opt out: Consumers can opt out of:
  • The processing of their personal data for sale, targeted advertising, or certain profiling "in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer"
  • The collection or processing of sensitive data, including precise geolocation data
  • The collection of personal data through the operation of a voice recognition or facial recognition feature

Parents or legal guardians can exercise these rights on behalf of their children.

The FDBR does not grant a private right of action, meaning consumers cannot directly sue violators. An earlier 2021 data privacy bill in the state, which didn't pass, did include this option. California remains the only U.S. state with a data privacy law that gives consumers this right.

Controllers' Obligations Under the Florida Digital Bill of Rights

The Florida privacy law tasks controllers with several responsibilities for protecting consumers' personal data.

Consumer Rights Requests Under the FDBR

Controllers must notify consumers of:

• Their rights regarding their personal data
• How consumers can exercise those rights, including contact information
• The procedure for appealing the controller's decision (for example, rejection of a request)

This information is typically outlined in a privacy policy or privacy notice. Such requests are often called data subject requests (DSR) or data subject access requests (DSAR).

Controllers must establish at least two secure, reliable, and easily accessible methods for consumers to exercise their rights under the FDBR. Consumers can be asked to log in to an existing account for identity verification, but they must not be required to create a new account just to exercise their rights.

If the controller operates a website, a direct option for consumers to exercise their rights must be available there. Controllers that operate exclusively online, and that collected the personal data directly from consumers, can provide an email address for consumers to submit requests.

The controller has 45 days from the date of receipt to respond to an authenticated consumer request. They can decline to act on the request for specific reasons, such as being unable to reasonably verify the consumer's identity, or if the consumer submits an excessive number of requests within a 12-month period. If extenuating circumstances prevent fulfilling the request within the 45-day period, the controller can extend the response period by 15 days, with prior notice to the consumer.

Controllers must let the consumer know within 60 days whether their request has been fulfilled. If a request is denied, consumers can appeal, and the controller must explain how to proceed. The controller has 60 days to respond to the appeal.

Privacy Notice Under the FDBR

Controllers must publish a privacy notice detailing:

• Categories of personal data processed, including sensitive data, if any
• Purposes for processing personal data
• Methods for consumers to exercise their rights and appeal a controller's decision
• Categories of personal data shared with third parties, if any
• Categories of third parties receiving personal data, if any
• How consumers can opt out of the sale of personal data, or its processing for targeted advertising or profiling

This information should be reasonably accessible to consumers, typically presented as a privacy policy on the business's website.

If a controller sells sensitive personal data, it must also include a notice with the exact wording: "NOTICE: This website may sell your sensitive personal data" or "NOTICE: This website may sell your biometric personal data," depending on the type of data sold. The privacy notice must be updated annually.

Purpose Limitation Under the FDBR

Controllers are permitted to process personal data for the purposes communicated to consumers, provided that processing remains "adequate, relevant, and reasonably necessary" while proportional to those purposes.

Data Security Under the FDBR

Controllers must establish, implement, and maintain reasonable administrative, technical, and physical security measures appropriate to the nature and volume of personal information being processed.

Data Protection Assessments (DPA) Under the FDBR

The Florida data privacy law requires controllers to conduct and document data protection assessments when they process personal data:

• For targeted advertising
• For sale
• Categorized as sensitive personal data
• For profiling that poses a foreseeable risk of unfair or deceptive treatment or unlawful impact on consumers; financial, physical, or reputational injury; offensive intrusion into consumers' private affairs; or other substantial injury
• That presents a heightened risk of harm to consumers

The Attorney General can request a DPA from a controller, usually as part of an investigation into potential violations.

Consent Requirements Under the FDBR

Like many other U.S. states with consumer privacy laws, Florida operates on an opt-out model, meaning consent isn't required before collecting and processing personal data in many instances. Obtaining consent is mandatory, however, before handling sensitive personal data.

Consumers must receive clear notice about data processing and be able to opt out of the sale of personal data, its use for targeted advertising or profiling, or data collection involving facial or voice recognition technologies.

Regarding minors, the FDBR follows the federal COPPA in requiring consent from a parent or legal guardian before processing any personal data of a known child. Under Florida's law, all personal data belonging to children under 18 is considered sensitive by default, extending protection well beyond the more common under-13 threshold.

Nondiscrimination Under the FDBR

Controllers must not unlawfully discriminate against consumers or process personal data in violation of state or federal anti-discrimination laws, and cannot discriminate against consumers for exercising their rights. For example, consumers can't be denied access to a website simply because they've opted out of personal data collection.

Some website features may require certain trackers to function correctly; if a consumer opts out of those trackers, the site may not work optimally, which is not considered discriminatory on its own.

Controllers can offer voluntary incentives, such as discounts for consumers who participate in loyalty programs or newsletter subscriptions where personal data is collected. These incentives should be reasonable and proportionate to the data collected, since regulators disapprove of disproportionate rewards that function as bribes.

Data Processing Agreements Under the FDBR

The Florida data privacy law requires controllers to enter into contracts with processors outlining data processing procedures. Although the regulation doesn't explicitly call this a "data processing agreement," it's similar in function to agreements required under other privacy laws, such as the General Data Protection Regulation (GDPR) and the Virginia Consumer Data Protection Act (VCDPA).

These contracts matter because the controller remains ultimately liable for processing activities or privacy breaches caused by a processor's actions. The contract should cover:

• Instructions for processing data
• Nature and purpose of data processing
• Type of data being processed
• Duration of processing
• Rights and obligations of both parties
• Duty of confidentiality

Processors are also required to assist controllers in meeting their duties relating to security, transparency, retention, deletion, assessment, and reporting.

Enforcement of the Florida Digital Bill of Rights

The Attorney General of Florida and the Department of Legal Affairs have exclusive authority to enforce the FDBR. While the law doesn't grant consumers a private right of action, they can report suspected violations or complaints about denied requests to the Attorney General's office. The Attorney General must give written notice to the accused parties detailing the alleged violations.

Similar to the Colorado Privacy Act (CPA), violations of the FDBR are treated as deceptive trade practices.

After written notice, a 45-day cure period may be granted for the organization to address the issues and prevent recurrence without facing penalties. If the issues are resolved to the Attorney General's satisfaction, financial penalties will likely be avoided, though the organization might receive a guidance letter indicating that future violations won't qualify for another cure period.

The cure period doesn't apply if a violation involves a known child. The Department of Legal Affairs will also weigh the number and seriousness of violations before deciding whether to allow a cure period. Unlike the cure period under some other state laws, which ends (or sunsets) after a year or two, the FDBR's cure period is permanent.

Fines and Penalties Under the FDBR

If a controller or its processors remain in violation after the cure period, the Attorney General may launch an investigation and impose fines of up to USD 50,000 per violation. Penalties can be tripled if:

• The violation involves a known child
• A controller doesn't delete personal data after receiving a verified consumer request, or a processor ignores a controller's deletion instructions
• A controller continues to sell or share a consumer's personal data after the consumer exercises their opt-out rights

Prohibition of Government Censorship Under Florida Privacy Law

The FDBR includes a section addressing social media, stipulating that government entities cannot request the removal of content or user accounts from social media platforms unless the content or account is used to commit a crime or violates Florida public records law.

The definition of "social media platform" is broad, covering "a form of electronic communication through which users create online communities or groups to share information, ideas, personal messages, and other content." That breadth could invite legal challenges of its own.

Protection of Children Under Florida Privacy Law

The FDBR provides more detailed requirements for protecting children online than most other U.S. data privacy laws, and triples financial penalties for violations involving known children. Its definition of "substantial harm or privacy risk to children" includes several examples of potential harm and specifies ways children's data cannot be collected or used, with particular prohibitions for any "online platform that provides an online service, product, game, or feature likely to be predominantly accessed by children."

Florida Digital Bill of Rights and Consent Management

Florida's consumer privacy law requires prior consent only for processing sensitive personal data and children's data. Penalties for knowingly processing children's data without prior consent are triple the standard penalty. Penalties for not honoring valid opt-out requests can also be tripled.

Consumers must have the option to opt out of the collection and processing of their personal data for purposes like sale, targeted advertising, or profiling, typically via the privacy notice or privacy policy. This opt-out mechanism can be presented as a cookie banner, usually a link or button. A consent management platform (CMP) can help automate detection of cookies and other tracking technologies on websites and apps, and simplify sharing the required information with consumers about data categories, service providers, and third parties.

The United States does not have a unified federal data privacy law, though legislation has been proposed several times. For now, businesses operating nationwide and internationally may need to work with multiple, differing consumer privacy laws at once. A CMP can help by displaying customized banners to visitors based on the legal requirements of their location, supporting FDBR requirements as well as those of other current and upcoming U.S. regulations, and, for companies operating internationally, frameworks like the EU's GDPR.

The FDBR and the Florida Security of Communications Act (FSCA): Two Different Laws

There is another Florida statute worth distinguishing clearly from the FDBR: the Florida Security of Communications Act (FSCA), codified in Chapter 934 of the Florida Statutes. Where the FDBR is a consumer data privacy law granting rights like access, correction, and deletion, the FSCA is Florida's wiretapping statute, similar to the California Invasion of Privacy Act (CIPA). The FSCA was enacted in 1969 and originally aimed at unauthorized phone-line interception and covert recordings.

The FSCA requires all-party consent before intercepting a wire, oral, or electronic communication. Since 2025, plaintiffs have increasingly applied it to website technologies — session replay tools, live chat, and tracking pixels — arguing that a website visitor is a "party" to a communication who hasn't consented to it being intercepted by a third-party tool.

This mirrors the litigation pattern seen for years under CIPA, and legal commentators frequently describe the two statutes' operative language as functionally similar, though the FSCA's civil damages are lower: USD 1,000 per violation or USD 100 per day, whichever is greater, plus actual damages and attorney's fees.

Unlike the FDBR, the FSCA carries no revenue threshold and no private-right-of-action restriction. Any business with a Florida-facing website, regardless of size, can be a target, and consumers can sue directly rather than routing complaints through the Attorney General. A CMP like Cookiebot™ supports notice and consent practices around tools like session replay and chat, but it doesn't substitute for a legal review of a site's specific tracking stack given how unsettled this litigation area currently is.

Complying with the Florida Digital Bill of Rights

Because of the high revenue threshold, many organizations will fall outside the FDBR's scope entirely, though some of its requirements reflect good practice for any company handling personal data, particularly around children's protection, government censorship, and compliance thresholds.

A privacy by design approach benefits organizations generally, regardless of which specific law applies. Supporting FDBR requirements involves understanding its specifics and providing consumers with the required information, an accessible privacy notice, and working opt-out options. Cookiebot™ CMP helps manage cookie and tracking notifications, giving visitors clear information about what's in use on a site.

Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy, regulatory requirements, and your specific business operations.