Narrower state privacy law
Florida privacy law
Florida Digital Bill of Rights
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Fla. Stat. §§ 501.701 to 501.722 (ch. 501, part V)
- Official text
- http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html
- Enacted
- June 6, 2023. Ch. 2023-201, Laws of Fla. (CS/CS/SB 262)
- In force
- July 1, 2024
- Effective dates
- July 1, 2023: data protection assessments cover processing activities generated on or after this date (Fla. Stat. § 501.713(6))
- July 1, 2024: main provisions (s. 27, ch. 2023-201)
- July 18, 2024: Department of Legal Affairs rules 2-3.001 to 2-3.004, Fla. Admin. Code (authorized persons, data security, enforcement, authenticated requests)
- Enforcer
- Department of Legal Affairs (Attorney General), exclusive
- Private right of action
- No. No private cause of action (§ 501.72(8)); violations are actionable as unfair or deceptive trade practices solely by the Department of Legal Affairs (§ 501.72(1)).
- Cure period
- 45 days. Discretionary: after written notice the Department may grant 45 days to cure; not available for violations involving a known child. (§ 501.72(2))
- Rulemaking
- Yes, Department of Legal Affairs (Office of the Attorney General). Rules 2-3.001 to 2-3.004, Fla. Admin. Code, effective 2024-07-18, adopted under § 501.72(5). Rules
Amendments
No amendments recorded.
Topics
- ApplicabilityFlorida's law is much narrower than other state privacy laws. Most duties apply only to a 'controller': a for-profit business doing business in Florida with more than $1 billion in global gross annual revenue that also earns at least half its revenue from online advertising, runs a consumer smart speaker and voice assistant service, or runs an app store with at least 250,000 apps, plus entities it controls or that control it. A separate rule reaches far more businesses: any for-profit business that does business in Florida and collects personal data may not sell sensitive data without consent, whatever its size. Nonprofits, higher education institutions, state agencies, GLBA financial institutions and HIPAA covered entities are excluded at entity level, and employee data is exempt.
- Consumer rightsConsumers may confirm and access, correct, delete and obtain a portable copy of their personal data, and opt out of targeted advertising, sale and profiling for significant decisions. Florida adds opt-outs from the collection of sensitive data and of data gathered through voice or facial recognition features. Controllers must respond within 45 days, extendable once by only 15 days, and must offer an appeal answered within 60 days.
- Sensitive dataSensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used for identification, data collected from a known child, and precise geolocation. Controllers need consent to process sensitive data, and any for-profit business doing business in Florida needs prior consent to sell it and must post a fixed notice. Florida defines a child as anyone under 18: a known child aged 13 to 17 must give affirmative authorization, and COPPA governs under 13.
- Controller dutiesControllers must publish a privacy notice updated at least annually, collect only data that is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and not discriminate against consumers who exercise rights. Data protection assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing generated on or after 2023-07-01. The statute does not require controllers to honor universal opt-out signals. Search engine controllers must describe their main ranking parameters, including any treatment of political ideology.
- ProcessorsProcessors must follow the controller's instructions and help it meet its duties, including requests, security and breach notice, and assessments. A contract must set out processing instructions, nature and purpose, data types, duration, and both parties' rights and duties, and must bind the processor to confidentiality, deletion or return, information sharing, assessments and flow-down to subcontractors.
- EnforcementOnly the Department of Legal Affairs (the Attorney General) enforces the law, treating violations as unfair or deceptive trade practices. Civil penalties reach $50,000 per violation and may be tripled for violations involving a known child, failures to delete or correct, and continued selling or sharing after an opt-out. The Department may grant a 45-day cure period at its discretion, never for violations involving known children. There is no private right of action.
Sources
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Florida statute
Reference material, not legal advice.