DPO SchoolDPO School

Florida Digital Bill of Rights

Florida privacy law: applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Florida's law is much narrower than other state privacy laws. Most duties apply only to a 'controller': a for-profit business doing business in Florida with more than $1 billion in global gross annual revenue that also earns at least half its revenue from online advertising, runs a consumer smart speaker and voice assistant service, or runs an app store with at least 250,000 apps, plus entities it controls or that control it. A separate rule reaches far more businesses: any for-profit business that does business in Florida and collects personal data may not sell sensitive data without consent, whatever its size. Nonprofits, higher education institutions, state agencies, GLBA financial institutions and HIPAA covered entities are excluded at entity level, and employee data is exempt.

Key points

  1. Controller test: for-profit, does business in Florida, collects and determines processing of consumers' personal data, and over $1 billion in global gross annual revenue.

    Section: Fla. Stat. § 501.702(9)(a)1.-5.

  2. Plus one of: 50 percent or more of global revenue from online ads; operating a consumer smart speaker and voice command service with a cloud-connected assistant; or operating an app store with at least 250,000 apps.

    Section: Fla. Stat. § 501.702(9)(a)6.

  3. Entities that control, or are controlled by, a controller are also controllers.

    Section: Fla. Stat. § 501.702(9)(b)

  4. The ban on selling sensitive data without consent applies to any for-profit business meeting only the first three controller elements (no revenue threshold).

    Section: Fla. Stat. § 501.715(1)

  5. Entity-level exclusions: state agencies, financial institutions or data subject to GLBA Title V, HIPAA covered entities and business associates, nonprofits, and postsecondary institutions.

    Section: Fla. Stat. § 501.703(2)

  6. Consumers are Florida residents acting in an individual or household context; commercial and employment contexts are excluded, and employee, emergency contact and benefits data are exempt.

    Section: Fla. Stat. §§ 501.702(8), 501.704(16)-(18)

  7. Data-level exemptions include HIPAA protected health information, FCRA-regulated data, FERPA data and Driver's Privacy Protection Act data.

    Section: Fla. Stat. § 501.704

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Florida statute

Reference material, not legal advice.