Florida Digital Bill of Rights
Florida privacy law: controller duties
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Controllers must publish a privacy notice updated at least annually, collect only data that is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and not discriminate against consumers who exercise rights. Data protection assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing generated on or after 2023-07-01. The statute does not require controllers to honor universal opt-out signals. Search engine controllers must describe their main ranking parameters, including any treatment of political ideology.
Key points
Privacy notice, updated at least annually: categories of data, purposes, how to exercise and appeal rights, third-party sharing, and request methods.
Section: Fla. Stat. § 501.711(1)
Clear and conspicuous disclosure of sale or targeted advertising and how to opt out.
Section: Fla. Stat. § 501.711(4)
Data minimisation: adequate, relevant and reasonably necessary for the disclosed purposes; secondary use needs consent.
Section: Fla. Stat. § 501.71(1)(a), (2)(a)
Reasonable administrative, technical and physical security.
Section: Fla. Stat. § 501.71(1)(b)
Data protection assessments for targeted advertising, sale, risky profiling, sensitive data and heightened-risk processing, for activities generated on or after 2023-07-01.
Section: Fla. Stat. § 501.713(1), (6)
Search engines must publish a plain-language description of the main ranking parameters.
Section: Fla. Stat. § 501.71(4)
No requirement to recognise universal opt-out preference signals appears in the statute.
Section: Fla. Stat. §§ 501.705, 501.709
Sources
- http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.71.html
- http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.711.html
- http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.713.html
Compare controller duties across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 35: Data protection impact assessment (assessments)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Florida statute
Reference material, not legal advice.