--- title: "Florida privacy law: controller duties" canonical: "https://dposchool.com/state-privacy-laws/state/florida/controller-duties" source: "http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Florida Digital Bill of Rights # Florida privacy law: controller duties Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Controllers must publish a privacy notice updated at least annually, collect only data that is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and not discriminate against consumers who exercise rights. Data protection assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing generated on or after 2023-07-01. The statute does not require controllers to honor universal opt-out signals. Search engine controllers must describe their main ranking parameters, including any treatment of political ideology. ## Key points 1. Privacy notice, updated at least annually: categories of data, purposes, how to exercise and appeal rights, third-party sharing, and request methods. Section: [Fla. Stat. § 501.711(1)](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html) 2. Clear and conspicuous disclosure of sale or targeted advertising and how to opt out. Section: [Fla. Stat. § 501.711(4)](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html) 3. Data minimisation: adequate, relevant and reasonably necessary for the disclosed purposes; secondary use needs consent. Section: [Fla. Stat. § 501.71(1)(a), (2)(a)](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html) 4. Reasonable administrative, technical and physical security. Section: [Fla. Stat. § 501.71(1)(b)](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html) 5. Data protection assessments for targeted advertising, sale, risky profiling, sensitive data and heightened-risk processing, for activities generated on or after 2023-07-01. Section: [Fla. Stat. § 501.713(1), (6)](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html) 6. Search engines must publish a plain-language description of the main ranking parameters. Section: [Fla. Stat. § 501.71(4)](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html) 7. No requirement to recognise universal opt-out preference signals appears in the statute. Section: [Fla. Stat. §§ 501.705, 501.709](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html) ## Sources - [http://www.leg.state.fl.us/statutes/index.cfm?App\_mode=Display\_Statute&URL=0500-0599/0501/Sections/0501.71.html](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.71.html) - [http://www.leg.state.fl.us/statutes/index.cfm?App\_mode=Display\_Statute&URL=0500-0599/0501/Sections/0501.711.html](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.711.html) - [http://www.leg.state.fl.us/statutes/index.cfm?App\_mode=Display\_Statute&URL=0500-0599/0501/Sections/0501.713.html](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.713.html) [Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Florida statute](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html) Reference material, not legal advice. ## Other topics for Florida - [Applicability](https://dposchool.com/state-privacy-laws/state/florida/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/florida/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/florida/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/state/florida/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/florida/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Florida](https://dposchool.com/state-privacy-laws/state/florida) / Controller duties Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/florida/sensitive-data) Next: [Processors](https://dposchool.com/state-privacy-laws/state/florida/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents