DPO SchoolDPO School

Florida Digital Bill of Rights

Florida privacy law: sensitive data

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used for identification, data collected from a known child, and precise geolocation. Controllers need consent to process sensitive data, and any for-profit business doing business in Florida needs prior consent to sell it and must post a fixed notice. Florida defines a child as anyone under 18: a known child aged 13 to 17 must give affirmative authorization, and COPPA governs under 13.

Key points

  1. Definition of sensitive data, including data collected from a known child.

    Section: Fla. Stat. § 501.702(31)

  2. A child is anyone younger than 18.

    Section: Fla. Stat. § 501.702(6)

  3. Controllers may not process sensitive data without consent; for a known child 13 to 17, affirmative authorization; under 13, per COPPA.

    Section: Fla. Stat. § 501.71(2)(d)

  4. No sale of sensitive data without prior consent by any for-profit business doing business in Florida that collects personal data.

    Section: Fla. Stat. § 501.715(1)

  5. Sellers of sensitive data must post: 'NOTICE: This website may sell your sensitive personal data.' A similar notice applies to biometric data.

    Section: Fla. Stat. §§ 501.711(2), (3), 501.715(2)

Sources

Compare sensitive data across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Florida statute

Reference material, not legal advice.