---
title: "Florida privacy law: sensitive data"
canonical: "https://dposchool.com/state-privacy-laws/state/florida/sensitive-data"
source: "http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Florida Digital Bill of Rights

# Florida privacy law: sensitive data

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used for identification, data collected from a known child, and precise geolocation. Controllers need consent to process sensitive data, and any for-profit business doing business in Florida needs prior consent to sell it and must post a fixed notice. Florida defines a child as anyone under 18: a known child aged 13 to 17 must give affirmative authorization, and COPPA governs under 13.

## Key points

1. Definition of sensitive data, including data collected from a known child.

   Section: [Fla. Stat. § 501.702(31)](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html)

2. A child is anyone younger than 18.

   Section: [Fla. Stat. § 501.702(6)](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html)

3. Controllers may not process sensitive data without consent; for a known child 13 to 17, affirmative authorization; under 13, per COPPA.

   Section: [Fla. Stat. § 501.71(2)(d)](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html)

4. No sale of sensitive data without prior consent by any for-profit business doing business in Florida that collects personal data.

   Section: [Fla. Stat. § 501.715(1)](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html)

5. Sellers of sensitive data must post: 'NOTICE: This website may sell your sensitive personal data.' A similar notice applies to biometric data.

   Section: [Fla. Stat. §§ 501.711(2), (3), 501.715(2)](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html)

## Sources

- [http://www.leg.state.fl.us/statutes/index.cfm?App\_mode=Display\_Statute&URL=0500-0599/0501/Sections/0501.71.html](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.71.html)
- [http://www.leg.state.fl.us/statutes/index.cfm?App\_mode=Display\_Statute&URL=0500-0599/0501/Sections/0501.715.html](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.715.html)

[Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Florida statute](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html)

Reference material, not legal advice.

## Other topics for Florida

- [Applicability](https://dposchool.com/state-privacy-laws/state/florida/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/florida/consumer-rights)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/florida/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/florida/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/florida/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Florida](https://dposchool.com/state-privacy-laws/state/florida) / Sensitive data

Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/florida/consumer-rights)

Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/florida/controller-duties)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents