{
 "jurisdiction_id": "US-FL",
 "jurisdiction": "United States – Florida",
 "url": "https://dataprotection.gi/jurisdictions/united-states-florida/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-06",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 42,
  "sub_modules": 57,
  "source_register": 20
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "amber",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-florida/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "Binding, in-force framework exists but applies to a very small universe of controllers; sectoral FIPA breach law has much broader reach.",
   "claims": [
    {
     "statement": "The Florida Attorney General (Department of Legal Affairs) holds exclusive statutory enforcement authority over the Florida Digital Bill of Rights and the Florida Information Protection Act, and neither statute provides a private cause of action.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Senate Bill 262, enacted as the Florida Digital Bill of Rights, made its consumer data protection provisions effective 1 July 2024.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Florida Information Protection Act of 2014 (§501.171, Fla. Stat.) independently requires businesses and government entities to take reasonable measures to protect personal information and to report data breaches to affected consumers.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "My Florida Legal",
     "source_url": "https://www.myfloridalegal.com/consumer-protection/how-to-protect-yourself-data-security",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The FDBR defines 'sensitive data' to include racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, data from a known child, and precise geolocation data limited to a 1,750-foot radius.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://legacy.dataguidance.com/opinion/florida-digital-bill-rights-privacy-concerns-and-key",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "FDBR controller obligations apply only to for-profit entities doing business in Florida that meet a $1 billion global annual gross revenue threshold together with at least one of three specified business-model criteria: online-advertising revenue share, smart-speaker/voice-assistant operation, or large-scale app-store operation.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/defining-comprehensive-florida-washington-and-the-scope-of-state-tracking",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "amber",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-florida/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "Consent/lawful-basis architecture exists but is materially narrower than GDPR-analogue regimes and applies to a limited controller population.",
   "claims": [
    {
     "statement": "The FDBR does not enumerate GDPR-style lawful bases; instead it follows an opt-out default model under which processing is permitted unless a consumer exercises a specific statutory opt-out right, with consent required only for narrowly defined activities such as the sale of sensitive data.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://legacy.dataguidance.com/opinion/florida-digital-bill-rights-privacy-concerns-and-key",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "All businesses conducting business in Florida — not only those meeting the FDBR's controller thresholds — must obtain a consumer's opt-in consent before selling that consumer's sensitive personal data.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://legacy.dataguidance.com/opinion/florida-digital-bill-rights-privacy-concerns-and-key",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Sensitive data under the FDBR includes genetic or biometric data processed to uniquely identify an individual and personal data collected from a known child; processing a known child's sensitive data requires COPPA-referenced affirmative authorization even though the FDBR defines 'child' as under 18 rather than COPPA's under-13 threshold.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The FDBR's definition of 'personal data' excludes pseudonymous data — including most third-party cookie identifiers and aggregated or anonymized consumer information — from the statute's coverage entirely, a narrower carve-out than most peer state laws.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "amber",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-florida/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "Rights framework is materially GDPR/CCPA-analogue in substance but narrow in applicability.",
   "claims": [
    {
     "statement": "FDBR-covered controllers must allow consumers to confirm whether their personal data is being processed and to access a copy of that data.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Consumers have statutory rights to correct inaccuracies in and to delete their personal data held by FDBR-covered controllers.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Consumers may opt out of processing for targeted advertising, the sale of personal, sensitive, or biometric data, and certain forms of profiling under the FDBR.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "FDBR-covered controllers must provide consumers a portable copy of their personal data upon request.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Controllers must respond to consumer rights requests within 45 days of receipt, with a possible extension to 60 days when reasonably necessary, must establish at least two methods for consumers to submit such requests, and must provide an appeals process for refusals.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-florida/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "Substantive duties exist and are enforced (see Roku action) but DPO/ROPA analogues are absent and FDBR duties bind only large controllers.",
   "claims": [
    {
     "statement": "FDBR-covered controllers must conduct and document data protection assessments for processing activities presenting a heightened risk of harm, including targeted advertising, sale of personal data, certain profiling, and processing of sensitive data, and must produce such assessments to the Attorney General upon request.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The FDBR requires specific contractual terms between controllers and processors, including a processor's duty to assist the controller's compliance, though it does not create a distinct joint-controller liability regime akin to GDPR Article 26.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://legacy.dataguidance.com/opinion/florida-digital-bill-rights-privacy-concerns-and-key",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Controllers must adopt reasonable administrative, technical and physical measures to protect the confidentiality, integrity and accessibility of personal data and reduce foreseeable risk of harm to consumers; separately, FIPA requires all covered entities to take reasonable measures to protect personal information generally.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://legacy.dataguidance.com/opinion/florida-digital-bill-rights-privacy-concerns-and-key",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Under FIPA (§501.171, Fla. Stat.), covered entities must notify affected individuals of a data breach and, for breaches affecting 500 or more Florida residents, must also notify the Florida Attorney General, with the statute defining the content required in the notice.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "My Florida Legal",
     "source_url": "https://www.myfloridalegal.com/consumer-protection/how-to-protect-yourself-data-security",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "SB 262 expanded FIPA's definition of 'personal information' to include biometric data and precise geolocation data (when combined with a name), broadening the scope of Florida's breach-notification obligations.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Controllers and processors must adopt a data retention schedule that prohibits use or retention of personal data after the initial collection purpose is satisfied, after contract expiration, or two years after the consumer's last interaction, subject to certain exemptions.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "red",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-florida/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "No comprehensive cross-border transfer regime exists at the Florida state level.",
   "claims": []
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "amber",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-florida/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "Some overlays plausible but unverified against final enacted text; others confirmed absent.",
   "claims": [
    {
     "statement": "Florida's prior competing comprehensive-privacy bills (HB 969 / SB 1734, 2021) proposed exemptions for GLBA-covered financial institutions and HIPAA-covered entities/business associates; confirmation that the enacted FDBR (SB 262, 2023) preserves materially identical exemptions has not been independently verified against the final statutory text in this research pass.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/florida-towards-comprehensive-privacy-law-tale-two",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Health data is separately protected in Florida through HIPAA's federal framework and through FDBR's classification of 'mental or physical health diagnosis' data as sensitive data requiring opt-in consent for sale.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Florida does not maintain a dedicated ePrivacy-style cookie/electronic-communications statute; telemarketing and robocall conduct is instead pursued by the Attorney General under Florida consumer-protection statutes together with the federal TCPA and Telemarketing Sales Rule.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "My Florida Legal",
     "source_url": "https://www.myfloridalegal.com/newsrelease/attorney-general-moody-takes-legal-action-against-avid-telecom-over-billions-illegal",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Florida's 2021 predecessor comprehensive-privacy bills exempted personal data processed in an employment context from controller obligations; whether this carve-over exists in identical form in the enacted FDBR has not been independently confirmed.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/florida-towards-comprehensive-privacy-law-tale-two",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "amber",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-florida/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "Meaningful opt-out and dark-pattern provisions exist but scope is narrowed by the pseudonymous-data carve-out and controller threshold.",
   "claims": [
    {
     "statement": "The FDBR excludes pseudonymous data — including most third-party cookie identifiers — from its definition of 'personal data,' materially narrowing any cookie-consent obligations compared to ePrivacy-style regimes.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The FDBR incorporates 'dark patterns' among its defined terms, addressing manipulative user-interface design used to obtain consumer consent.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://legacy.dataguidance.com/opinion/florida-digital-bill-rights-privacy-concerns-and-key",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The FDBR defines 'targeted advertising' broadly enough to include advertising based on data collected across a controller's affiliated websites, extending the opt-out right further than some peer state laws.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://legacy.dataguidance.com/opinion/florida-digital-bill-rights-privacy-concerns-and-key",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Florida Attorney General enforces telemarketing conduct — including robocalls and National Do Not Call Registry violations — through Florida consumer-protection statutes and coordinated multistate actions under the federal Telemarketing Sales Rule and TCPA.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "My Florida Legal",
     "source_url": "https://www.myfloridalegal.com/newsrelease/attorney-general-moody-takes-legal-action-against-avid-telecom-over-billions-illegal",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "amber",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-florida/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "Sensitive-data consent rules and profiling opt-out exist; no dedicated biometric statute or ADM-transparency right.",
   "claims": [
    {
     "statement": "Consumers may opt out of certain profiling as part of the FDBR's opt-out rights regime.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Biometric data is treated as 'sensitive data' under the FDBR, requiring consumer opt-in consent before sale and a specific website disclosure ('NOTICE: This website may sell your biometric personal data') when a qualifying controller sells it.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://legacy.dataguidance.com/opinion/florida-digital-bill-rights-privacy-concerns-and-key",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "A standalone Florida Biometric Information Privacy Act, modeled on Illinois's BIPA and including a private right of action, was proposed in the Florida Legislature circa 2019; it is not confirmed to have been enacted, and Florida's operative biometric protections currently run through the FDBR and FIPA rather than a dedicated biometric statute.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/state-lawmakers-propose-florida-biometric-information-privacy-act/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Genetic data processed for the purpose of uniquely identifying an individual is classified as 'sensitive data' under the FDBR, triggering the same opt-in consent requirement for sale as other sensitive-data categories.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://legacy.dataguidance.com/opinion/florida-digital-bill-rights-privacy-concerns-and-key",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "green",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-florida/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "Binding, in-force, and actively enforced regime with multiple 2025-2026 AG actions.",
   "claims": [
    {
     "statement": "Florida House Bill 3 (2024) requires commercial entities that distribute online material harmful to minors to verify that users are at least 18 years of age; the requirement took effect 1 January 2025 and has been actively enforced by the Attorney General against multiple pornography websites, including litigation invoking penalties of up to $50,000 per violation.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "My Florida Legal",
     "source_url": "https://www.myfloridalegal.com/newsrelease/attorney-general-james-uthmeier-fights-protect-children-online-pornography-brings",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "HB 3 prohibits social media platforms deploying certain addictive design features from contracting with and providing accounts to users known to be 13 years old or younger without parental consent, requires account termination absent such consent, and provides a 90-day dispute period.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/florida-governor-signs-bill-online-protections-minors",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "FDBR treats personal data collected from a known child as 'sensitive data,' requiring COPPA-referenced affirmative authorization before such data may be sold, notwithstanding FDBR's broader definition of 'child' as under 18 rather than COPPA's under-13 threshold.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "In October 2025, the Florida Attorney General's Office of Parental Rights filed an enforcement action against Roku alleging collection, sale, and reidentification of children's sensitive personal data — including viewing habits and voice recordings — without parental consent, in violation of the FDBR.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "My Florida Legal",
     "source_url": "https://www.myfloridalegal.com/newsrelease/attorney-general-james-uthmeiers-office-parental-rights-files-enforcement-action",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "amber",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-florida/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "Enforcement powers and activity exist and are growing, but no private right of action and penalty issuance under the FDBR remains unconfirmed/nil to date.",
   "claims": [
    {
     "statement": "The Florida Attorney General has exclusive enforcement authority over the FDBR, with statutory penalties of up to $50,000 per violation, which can be tripled under certain circumstances, and discretion to provide a notice and 45-day cure period before enforcement.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Florida Attorney General's Annual Enforcement Report covering January 1 – December 31, 2025 recorded 97 consumer complaints alleging denial of the right to delete personal data and 53 alleging denial of the right to opt out of processing, continuing a pattern in which — as of the prior (2024) reporting period — no monetary penalties had yet been issued by the Department for FDBR violations.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Florida Department of Legal Affairs",
     "source_url": "https://www.myfloridalegal.com/sites/default/files/2026-02/digital-bill-of-rights-annual-report.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The FDBR and FIPA both lack a private cause of action, so Florida consumers cannot bring collective or class actions directly under either statute; class exposure for Florida data-breach or privacy harms instead arises under general common-law claims or other statutes such as FDUTPA.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Neither the FDBR nor FIPA provides a private right of action; enforcement runs exclusively through the Florida Attorney General's Department of Legal Affairs.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/the-ranging-impacts-of-floridas-digital-bill-of-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Florida's Legislature passed HB 473, the Cybersecurity Incident Liability Act, which would grant qualifying companies conditional immunity from data-breach lawsuits where they substantially comply with FIPA's notification requirements and maintain a cybersecurity program aligned with recognized industry standards; as of research, the bill awaited action by the Governor.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/florida-bill-introduces-data-breach-immunity-for-entities-meeting-industry-cybersecurity-standards",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Attorney General published its most recent FDBR Annual Enforcement Report in February 2026, covering the January–December 2025 enforcement period and confirming continued rule-implementation activity under §501.72(5), Fla. Stat.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Florida Department of Legal Affairs",
     "source_url": "https://www.myfloridalegal.com/sites/default/files/2026-02/digital-bill-of-rights-annual-report.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  }
 ]
}