United States – Florida

Regulator And AuthorityAmber

AG holds exclusive enforcement authority over FDBR and FIPA; no private cause of action under either.

Claims (1):

• The Florida Attorney General (Department of Legal Affairs) holds exclusive statutory enforcement authority over the Florida Digital Bill of Rights and the Florida Information Protection Act, and neither statute provides a private cause of action.

Act And InstrumentsAmber

Two operative instruments: FDBR (SB 262) and FIPA (§501.171).

Claims (2):

• Senate Bill 262, enacted as the Florida Digital Bill of Rights, made its consumer data protection provisions effective 1 July 2024.
• The Florida Information Protection Act of 2014 (§501.171, Fla. Stat.) independently requires businesses and government entities to take reasonable measures to protect personal information and to report data breaches to affected consumers.

Material ScopeAmber

FDBR sensitive-data definition drives most substantive obligations.

Claims (1):

• The FDBR defines 'sensitive data' to include racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, data from a known child, and precise geolocation data limited to a 1,750-foot radius.

Territorial ScopeAmber

Controller definition keyed to $1B global revenue plus one of three business-model criteria.

Claims (1):

• FDBR controller obligations apply only to for-profit entities doing business in Florida that meet a $1 billion global annual gross revenue threshold together with at least one of three specified business-model criteria: online-advertising revenue share, smart-speaker/voice-assistant operation, or large-scale app-store operation.

Regulator Registration And FilingRed

No controller registration or filing obligation identified under FDBR or FIPA.

Absence provenance: not recorded. Searched: Florida Digital Bill of Rights controller registration requirement, FIPA Florida Attorney General filing obligation.

Lawful BasesAmber

Opt-out default model rather than enumerated lawful bases.

Claims (1):

• The FDBR does not enumerate GDPR-style lawful bases; instead it follows an opt-out default model under which processing is permitted unless a consumer exercises a specific statutory opt-out right, with consent required only for narrowly defined activities such as the sale of sensitive data.

Consent ThresholdsAmber

Opt-in consent required universally (even for non-controllers) for sale of sensitive data.

Claims (1):

• All businesses conducting business in Florida — not only those meeting the FDBR's controller thresholds — must obtain a consumer's opt-in consent before selling that consumer's sensitive personal data.

Special CategoriesAmber

Sensitive-data category drives heightened consent duties, including a COPPA-referenced children's-data rule.

Claims (1):

• Sensitive data under the FDBR includes genetic or biometric data processed to uniquely identify an individual and personal data collected from a known child; processing a known child's sensitive data requires COPPA-referenced affirmative authorization even though the FDBR defines 'child' as under 18 rather than COPPA's under-13 threshold.

Pseudonymisation And AnonymisationAmber

Pseudonymous/aggregated/anonymized data excluded entirely from scope.

Claims (1):

• The FDBR's definition of 'personal data' excludes pseudonymous data — including most third-party cookie identifiers and aggregated or anonymized consumer information — from the statute's coverage entirely, a narrower carve-out than most peer state laws.

Access RightAmber

Right to confirm processing and access a copy of data.

Claims (1):

• FDBR-covered controllers must allow consumers to confirm whether their personal data is being processed and to access a copy of that data.

Rectification And ErasureAmber

Right to correct and delete personal data.

Claims (1):

• Consumers have statutory rights to correct inaccuracies in and to delete their personal data held by FDBR-covered controllers.

Restriction And ObjectionAmber

Opt-out rights for targeted advertising, sale, profiling, and biometric/sensitive-data collection.

Claims (1):

• Consumers may opt out of processing for targeted advertising, the sale of personal, sensitive, or biometric data, and certain forms of profiling under the FDBR.

Data PortabilityAmber

Right to obtain a portable copy of personal data.

Claims (1):

• FDBR-covered controllers must provide consumers a portable copy of their personal data upon request.

Deadlines And Response WindowsAmber

45-day window, extendable to 60 days; two request methods; appeals process required.

Claims (1):

• Controllers must respond to consumer rights requests within 45 days of receipt, with a possible extension to 60 days when reasonably necessary, must establish at least two methods for consumers to submit such requests, and must provide an appeals process for refusals.

Accountability And DpiaAmber

Mandatory data protection assessments for higher-risk processing, producible to AG on request.

Claims (1):

• FDBR-covered controllers must conduct and document data protection assessments for processing activities presenting a heightened risk of harm, including targeted advertising, sale of personal data, certain profiling, and processing of sensitive data, and must produce such assessments to the Attorney General upon request.

Dpo RequirementsRed

No DPO-appointment mandate identified under FDBR or FIPA.

Absence provenance: not recorded. Searched: Florida Digital Bill of Rights data protection officer requirement.

Ropa RequirementsRed

No standalone records-of-processing-activities obligation identified distinct from the DPA regime.

Absence provenance: not recorded. Searched: Florida Digital Bill of Rights records of processing activities requirement.

Joint Controller ArrangementsAmber

Processor contractual and assistance duties exist; no distinct joint-controller liability regime.

Claims (1):

• The FDBR requires specific contractual terms between controllers and processors, including a processor's duty to assist the controller's compliance, though it does not create a distinct joint-controller liability regime akin to GDPR Article 26.

Security MeasuresAmber

Reasonable administrative, technical and physical security measures required under both FDBR and FIPA.

Claims (1):

• Controllers must adopt reasonable administrative, technical and physical measures to protect the confidentiality, integrity and accessibility of personal data and reduce foreseeable risk of harm to consumers; separately, FIPA requires all covered entities to take reasonable measures to protect personal information generally.

Breach NotificationAmber

FIPA breach notification to consumers and, for 500+ affected individuals, to the AG; scope expanded by SB 262 to cover biometric/geolocation data.

Claims (2):

• Under FIPA (§501.171, Fla. Stat.), covered entities must notify affected individuals of a data breach and, for breaches affecting 500 or more Florida residents, must also notify the Florida Attorney General, with the statute defining the content required in the notice.
• SB 262 expanded FIPA's definition of 'personal information' to include biometric data and precise geolocation data (when combined with a name), broadening the scope of Florida's breach-notification obligations.

Retention And DisposalAmber

Mandatory retention schedules tied to purpose completion, contract expiry, or two years of inactivity.

Claims (1):

• Controllers and processors must adopt a data retention schedule that prohibits use or retention of personal data after the initial collection purpose is satisfied, after contract expiration, or two years after the consumer's last interaction, subject to certain exemptions.

Transfer MechanismsRed

No FDBR/FIPA transfer-mechanism provision identified.

Absence provenance: not recorded. Searched: Florida Digital Bill of Rights cross-border data transfer mechanism.

Adequacy ReceivedRed

Not applicable — Florida is a US sub-national jurisdiction with no adequacy-receiving mechanism.

Absence provenance: not recorded. Searched: Florida adequacy decision received.

Adequacy GrantedRed

Not applicable — Florida issues no adequacy determinations.

Absence provenance: not recorded. Searched: Florida adequacy decision granted.

Sccs And BcrsRed

No SCC/BCR framework identified at Florida state level.

Absence provenance: not recorded. Searched: Florida standard contractual clauses binding corporate rules.

Transfer Impact AssessmentRed

No TIA requirement identified.

Absence provenance: not recorded. Searched: Florida transfer impact assessment requirement.

Data LocalisationRed

No data-localisation mandate identified.

Absence provenance: not recorded. Searched: Florida data localisation requirement personal data.

Financial Sector OverlayAmber

Predecessor bills proposed GLBA exemptions; final-text confirmation pending.

Claims (1):

• Florida's prior competing comprehensive-privacy bills (HB 969 / SB 1734, 2021) proposed exemptions for GLBA-covered financial institutions and HIPAA-covered entities/business associates; confirmation that the enacted FDBR (SB 262, 2023) preserves materially identical exemptions has not been independently verified against the final statutory text in this research pass.

Health Sector OverlayAmber

Health diagnosis data is 'sensitive data' under FDBR; HIPAA remains the primary federal health-data regime.

Claims (1):

• Health data is separately protected in Florida through HIPAA's federal framework and through FDBR's classification of 'mental or physical health diagnosis' data as sensitive data requiring opt-in consent for sale.

Telecoms And EprivacyAmber

No dedicated ePrivacy/cookie statute; telemarketing regulated via FTSA and federal TCPA/TSR enforcement.

Claims (1):

• Florida does not maintain a dedicated ePrivacy-style cookie/electronic-communications statute; telemarketing and robocall conduct is instead pursued by the Attorney General under Florida consumer-protection statutes together with the federal TCPA and Telemarketing Sales Rule.

Employment DataAmber

Predecessor-bill reporting indicates an employee-data exemption; unverified against final SB 262 text.

Claims (1):

• Florida's 2021 predecessor comprehensive-privacy bills exempted personal data processed in an employment context from controller obligations; whether this carve-over exists in identical form in the enacted FDBR has not been independently confirmed.

Credit And ScoringRed

No FL-specific credit-scoring privacy rule beyond federal FCRA identified.

Absence provenance: not recorded. Searched: Florida credit scoring data privacy law.

EducationRed

No FL-specific education-sector DP overlay beyond FERPA identified.

Absence provenance: not recorded. Searched: Florida education sector student data privacy law.

InsuranceRed

No FL-specific insurance-sector DP overlay identified beyond general FDBR/FIPA.

Absence provenance: not recorded. Searched: Florida insurance sector data privacy overlay.

Cookies And TrackersAmber

Pseudonymous/cookie identifiers excluded from 'personal data' scope.

Claims (1):

• The FDBR excludes pseudonymous data — including most third-party cookie identifiers — from its definition of 'personal data,' materially narrowing any cookie-consent obligations compared to ePrivacy-style regimes.

Dark PatternsAmber

'Dark patterns' is a defined term under FDBR.

Claims (1):

• The FDBR incorporates 'dark patterns' among its defined terms, addressing manipulative user-interface design used to obtain consumer consent.

Opt Out SignalsRed

No confirmed universal opt-out signal (e.g., GPC) mandate.

Absence provenance: not recorded. Searched: Florida Digital Bill of Rights Global Privacy Control universal opt-out signal.

Clean Rooms And DcrRed

No clean-room/data-collaboration-room rule identified.

Absence provenance: not recorded. Searched: Florida data clean room data collaboration room rule.

Cross Context AdvertisingAmber

Targeted-advertising definition extends to affiliated-website tracking.

Claims (1):

• The FDBR defines 'targeted advertising' broadly enough to include advertising based on data collected across a controller's affiliated websites, extending the opt-out right further than some peer state laws.

Direct MarketingAmber

Telemarketing/robocall conduct pursued via consumer-protection and federal telemarketing law.

Claims (1):

• The Florida Attorney General enforces telemarketing conduct — including robocalls and National Do Not Call Registry violations — through Florida consumer-protection statutes and coordinated multistate actions under the federal Telemarketing Sales Rule and TCPA.

Profiling RestrictionsAmber

Opt-out right against certain profiling.

Claims (1):

• Consumers may opt out of certain profiling as part of the FDBR's opt-out rights regime.

Automated Decision Making TransparencyRed

No distinct ADM-explanation/transparency right beyond the profiling opt-out identified.

Absence provenance: not recorded. Searched: Florida Digital Bill of Rights automated decision-making transparency right.

Ai Risk AssessmentsRed

No AI-specific risk-assessment statute beyond the general FDBR DPA requirement identified.

Absence provenance: not recorded. Searched: Florida AI-specific risk assessment statute.

Biometric RegimeAmber

Biometric data addressed within FDBR sensitive-data category; no standalone BIPA-style statute confirmed enacted.

Claims (2):

• Biometric data is treated as 'sensitive data' under the FDBR, requiring consumer opt-in consent before sale and a specific website disclosure ('NOTICE: This website may sell your biometric personal data') when a qualifying controller sells it.
• A standalone Florida Biometric Information Privacy Act, modeled on Illinois's BIPA and including a private right of action, was proposed in the Florida Legislature circa 2019; it is not confirmed to have been enacted, and Florida's operative biometric protections currently run through the FDBR and FIPA rather than a dedicated biometric statute.

Genetic DataAmber

Genetic data uniquely identifying an individual is 'sensitive data' under FDBR.

Claims (1):

• Genetic data processed for the purpose of uniquely identifying an individual is classified as 'sensitive data' under the FDBR, triggering the same opt-in consent requirement for sale as other sensitive-data categories.

State Surveillance CarveoutsRed

No FL-specific national-security/state-surveillance carve-out beyond general law-enforcement exemptions identified.

Absence provenance: not recorded. Searched: Florida Digital Bill of Rights state surveillance national security carveout.

Age VerificationGreen

HB 3 mandates age verification for online material harmful to minors, effective 1 Jan 2025, actively enforced.

Claims (1):

• Florida House Bill 3 (2024) requires commercial entities that distribute online material harmful to minors to verify that users are at least 18 years of age; the requirement took effect 1 January 2025 and has been actively enforced by the Attorney General against multiple pornography websites, including litigation invoking penalties of up to $50,000 per violation.

Parental ConsentGreen

HB 3 requires verifiable parental consent for under-14 social-media accounts.

Claims (1):

• HB 3 prohibits social media platforms deploying certain addictive design features from contracting with and providing accounts to users known to be 13 years old or younger without parental consent, requires account termination absent such consent, and provides a 90-day dispute period.

Minor Profiling BansAmber

FDBR requires COPPA-referenced authorization before processing a known child's sensitive data for sale.

Claims (1):

• FDBR treats personal data collected from a known child as 'sensitive data,' requiring COPPA-referenced affirmative authorization before such data may be sold, notwithstanding FDBR's broader definition of 'child' as under 18 rather than COPPA's under-13 threshold.

Education SettingsRed

No FL-specific education-sector children's-data statute distinct from FERPA identified.

Absence provenance: not recorded. Searched: Florida education sector children's data privacy statute.

Dependent AdultsRed

No FL-specific dependent/vulnerable-adult data protection provision identified.

Absence provenance: not recorded. Searched: Florida dependent adult vulnerable adult data protection statute.

Regulator Powers And PenaltiesAmber

Up to $50,000 per violation, triplable; discretionary 45-day cure period.

Claims (1):

• The Florida Attorney General has exclusive enforcement authority over the FDBR, with statutory penalties of up to $50,000 per violation, which can be tripled under certain circumstances, and discretion to provide a notice and 45-day cure period before enforcement.

Enforcement Activity IndexAmber

2025-2026 complaint data and confirmed nil-penalty status as of most recent verified report.

Claims (1):

• The Florida Attorney General's Annual Enforcement Report covering January 1 – December 31, 2025 recorded 97 consumer complaints alleging denial of the right to delete personal data and 53 alleging denial of the right to opt out of processing, continuing a pattern in which — as of the prior (2024) reporting period — no monetary penalties had yet been issued by the Department for FDBR violations.

Regulator Funding And CapacityRed

No FDBR-specific funding/headcount data identified; folded into general AG consumer-protection budget.

Absence provenance: not recorded. Searched: Florida Attorney General Digital Bill of Rights enforcement unit funding headcount.

Collective Redress And Class ActionsAmber

No private cause of action under FDBR/FIPA; class exposure runs through general law/FDUTPA instead.

Claims (1):

• The FDBR and FIPA both lack a private cause of action, so Florida consumers cannot bring collective or class actions directly under either statute; class exposure for Florida data-breach or privacy harms instead arises under general common-law claims or other statutes such as FDUTPA.

Private Right Of ActionAmber

Neither FDBR nor FIPA provides a private right of action.

Claims (1):

• Neither the FDBR nor FIPA provides a private right of action; enforcement runs exclusively through the Florida Attorney General's Department of Legal Affairs.

Recent Developments 180DAmber

HB 473 (Cybersecurity Incident Liability Act) passed the Legislature in 2026; the AG published its most recent Annual Enforcement Report in February 2026.

Claims (2):

• Florida's Legislature passed HB 473, the Cybersecurity Incident Liability Act, which would grant qualifying companies conditional immunity from data-breach lawsuits where they substantially comply with FIPA's notification requirements and maintain a cybersecurity program aligned with recognized industry standards; as of research, the bill awaited action by the Governor.
• The Attorney General published its most recent FDBR Annual Enforcement Report in February 2026, covering the January–December 2025 enforcement period and confirming continued rule-implementation activity under §501.72(5), Fla. Stat.