Florida
Florida Digital Bill of Rights
Florida’s consumer privacy law. It gives Florida residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- In effect since July 1, 2024
- Citation
- Fla. Stat. § 501.701 et seq.
- Official text
- Read the law(opens in a new tab)
Who it covers
Only very large companies (over $1 billion in revenue). Florida also requires any business that sells sensitive data to get consent and post a notice.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
- Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
- Offer an appeal when you turn down a privacy request.
- If you sell sensitive data: get the consumer’s consent first and show the notice “NOTICE: This website may sell your sensitive personal data.” This applies to any for-profit business (§ 501.715).
Two sets of rules: giant tech companies, and everyone else
The Florida Digital Bill of Rights took effect on July 1, 2024. Most of it applies only to “controllers”: for-profit businesses with over $1 billion in global annual revenue that also make 50% or more of it from online ads, run a smart speaker and voice command service, or run an app store with at least 250,000 apps.
One rule reaches any for-profit business that does business in Florida and collects personal data, whatever its size: you may not sell sensitive data without prior consent. If you do sell it, your privacy notice must say: “NOTICE: This website may sell your sensitive personal data.”
Nonprofits are exempt, as are state agencies, Gramm-Leach-Bliley financial institutions, HIPAA covered entities and colleges.
Rights against the large controllers
- Rights to access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling.
- Florida-only rights: to opt out of the collection of sensitive data, including precise geolocation, and of personal data collected through voice or facial recognition.
- Respond within 45 days, extendable once by 15 more, free of charge.
- Appeals: conspicuously available, answered in writing within 60 days.
Sensitive data, teens and opt-out signals
Florida counts anyone under 18 as a child. Sensitive data includes race or ethnicity, religion, health diagnoses, sexual orientation, citizenship or immigration status, genetic and biometric data, data of a known child, and precise geolocation. Controllers need consent to process it; for a known child of 13 to 17, the teen must authorize selling it, and under 13 COPPA applies.
A separate section protects children on online platforms they predominantly use, limiting profiling, precise geolocation and dark patterns.
Florida doesn’t require honoring universal opt-out signals such as Global Privacy Control.
Enforcement
The Department of Legal Affairs (the Attorney General) enforces the law alone, under Florida’s Deceptive and Unfair Trade Practices Act; there’s no private right of action. Penalties are up to $50,000 per violation, and can be tripled for violations involving a known child, failing to delete or correct after a valid request, or continuing to sell or share data after an opt-out. A 45-day cure period is at the department’s discretion, and isn’t available for known-child violations.
In October 2025 the Attorney General sued Roku under the law, alleging it sold or processed children’s data without parental consent.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Children’s Privacy Policy (Pro)
A children’s privacy notice page for sites that may collect information from children under 13.
A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Does Florida’s privacy law apply to my small business?
Mostly no; the main duties apply only to companies with over $1 billion in revenue. But any for-profit business needs prior consent to sell sensitive data.
Who counts as a child in Florida?
Anyone under 18.
How big are Florida’s penalties?
Up to $50,000 per violation, tripled in some cases, such as violations involving a known child.
Sources
- Fla. Stat. § 501.702 (definitions)(opens in a new tab)
- § 501.705 (rights)(opens in a new tab)
- § 501.706 (deadlines)(opens in a new tab)
- § 501.711 (privacy notice)(opens in a new tab)
- § 501.715 (sale of sensitive data, all businesses)(opens in a new tab)
- § 501.72 (enforcement)(opens in a new tab)
- Florida Attorney General: lawsuit against Roku(opens in a new tab)
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
