Florida has not one, but two laws relevant to anyone handling data from state consumers.

And understanding the difference between them is the first step in knowing whether your business falls within the scope of each one.

The Florida Digital Bill of Rights (FDBR), Part V of Chapter 501 of the Florida Statutes (§§ 501.701 to 501.721), came into effect on July 1, 2024. It is the most selective comprehensive data privacy law in the United States: it applies exclusively to companies with global annual revenues exceeding US$ 1 billion that meet specific digital business criteria.

If you have never heard of the FDBR, it probably does not apply to your business. But if it does, you need to know it very well.

When it comes to data privacy in Florida, two names come up frequently: FDBR and FIPA. They coexist, but they regulate different things and have completely different application scopes.

The Florida Information Protection Act (FIPA), codified at § 501.171 of the Florida Statutes, was enacted in 2014. It is a data security and breach notification law, not a comprehensive privacy law in the style of the GDPR or Brazil's LGPD.

FIPA applies to any business, government agency, or individual that maintains personal information of Florida residents in electronic format. The scope is broad: if you have names, Social Security numbers, bank account numbers, health information, or other personal data of Florida residents stored digitally, FIPA applies.

The main FIPA obligations are:

Implement reasonable security measures to protect personal data from unauthorized access.

Notify affected consumers of a data breach within 30 days of discovery.

Notify the Florida Department of Legal Affairs if more than 500 consumers are affected.

Notify national credit reporting agencies if more than 1,000 consumers are affected.

Penalties for delayed notification reach US$ 500,000.

FIPA does not grant rights of access, correction, or deletion. It deals with security and transparency after incidents, not with active control by data subjects over their data.

The Florida Digital Bill of Rights is a comprehensive privacy law modeled on modern legislation. It guarantees rights to Florida consumers, creates compliance obligations for businesses that process their data, and establishes enforcement mechanisms.

The fundamental difference: the FDBR has an extremely high applicability threshold. It applies only to businesses with global revenues exceeding US$ 1 billion that operate in specific digital business sectors.

A company may be subject to both simultaneously. If a Big Tech company with a Florida presence suffers a data breach, FIPA governs the notification process. The FDBR governs everything that happens before: how data is collected, processed, and what rights consumers have over it.

The Florida Digital Bill of Rights is Florida's state-level personal data protection law. It may be cited as the "Florida Digital Bill of Rights" under § 501.701 and forms Part V of Chapter 501 of the Florida Statutes.

The law creates a framework of rights and obligations focused on transparency, consent, and data control. If you are already familiar with the LGPD or the GDPR, the general structure will be familiar. What distinguishes it is the extremely selective applicability threshold.

Enforcement is the responsibility of the Florida Department of Legal Affairs. There is no private right of action.

On July 1, 2024.

The FDBR's applicability threshold is the most restrictive among all US state privacy laws.

Under § 501.703 and § 501.702(9), the law applies to controllers that:

1. Conduct business in Florida or produce products or services used by Florida residents.

2. Process or engage in the sale of personal data.

3. Are organized for profit or the financial benefit of their shareholders or owners.

4. Generate more than US$ 1 billion in global gross annual revenues.

5. Meet at least one of the following additional criteria:

Derive 50% or more of global gross annual revenues from the sale of online advertisements, including targeted advertising or the sale of ads online.

Operate a consumer smart speaker with a voice command component and integrated virtual assistant connected to a cloud computing service.

Operate an app store or digital distribution platform with at least 250,000 different software applications available for download.

In practice, the FDBR was designed to reach companies like Google, Meta, Amazon, and Apple. Smaller businesses, even if they operate in Florida and handle data of Florida residents, are not within the FDBR's scope (but may be within FIPA's scope).

Under § 501.703(2), the following are exempt:

State agencies and political subdivisions of the state.

Financial institutions regulated by the Gramm-Leach-Bliley Act (Title V).

Covered entities and business associates regulated by HIPAA.

Nonprofit organizations.

Postsecondary education institutions receiving state funds.

There are also exemptions for HIPAA-protected data, FERPA-regulated data, Fair Credit Reporting Act data, Driver's Privacy Protection Act data, Farm Credit Act data, employee and job applicant data, and short-term transactional payment processing data.

Under § 501.702(19), personal data is any information, including sensitive data, linked or reasonably linkable to an identified or identifiable individual. It also includes pseudonymous data when used in conjunction with additional information that reasonably links the data to an individual.

De-identified data and publicly available information are excluded.

Under § 501.702(31), sensitive data includes:

Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status.

Genetic or biometric data processed to uniquely identify an individual.

Personal data collected from a known child.

Precise geolocation data (within 1,750 feet).

The FDBR has a specific and important definition of "known child" (§ 501.702(17)): any individual under 18 years of age of whose age the controller has actual knowledge or willfully disregards. This is a higher threshold than most US laws, which use 13 years.

The FDBR guarantees seven rights to Florida residents, two more than most US state privacy laws. Under § 501.705(2):

Right to access and confirmation: knowing whether the controller processes their data and obtaining a copy in an accessible format.

Right to correction: correcting inaccuracies in personal data, considering the nature of the data and the purposes of processing.

Right to deletion: requesting deletion of any or all data provided by or obtained about the consumer.

Right to portability: obtaining a copy of data in a portable and, where technically feasible, readily usable format, if the data is available in a digital format.

Right to opt-out of targeted advertising, data sale, and profiling with legal or similarly significant effects.

Right to opt-out of collection of sensitive data, including precise geolocation data, or processing of sensitive data.

Right to opt-out of collection of data via voice recognition or facial recognition features.

The seventh right, related to voice and facial recognition, is exclusive to the FDBR among US state privacy laws.

§ 501.705(3) goes beyond opt-out rights and explicitly prohibits devices with voice recognition, facial recognition, video recording, audio recording, or other electronic, visual, thermal, or olfactory data collection features from being used for surveillance when not in active use by the consumer, unless the consumer has expressly authorized it.

Under § 501.706, the controller must respond without undue delay, no later than 45 days after receipt of the request.

The deadline can be extended once by 15 additional days (not 45 like other laws) when reasonably necessary, as long as the consumer is notified within the initial period with the reason.

After fulfilling the request, the controller must provide notice to the consumer within 60 days confirming compliance (§ 501.706(4)).

Service is free at least twice per year per consumer. For manifestly unfounded, excessive, or repetitive requests, the business may charge a reasonable fee or decline, but bears the burden of demonstrating the excessive nature.

§ 501.709 requires the controller to establish two or more methods for consumers to submit requests. This is unique among US state privacy laws.

The methods must be secure, reliable, and clearly and conspicuously accessible. A mechanism on the controller's own website is mandatory. Online-only businesses with a direct consumer relationship may additionally accept requests by email.

The business cannot require consumers to create a new account to exercise their rights.

Under § 501.702(7), consent is a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement.

What is not valid consent: accepting general terms that contain data processing descriptions alongside unrelated information, hovering over or closing content, and any agreement obtained through dark patterns.

Dark patterns are defined in § 501.702(11) as interfaces designed with the substantial effect of subverting or impairing user autonomy, decision-making, or choice, including any practice the FTC refers to as a dark pattern.

Under § 501.71, the controller must:

Limit data collection to what is adequate, relevant, and reasonably necessary for the disclosed purposes.

Implement reasonable technical, administrative, and physical data security practices proportionate to the volume and nature of the data.

Not process data for purposes incompatible with those disclosed, except with consumer consent.

Not process data in violation of anti-discrimination laws.

Not discriminate against consumers who exercise their rights.

Not process sensitive data of consumers without prior consent, or for known children between 13 and 18, without their affirmative authorization, or following COPPA for children under 13.

For search engine operators: make available a plain language description of main ranking parameters, including whether political partisanship or ideology is prioritized or deprioritized in search results.

The FDBR defines targeted advertising (§ 501.702(33)) as ads based on data from consumer activities over time across affiliated or unaffiliated websites and online applications.

This differs from most other state privacy laws. The VCDPA, for example, covers only non-affiliated websites. The FDBR includes affiliated ones, meaning that trackers operating within the ecosystem of companies in the same corporate group may constitute targeted advertising under the FDBR.

§ 501.702(29) defines sale of personal data as sharing, disclosing, or transferring for monetary or other valuable consideration. This is broader than the VCDPA, which mentions only monetary consideration. A company that exchanges user data with partners in return for services, technology, or other benefits may be conducting a "sale" under the FDBR.

§ 501.711 requires the controller to provide a reasonably accessible and clear privacy notice updated at least annually.

Beyond common content elements, the FDBR requires specific notices when the controller sells sensitive or biometric data. If the site sells sensitive data, it must display: "NOTICE: This website may sell your sensitive personal data." If it sells biometric data: "NOTICE: This website may sell your biometric personal data."

§ 501.719(3) requires adoption of a retention schedule that prohibits use or retention of personal data after:

The fulfillment of the initial purpose of collection.

The expiration or termination of the contract.

2 years after the consumer's last interaction with the controller.

This explicit 2-year limit is specific to the FDBR and sets it apart from most other US state privacy laws.

Under § 501.72, violations of the FDBR are treated as unfair and deceptive trade practices. Civil penalties reach up to US$ 50,000 per violation, significantly higher than other state laws like the VCDPA (US$ 7,500) and NHDPA (US$ 10,000).

Penalties may be tripled for:

Violations involving a known Florida child (a controller that willfully disregards age is deemed to have actual knowledge of it).

Failure to delete or correct data after an authenticated consumer request.

Continuing to sell or share a consumer's data after they opt out.

The Department may grant a 45-day cure period, but it is discretionary, not guaranteed. For violations involving children, there is no cure period available.

If you do not exceed US$ 1 billion in global revenue and do not operate an app store, smart speaker, or large-scale online advertising platform, the FDBR likely does not apply. But FIPA still may.

Understand what you collect, for what purpose, how it is used, and with whom it is shared. Data mapping is the foundation of any compliance program.

The FDBR requires at least two secure and accessible methods for consumers to submit requests.

Annual updates are mandatory by law. Include the specific notices required when selling sensitive and biometric data.

The two additional FDBR rights need structured exercise channels.

Data must be deleted after 2 years from the consumer's last interaction, except for the legal exceptions.

If your business operates devices with voice or camera features, ensure they do not collect data when not in active use without express consumer authorization.

Applying privacy by design from product conception is what makes compliance sustainable.

AdOpt records every consent interaction, blocks trackers before acceptance, and generates the auditable log needed in a Department of Legal Affairs investigation.

The automatic scan identifies all active trackers on the site, feeding the data inventory required for the privacy notice and the Data Protection Assessments. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Ready to bring your website into compliance with the FDBR? Talk to our team.

To understand how these privacy laws compare in terms of structure and practical impact, our comparative guide goes deeper on the subject.

Compliance with the FDBR rests on three documents that have to agree with each other: the cookies policy, which declares every tracker and its purpose; the privacy policy, which explains what you do with the data; and the privacy portal, where the consumer exercises their rights and you keep the record of it.

1. What is the difference between the FDBR and FIPA?
FIPA (2014) is a data security and breach notification law that applies to any business maintaining data of Florida residents. The FDBR (2024) is a comprehensive consumer rights law that applies only to businesses with more than US$ 1 billion in global revenue operating in specific digital technology sectors. A company may be subject to both simultaneously: FIPA governs what happens after a data breach, and the FDBR governs how data is collected, processed, and what rights consumers have over it.

2. Who is actually within the scope of the FDBR?
In practice, the FDBR was designed to reach Big Tech companies such as Google, Meta, Amazon, and Apple. The US$ 1 billion global revenue threshold combined with the additional requirements (online advertising, smart speakers, or app stores with 250K apps) excludes the vast majority of businesses from the scope. Smaller businesses that handle data of Florida residents remain subject to FIPA for security and breach notification matters (§ 501.702(9)).

3. What are the rights exclusive to the FDBR that other laws do not have?
The FDBR guarantees seven rights, two of which are exclusive: the right to opt out of collection of sensitive data (including precise geolocation) and the right to opt out of data collection via voice or facial recognition features (§ 501.705(2)(f) and (g)). The device surveillance prohibition when not in active use is also a requirement exclusive to the FDBR.

4. What are the penalties for non-compliance with the FDBR?
The Department of Legal Affairs may impose civil penalties of up to US$ 50,000 per violation, triplicable for violations involving known children, failure to delete or correct data after an authenticated request, and continued sale of data after consumer opt-out. The 45-day cure period is discretionary, not guaranteed, and does not apply to violations involving children (§ 501.72).

5. How does the FDBR define targeted advertising differently from other laws?
The FDBR (§ 501.702(33)) defines targeted advertising as ads based on data from consumer activities over time across affiliated or non-affiliated websites, making it broader than the VCDPA which only covers non-affiliated websites. Additionally, the "sale" definition in the FDBR includes non-monetary valuable consideration, while the VCDPA mentions only monetary consideration.

Ready to bring your website into compliance with the FDBR? Talk to our team.