Every tracker you install on your site starts collecting data before the user makes any conscious decision about what they accept or reject.

This page covers one piece of the picture. For the full scope of the FDBR — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the FDBR and cookies.

An advertising pixel registers the visit. An analytics cookie begins measuring behavior. A support chat already knows the visitor's origin before the first message.

The Florida Digital Bill of Rights (FDBR, §§ 501.701 to 501.721), in effect since July 1, 2024, has specific requirements for how these trackers operate and what must be documented about them.

This article focuses exclusively on what the FDBR requires from a Cookies Policy: what the document must contain, how tracker consent must work, and what the law's specific rights imply for your cookie strategy.

The cookie banner is the visual consent element. It is what the visitor sees when they first access the site. It must be clear, offer real options, block non-essential trackers before they fire, and not use dark patterns.

The Cookies Policy is the detailed document. It is where the user finds complete information about every technology operating on the site: what it collects, what it is for, who receives the data, and how long it is stored.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible through a clear link within the consent notice itself.

§ 501.71(2)(a) prohibits processing for purposes incompatible with those disclosed. And § 501.711(1)(b) requires the purpose of processing to be included in the privacy notice.

For cookies, each category needs a specific purpose description, not a generic one.

What does not work: "cookies to improve your experience." That is not a purpose. It is a vague description that provides no compliance and no protection.

What works:

"Analytics cookies: collect browsing behavior data including pages visited, session duration, and traffic source. Used to identify opportunities to improve site content and prioritize usability corrections."

"Advertising cookies: collect behavioral data across affiliated and non-affiliated websites over time to build interest profiles and display personalized ads. Include pixels from platforms such as Meta Ads, Google Ads, and programmatic DSPs."

The Policy must list the categories of trackers operating on the site with a description of what each one does. The main categories:

Necessary cookies: essential for basic functionality. Authentication, session security. These do not require consent but must be documented.

Analytics cookies: measure browsing behavior. These generally require consent because they collect data that may identify users through cross-referencing.

Advertising cookies: feed ad pixels, build behavioral profiles, enable retargeting. These require explicit consent and the specific disclosure mandated by the FDBR.

Functional cookies: remember user preferences. May or may not require consent depending on the nature of the data.

Third-party cookies: fired by external services integrated into the site. Correct tag categorization is what makes it possible to document each one accurately.

The FDBR defines targeted advertising (§ 501.702(33)) as ads based on consumer activity data over time across affiliated or non-affiliated websites and online applications.

This is an important point of difference. The VCDPA, for example, covers only non-affiliated websites. The FDBR includes affiliated ones, meaning that trackers operating within the ecosystem of companies in the same corporate group may constitute targeted advertising under the FDBR.

§ 501.711(4) requires clear and conspicuous disclosure of any data sale or targeted advertising processing, along with the opt-out mechanism. This must be in the Cookies Policy.

§ 501.702(29) defines sale of personal data as sharing, disclosing, or transferring for monetary or other valuable consideration.

This is broader than the VCDPA, which mentions only monetary consideration. A company that exchanges user data with partners in return for services, technology, or other benefits may be conducting a "sale" under the FDBR. The Cookies Policy must assess whether site integrations fall under this definition.

§ 501.711(1)(d) and (e) require the privacy notice to disclose which categories of data are shared with third parties and which categories of third parties receive them.

For cookies, this means clearly declaring:

If a Meta Pixel transfers behavioral data to Meta, it must be documented.

If Google Analytics sends session data to Google, it must be stated.

If CRM tools receive browsing data from the site, they must be identified.

Every data flow leaving the controller's environment via cookies must be categorized.

§ 501.719(3) requires adoption of a retention schedule that prohibits use or retention of personal data after the initial purpose is fulfilled, after the contract ends, or 2 years after the consumer's last interaction.

For cookies, the Policy must document:

How long each cookie category remains active on the user's device.

How long data collected via cookies is retained in the business's systems.

How and when data is deleted, respecting the 2-year limit.

The FDBR has a right that does not exist in other US state privacy laws: consumers may opt out of the collection of sensitive data (§ 501.705(2)(f)), including precise geolocation data.

If the site collects precise geolocation data (within 1,750 feet) via cookies or location scripts, this is sensitive data under the FDBR (§ 501.702(31)(d)). The consumer has the right to refuse this collection, and the opt-out mechanism must be accessible in the Cookies Policy.

The FDBR's seventh right (§ 501.705(2)(g)) guarantees consumers the opt-out of data collection via voice or facial recognition features.

If the site uses any voice recognition technology (voice chat, audio commands) or facial recognition (identity verification, camera filters), the Cookies Policy must mention these technologies, explain their purpose, and describe how the consumer can exercise the opt-out.

§ 501.702(7) defines consent as a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement.

The correct standard: non-essential cookies off by default. The user chooses what to enable, not what to disable.

What is not valid consent:

Accepting general terms that contain cookie descriptions alongside other conditions.

Hovering over or closing a banner.

Any agreement obtained through dark patterns.

Dark patterns are defined in § 501.702(11) as interfaces designed with the substantial effect of subverting or impairing user autonomy, decision-making, or choice, including any practice the FTC refers to as a dark pattern.

In the context of cookies, common patterns the FDBR invalidates:

An "accept all" button prominently displayed with the reject option hard to find.

Non-essential cookies enabled by default.

Confusing language in the choice options.

Cookie walls blocking content until all cookies are accepted.

Banners that reappear repeatedly until the user accepts.

The FDBR defines "known child" as any individual under 18 years of age of whose age the controller has actual knowledge or willfully disregards (§ 501.702(17)).

This is a much higher threshold than other US laws. For known children:

Between 13 and 18: their affirmative authorization is required to process sensitive data (§ 501.71(2)(d)).

Under 13: COPPA applies.

If the site may have users under 18 whose age the controller knows, the Cookies Policy must describe how their data is treated differently, including the prohibition on using dark patterns to obtain data beyond what is necessary.

Penalties for violations involving known children are automatically tripled under the FDBR (§ 501.72(1)(a)).

§ 501.709 requires the controller to establish two or more methods for consumers to submit requests. This includes opt-out requests.

The Cookies Policy must describe at least two channels through which the consumer can exercise opt-outs for targeted advertising, data sale, sensitive data, and voice/facial recognition.

A consent management platform integrated into the site can be one of these channels. A DSAR form on the website can be another.

§ 501.711(1) requires updates at least annually. Beyond the mandatory annual review, situations requiring immediate update include:

Adding a new advertising pixel.

A new analytics, heatmap, or session recording tool.

A new chat, support, or engagement plugin.

A new CRM or email marketing platform integration.

Any new technology that collects voice, video, or location data.

New partners receiving behavioral data from users.

Continuous data mapping is what maintains synchronization between the tool inventory and the Cookies Policy.

Violations of cookie-related requirements under the FDBR are treated as unfair trade practices, with penalties up to US$ 50,000 per violation (§ 501.72).

Penalties are triplicable (reaching US$ 150,000 per violation) when:

The violation involves a known Florida child.

The business continues to sell or share data after the consumer opts out.

There is a failure to delete data after an authenticated request.

The 45-day cure period is discretionary and does not apply to violations involving children.

AdOpt's automatic scan identifies all technologies active on the site, feeding the list of categories that must appear in the Cookies Policy.

The cookie notice configured through AdOpt blocks non-essential trackers before acceptance, presents categories with clear descriptions, offers real choice options without dark patterns, and logs every interaction for audit purposes.

The system supports the configuration of FDBR-specific opt-outs, including sensitive data and voice/facial recognition.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Cookies Policy for your site that complies with the FDBR? Talk to our team.

Visible link in the site footer and within the cookie banner itself.

Listing of cookie categories with a description of what each one does on the site.

Specific purpose for each category, without vague descriptions (§ 501.711(1)(b)).

Disclosure of targeted advertising, including affiliated sites (§ 501.702(33)), with an accessible opt-out (§ 501.711(4)).

Data sale declaration, including non-monetary consideration if applicable (§ 501.702(29)).

Notice of sensitive data sale when applicable (§ 501.711(2)).

Notice of biometric data sale when applicable (§ 501.711(3)).

Categories of data shared with third parties via cookies (§ 501.711(1)(d)).

Categories of third parties that receive data via cookies (§ 501.711(1)(e)).

Opt-out of sensitive data and geolocation clearly described (§ 501.705(2)(f)).

Opt-out of voice and facial recognition described (§ 501.705(2)(g)).

Retention period for each category, including the 2-year limit (§ 501.719(3)).

Non-essential cookies disabled by default, without dark patterns (§ 501.702(11)).

Special protection for known children under 18 years of age (§ 501.702(17)).

Two or more submission channels described for opt-out requests (§ 501.709).

Accessible language, without legal jargon.

No cookie walls.

Annual update of the document at minimum.

1. Does the FDBR require a separate document called a "Cookies Policy"?
Not by name. The disclosure requirements for trackers are distributed between the privacy notice (§ 501.711) and the controller's specific duties (§ 501.71). A dedicated Cookies Policy is the most organized way to meet all of these requirements in a user-accessible format.

2. Is the FDBR's definition of targeted advertising different from other laws?
Yes. The FDBR (§ 501.702(33)) includes ads based on activity data from affiliated or non-affiliated websites, while the VCDPA, for example, covers only non-affiliated websites. This broadens the scope of advertising practices requiring disclosure and opt-out. A retargeting campaign within the same corporate group's ecosystem may constitute targeted advertising under the FDBR.

3. What changes for cookies when the user is a known child under 18?
For known children between 13 and 18, their affirmative authorization is required to process sensitive data (§ 501.71(2)(d)). For children under 13, COPPA applies. A controller that willfully disregards a user's age is treated as having actual knowledge of it (§ 501.702(17)). Penalties for violations involving known children are automatically tripled.

4. Does the FDBR require an opt-out for geolocation via cookies?
Yes. Precise geolocation data is sensitive data under the FDBR (§ 501.702(31)(d)). The consumer has the right to opt out of the collection of sensitive data (§ 501.705(2)(f)). If the site uses location scripts that identify the user within a radius of 1,750 feet, the opt-out for this tracking must be available and described in the Cookies Policy.

5. What are the specific penalties related to cookies under the FDBR?
All violations can result in up to US$ 50,000 per violation (§ 501.72(1)). Penalties are triplicable for violations involving known children, continuation of sharing or selling data after consumer opt-out, and failure to delete data after an authenticated request. A cookie that continues tracking after opt-out can result in a tripled penalty for each affected consumer.

Ready to build a Cookies Policy for your site that complies with the FDBR? Talk to our team.

Florida FDBR compliance rests on documents that need to agree with each other: the privacy policy, which explains what you do with the data; the privacy portal, which is where the consumer exercises their rights and you keep the record of it.