The Florida Digital Bill of Rights (FDBR) guarantees seven rights to Florida consumers. For each of those rights, there is a corresponding obligation on your side: a channel to receive the request, a deadline to respond, a structured appeal process, and documentation of the entire flow.

This page covers one piece of the picture. For the full scope of the FDBR — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the FDBR and cookies.

This article covers all of it: what a DSAR is under the FDBR, what the seven guaranteed rights are, how to process each type of request, the law's specific deadlines, and what happens when the process does not work as it should.

DSAR stands for Data Subject Access Request. In practice, it is any formal request from a Florida consumer to exercise the rights the FDBR (§§ 501.701 to 501.721) grants them over their own data.

The FDBR guarantees seven rights, two of which are exclusive to this law. This means that a Privacy Portal for a company within the FDBR's scope must cover more scenarios than portals configured for most other US state privacy laws.

If you are already familiar with the GDPR rights framework, the structure is familiar. The logic is the same: the consumer needs a functional channel to exercise the rights the law guarantees.

Under § 501.705(2), Florida residents have the following rights:

The consumer may confirm whether the business processes their data and obtain a copy of the personal data the business holds, under § 501.705(2)(a).

The response must be provided in an accessible format.

The consumer may request correction of inaccuracies in personal data, considering the nature of the data and the purposes of processing, under § 501.705(2)(b).

The business may, if it maintains a self-service correction mechanism, direct the consumer to use it. But it must inform the consumer of this option within the response deadline (§ 501.706(3)).

The consumer may request deletion of any or all data provided by or obtained about them, under § 501.705(2)(c).

The FDBR allows two forms of compliance when data was obtained from a third party (§ 501.706(6)):

Delete the data and retain only the deletion request record and the minimum data necessary to ensure the consumer's data remains deleted, without using the retained data for any other purpose.

Opt the consumer out of the processing of that data for any non-exempt purpose.

The consumer may obtain a copy of their data in a portable and, where technically feasible, readily usable format, if the data is available in a digital format, under § 501.705(2)(d).

The consumer may refuse processing of their data for targeted advertising, sale of personal data, and profiling in furtherance of decisions with legal or similarly significant effects (§ 501.705(2)(e)).

The consumer may opt out of the collection of sensitive data, including precise geolocation data, or the processing of sensitive data, under § 501.705(2)(f).

This is a right exclusive to the FDBR. Sensitive data includes racial or ethnic origin, religious beliefs, health diagnosis, sexual orientation, immigration status, genetic or biometric data, known children's data, and precise geolocation (§ 501.702(31)).

The consumer may opt out of data collection via voice recognition or facial recognition features, under § 501.705(2)(g).

This is the most exclusive right of the FDBR. If the business operates voice recognition technology (virtual assistants, audio commands) or facial recognition (identity verification, expression analysis), the consumer has the right to refuse data collection via these features.

§ 501.705(3) goes beyond opt-out rights. Devices with voice, video, facial recognition, audio, or other data collection sensors cannot use these features for surveillance when not in active use by the consumer, unless they have expressly authorized it.

The FDBR has deadlines that differ from other US state privacy laws.

45 days from receipt of an authenticated request to respond (§ 501.706(2)).

The deadline can be extended once by 15 additional days when reasonably necessary, considering the complexity and number of requests, as long as the consumer is notified within the initial period with the reason. The FDBR's extension period is 15 days, not 45 like other laws.

After fulfilling the request, the controller must provide notice to the consumer within 60 days confirming compliance (§ 501.706(4)).

60 days to respond to appeals (§ 501.707(3)).

Service is free at least twice per year per consumer (§ 501.706(5)).

§ 501.709 requires the controller to establish two or more methods for submitting requests. This is a requirement exclusive to the FDBR among US state privacy laws.

The methods must be:

Secure and reliable.

Clearly and conspicuously accessible.

Appropriate for the ways consumers normally interact with the controller.

Capable of supporting authentication of the consumer's identity.

Additionally, the controller must maintain a mechanism on its own website for request submission (§ 501.709(3)). Businesses operating exclusively online with a direct consumer relationship may additionally accept requests by email.

The business cannot require consumers to create a new account to exercise their rights. It may require use of an existing account.

Under § 501.707, the controller must establish an appeal process that is:

Conspicuously available and easy to find.

Similar to the original request submission process.

Capable of resulting in a written response within 60 days, including the decision and the reasoning.

The FDBR does not explicitly mention that the consumer must be informed about how to contact the Department of Legal Affairs after a denied appeal, unlike the VCDPA. But the business should inform consumers of available escalation channels.

The business needs to verify that whoever is submitting the request is the data subject. But the process cannot be a disproportionate barrier.

Under § 501.706(3), if the business cannot authenticate the request, it is not required to fulfill it, but must make a reasonable effort to request additional information reasonably necessary to authenticate the consumer and the request.

In practice:

For low-risk data: email confirmation may be sufficient.

For sensitive data or high-risk situations: a second verification factor may be justified.

What is never acceptable: disproportionate barriers relative to the type of data involved, requiring creation of a new account, or requesting more personal data than necessary to authenticate.

Service is free at least twice per year per consumer (§ 501.706(5)). For requests beyond that limit, or that are manifestly unfounded, excessive, or repetitive, the business may charge a reasonable fee or decline. The burden of demonstrating the excessive nature lies with the controller.

Receive and authenticate the data subject.

Locate all personal data the business holds about this consumer across all systems.

Prepare a copy in a readable and accessible format.

Include: categories of data, purposes, third parties that received the data, retention period.

Send the response within the 45-day deadline.

Send a compliance notice within 60 days (§ 501.706(4)).

Receive and authenticate.

Identify the inaccurate data and which systems it is stored in.

Correct in primary systems and, where applicable, notify third parties that received the data.

Confirm to the consumer that the correction was made.

If the business maintains a self-correction mechanism, it may direct the consumer to use it, but must notify within the deadline.

Receive and authenticate.

Check whether a legal exception allows retaining the data.

For data obtained from third parties, choose between the two options in § 501.706(6): delete outright, or opt the consumer out of all non-exempt processing.

Notify third parties that received the data when applicable.

Confirm to the consumer what was deleted.

Receive and authenticate.

Generate a file with the consumer's data in a portable format, when available digitally.

Deliver to the consumer securely within the deadline.

Receive and authenticate.

Cease processing for targeted advertising, data sale, and profiling with significant effects without undue delay.

Configure systems to ensure this consumer is not included in those practices.

Note: continuing to sell or share data after opt-out subjects the business to tripled penalties (§ 501.72(1)(c)).

A consent management platform integrated with the business's systems automates a large part of this workflow.

Receive and authenticate.

Identify all sensitive data collection points on the site or in the product.

Cease collection of sensitive data for this consumer as requested.

If precise geolocation was being collected, ensure that collection stops immediately.

Document the action taken.

Receive and authenticate.

Identify all voice and camera collection features in the product.

Configure the system to not collect voice or facial recognition data from this consumer.

Document the action taken.

The business may deny a request when:

It cannot authenticate the consumer's identity with commercially reasonable efforts.

The request is manifestly unfounded or excessive.

A legal exception justifies continued processing.

In all cases, the denial must be communicated to the consumer within the 45-day deadline (§ 501.706(3)), with:

The reason for the denial clearly stated.

Instructions on how to appeal the decision.

The appeal process must result in a written response within 60 days.

§ 501.71(2)(c) prohibits businesses from discriminating against consumers who exercise their rights. This includes denying products or services, charging different prices, or offering lower quality.

The exception: financial incentive programs, including payments to consumers as compensation for data processing, are permitted if the consumer gives clear prior consent to the material terms, and provided such incentives are not unjust, coercive, or unreasonable. The consent may be revoked at any time.

The FDBR uses a higher threshold. "Known child" (§ 501.702(17)) is any individual under 18 years of age of whose age the controller has actual knowledge or willfully disregards.

A controller that deliberately disregards a user's age is treated as having actual knowledge of it.

For requests from known children: parents or legal guardians may exercise the seven rights on behalf of the child (§ 501.705(1)).

Penalties for violations involving known children are automatically tripled by the FDBR (§ 501.72(1)(a)).

Every processed request must be documented. This includes:

Date and time of receipt.

Type of request (including which of the seven rights was exercised).

Authentication process performed.

Action taken.

Date the compliance notice was sent.

In case of denial: recorded justification.

In case of appeal: complete history and final decision.

This documentation is what protects the business in the event of a Department of Legal Affairs investigation. Penalties for failure to delete or correct data after an authenticated request are tripled (§ 501.72(1)(b)).

The Department of Legal Affairs may grant a 45-day cure period before initiating action (§ 501.72(2)), but this period is discretionary, not guaranteed.

And there is a critical exception: violations involving known Florida children have no cure period available (§ 501.72(2)). The Department may initiate immediate action.

Businesses without a structured DSAR process when they receive a Department notification face significant difficulty correcting in 45 days what should have been implemented from the start.

AdOpt logs every consent and opt-out interaction with a timestamp and unique identifier. When the consumer exercises opt-out of targeted advertising, sensitive data, or voice/facial recognition through the Privacy Portal, the system automatically updates the corresponding triggers.

AdOpt's auditable log serves as evidence that processes were completed as required by the FDBR. And when legislation changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Portal for your site that complies with the FDBR? Talk to our team.

Two or more submission channels that are secure and clearly accessible (§ 501.709).

Mechanism on the website for request submission (§ 501.709(3)).

Coverage of all 7 rights guaranteed by the FDBR, including opt-out for sensitive data and voice/facial recognition.

Conspicuously available appeal process similar to the original submission channel (§ 501.707).

45-day response deadline, with extension of only 15 additional days when necessary (§ 501.706(2)).

Compliance notice sent to the consumer within 60 days of fulfillment (§ 501.706(4)).

60-day deadline to respond to appeals (§ 501.707(3)).

Authentication process using commercially reasonable efforts (§ 501.706(3)).

Free service at least twice per year per consumer (§ 501.706(5)).

Documented record of each request, including which right was exercised.

Differentiated treatment for known children under 18 years of age (§ 501.702(17)).

Parents and legal guardians may exercise rights on behalf of known children (§ 501.705(1)).

Non-discrimination protection for consumers exercising their rights (§ 501.71(2)(c)).

1. Why does the FDBR require two or more DSAR channels while other laws require only one?
§ 501.709 explicitly requires two or more methods for submitting requests, signaling that the Florida legislature considered a single channel insufficient for different consumer profiles. The methods must be secure, reliable, and clearly accessible, taking into account how consumers normally interact with the controller. A business could use, for example, a website form as one channel and a dedicated email address as a second.

2. Is the FDBR's extension period really only 15 additional days?
Yes. § 501.706(2) allows an extension of only 15 additional days beyond the initial 45 days. Other state laws like the VCDPA and NHDPA allow extensions of 45 additional days. This means the maximum total response period under the FDBR is 60 days, versus up to 90 days under other laws. Businesses within the FDBR's scope need more agile processes to ensure compliance.

3. Does the FDBR have a guaranteed cure period like the VCDPA?
No. The FDBR's 45-day cure period is discretionary (§ 501.72(2)): the Department of Legal Affairs may or may not grant it, considering the number and frequency of violations, the substantial likelihood of public harm, and the safety of persons or property. Additionally, violations involving known Florida children have no cure period available. The Department may initiate immediate action in those cases.

4. How does the FDBR treat children differently from other laws in the context of DSARs?
The FDBR uses an 18-year threshold for "known child" (§ 501.702(17)), not 13 as most US laws do. Parents and legal guardians may exercise all seven rights on behalf of known children (§ 501.705(1)). Violations involving known children have no cure period and penalties are automatically tripled (§ 501.72(1)(a)). A controller that deliberately disregards a user's age is treated as having actual knowledge of it.

5. What happens if the business continues selling data after the consumer opts out?
§ 501.72(1)(c) lists continued sale or sharing of data after consumer opt-out as one of the violations that result in automatically tripled penalties. Each affected consumer can be counted as a separate violation, rapidly escalating the financial exposure. The base penalty reaches US$ 50,000 per violation, triplicable to US$ 150,000. For businesses with large user bases, this can represent significant financial risk.

Ready to build a Privacy Portal for your site that complies with the FDBR? Talk to our team.