If the Florida Digital Bill of Rights (FDBR) applies to your business, you have specific obligations about what must be in the Privacy Policy, how it should be presented, and how often it must be updated.

This page covers one piece of the picture. For the full scope of the FDBR — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the FDBR and cookies.

The FDBR (§§ 501.701 to 501.721), in effect since July 1, 2024, has one requirement that sets it apart from other US state privacy laws: the privacy notice must be updated at least annually, not only when there are material changes to processing practices.

This article focuses exclusively on what the FDBR requires from your Privacy Policy, point by point, based on the official text of the law.

The law uses the term "privacy notice." In practice, it is the Privacy Policy that most websites already have, but with specific content requirements and an annual update obligation.

§ 501.711 requires the controller to provide consumers with a privacy notice that is "reasonably accessible and clear, updated at least annually," containing six mandatory categories of information.

The document must list the categories of personal data the business processes, including, if applicable, any sensitive data processed (§ 501.711(1)(a)).

The FDBR is explicit in requiring specific mention of sensitive data when it is processed. This creates an additional layer of clarity compared to other state laws.

Personal data under the FDBR (§ 501.702(19)) includes any information linkable to an identified or identifiable individual, including pseudonymous data when used in conjunction with information that links the individual. Geolocation data, device identifiers, browsing history, and biometric data fall within this scope.

The document must explain what the data is used for (§ 501.711(1)(b)).

The purposes must be specific and correspond to what actually happens. § 501.71(2)(a) prohibits processing for purposes incompatible with those disclosed, except with consumer consent.

§ 501.711(5) goes further: the controller cannot collect additional categories of data or use collected data for additional purposes without providing prior notice to the consumer. Any expansion of the collection or use scope must be communicated.

The document must describe how consumers can exercise all rights guaranteed by the FDBR (§ 501.711(1)(c)), including the appeal process.

Unlike most other state laws that guarantee five rights, the FDBR guarantees seven. The Privacy Policy must describe how the consumer can exercise each of them:

The right to access and confirmation.

The right to correction.

The right to deletion.

The right to portability.

The right to opt out of targeted advertising, data sale, and profiling with significant effects.

The right to opt out of collection of sensitive data, including precise geolocation.

The right to opt out of collection via voice or facial recognition features.

And how the appeal process works when a request is denied.

The data protection officer must have these workflows mapped and operationally functional before publishing the document.

If the business shares data with third parties, the document must disclose which categories of data are shared (§ 501.711(1)(d)).

This covers analytics platforms, CRMs, email marketing tools, advertising networks, payment processors, and any other service that receives user data.

In the FDBR, the concept of "sale" is broader than in other laws. § 501.702(29) includes sharing for non-monetary valuable consideration in addition to monetary. A company that exchanges data with partners to receive services or other benefits may be conducting a "sale" under the FDBR definition.

In addition to the types of data, the Policy must disclose which categories of third parties receive them (§ 501.711(1)(e)).

Categories such as "digital advertising platforms," "analytics tools," "CRM systems," and "payment processors" are valid examples. Categories must be identifiable enough for the consumer to understand who accesses their data.

§ 501.711(1)(f) requires the Policy to describe the methods specified in § 501.709 for consumers to submit requests.

Here is a requirement specific to the FDBR: the controller must have two or more methods for submitting requests (§ 501.709). These methods must be secure, reliable, and clearly and conspicuously accessible. The Privacy Policy must describe all of them.

The business must also maintain a mechanism on its own website for request submission. Businesses that operate exclusively online and have a direct consumer relationship may additionally accept requests by email.

The FDBR has two specific notices that do not exist in other US state privacy laws.

If the controller engages in the sale of personal data that is sensitive data, it must display: "NOTICE: This website may sell your sensitive personal data." (§ 501.711(2))

If the controller engages in the sale of personal data that is biometric data, it must display: "NOTICE: This website may sell your biometric personal data." (§ 501.711(3))

These notices must be posted in accordance with the accessibility requirements of § 501.711(1) and are mandatory whenever these practices occur.

If the business sells personal data to third parties or processes it for targeted advertising, § 501.711(4) requires clear and conspicuous disclosure of this practice, along with the manner in which the consumer can opt out.

The FDBR defines targeted advertising (§ 501.702(33)) more broadly than other laws: it includes ads based on consumer activity data across affiliated or unaffiliated websites over time. This broadens the scope compared to laws like the VCDPA, which covers only non-affiliated websites.

§ 501.711(1) is explicit: the privacy notice must be updated at least annually. It is not enough to update only when there are material changes, as is common practice under other laws.

In practice, this means every company within the FDBR's scope needs an internal annual review process for the Privacy Policy, even if nothing has substantially changed in processing practices.

Situations that require immediate updates (in addition to the annual review):

Adding a new category of data collected.

Using existing data for new purposes.

New partners receiving consumer data.

Changes in data sale practices.

Introduction of new voice or facial recognition features.

Sensitive data receives special treatment under the FDBR. The Privacy Policy must explicitly identify whether sensitive data is collected and which categories.

Under § 501.702(31), sensitive data includes: racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data for identification, known children's personal data, and precise geolocation data.

For each category of sensitive data collected, the Policy must explain how the consumer's consent is obtained and how it can be revoked.

For known children between 13 and 18, the FDBR requires their affirmative authorization (§ 501.71(2)(d)). For children under 13, COPPA applies.

§ 501.705(3) prohibits devices with voice recognition, facial recognition, video recording, audio recording, or other data collection features from being used for surveillance when not in active use by the consumer, without express authorization.

The Privacy Policy must mention this prohibition and describe how the business's devices are configured to comply with it.

The FDBR uses a broader definition. "Known child" (§ 501.702(17)) is any individual under 18 years of age of whose age the controller has actual knowledge or willfully disregards.

This differs from most US laws that use 13 years as the threshold. If the site may have users under 18 whose age is known to the controller, the FDBR's special protections apply.

The Privacy Policy must describe how data of known users under 18 is treated differently.

§ 501.713 requires controllers to conduct and document Data Protection Assessments for:

Processing data for targeted advertising.

Sale of personal data.

Processing for profiling with a reasonably foreseeable risk of harm.

Processing sensitive data.

Any processing presenting a heightened risk of harm.

Assessments are confidential. The Department of Legal Affairs may request access, and disclosure in response to that request does not constitute waiver of attorney-client privilege.

The Privacy Policy does not need to publish the assessments, but should communicate that the business conducts impact assessments for high-risk activities.

§ 501.719(3) requires adoption of a retention schedule that prohibits use or retention of personal data after:

The fulfillment of the initial collection purpose.

The expiration or termination of the contract.

2 years after the consumer's last interaction with the controller.

The Privacy Policy must mention the retention periods adopted for each data category and the existence of this 2-year limit.

Violations of the FDBR are treated as unfair and deceptive trade practices by the Department of Legal Affairs, with penalties up to US$ 50,000 per violation.

Penalties are triplicable for violations involving known Florida children, failure to delete or correct data after an authenticated request, and continuation of data sale or sharing after consumer opt-out.

The 45-day cure period is discretionary. There is no guarantee it will be granted, and for violations involving children, it is not available.

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The consent management platform ensures the consent and opt-out mechanism works as described, including the additional rights specific to the FDBR.

Every consent interaction is logged. If the Department requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Policy for your site that complies with the FDBR? Talk to our team.

Visible and accessible link on all pages of the site.

Updated at least annually, even without material changes (§ 501.711(1)).

Categories of personal data processed, including sensitive data if applicable (§ 501.711(1)(a)).

Purpose of processing for each category, without vague descriptions (§ 501.711(1)(b)).

How to exercise all 7 rights guaranteed by the FDBR, with processes, channels, and deadlines (§ 501.711(1)(c)).

Appeal process described with a 60-day deadline.

Categories of data shared with third parties (§ 501.711(1)(d)).

Categories of third parties that receive data (§ 501.711(1)(e)).

Description of the two or more submission methods for consumer requests (§ 501.711(1)(f)).

Notice of sensitive data sale when applicable (§ 501.711(2)).

Notice of biometric data sale when applicable (§ 501.711(3)).

Disclosure of targeted advertising or data sale with accessible opt-out (§ 501.711(4)).

Differentiated treatment for known children under 18 years of age (§ 501.702(17)).

Device surveillance prohibition and how it is implemented (§ 501.705(3)).

Retention periods for each data category, including the 2-year limit (§ 501.719(3)).

Non-discrimination policy for consumers exercising their rights.

Free service at least twice per year per consumer.

1. Does the FDBR require the Privacy Policy to be updated annually even without changes?
Yes. § 501.711(1) explicitly requires the privacy notice to be "updated at least annually." This differs from other US state privacy laws that require updates only when there are material changes. Companies within the FDBR's scope need a mandatory annual review process.

2. What specific notices does the FDBR require that do not exist in other laws?
The FDBR requires two specific notices. If the controller sells sensitive data, it must display: "NOTICE: This website may sell your sensitive personal data." If it sells biometric data: "NOTICE: This website may sell your biometric personal data." These notices are exclusive to the FDBR among US state privacy laws (§ 501.711(2) and (3)).

3. How does the FDBR define "child" differently from other laws?
The FDBR defines "known child" as any individual under 18 years of age of whose age the controller has actual knowledge or willfully disregards (§ 501.702(17)). Most other state laws use 13 years. This means businesses within the FDBR's scope need specific protections for users up to 17 years old, not just those under 13.

4. Does the Privacy Policy need to mention the device surveillance prohibition?
Yes. § 501.705(3) prohibits devices with voice, video, facial recognition, or other sensor features from being used for surveillance when not in active use by the consumer, without express authorization. For businesses that operate devices with these features, the Privacy Policy must describe how the prohibition is respected in practice.

5. What happens if the Privacy Policy is not updated annually?
The absence of an annual update constitutes a violation of § 501.711(1). The Department of Legal Affairs may grant a 45-day cure period for correction, but that period is discretionary. If not corrected, penalties reach up to US$ 50,000 per violation, potentially triplicable in specific circumstances (§ 501.72).

Ready to build a Privacy Policy for your site that complies with the FDBR? Talk to our team.