Colorado CPA and Cookies: All You Need to Know

João Bruno Soares

Florida FDBR and Cookies: All You Need to Know

Every tracker you install on your site starts collecting data before the user makes any conscious decision about what they accept or reject.

This page covers one piece of the picture. For the full scope of the FDBR — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the FDBR and cookies](https://goadopt.io/en/blog/florida-fdbr-and-cookies-all-you-need-to-know/).

An advertising pixel registers the visit. An analytics cookie begins measuring behavior. A support chat already knows the visitor's origin before the first message.

The Florida Digital Bill of Rights (FDBR, §§ 501.701 to 501.721), in effect since July 1, 2024, has specific requirements for how these trackers operate and what must be documented about them.

This article focuses exclusively on what the FDBR requires from a Cookies Policy: what the document must contain, how tracker consent must work, and what the law's specific rights imply for your cookie strategy.

## Cookies Policy vs. cookie banner: the necessary distinction

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the visual consent element. It is what the visitor sees when they first access the site. It must be clear, offer real options, block non-essential trackers before they fire, and not use dark patterns.

The Cookies Policy is the detailed document. It is where the user finds complete information about every technology operating on the site: what it collects, what it is for, who receives the data, and how long it is stored.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible through a clear link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## What the FDBR specifically requires for cookies

### Specific purpose for each category

§ 501.71(2)(a) prohibits processing for purposes incompatible with those disclosed. And § 501.711(1)(b) requires the purpose of processing to be included in the privacy notice.

For cookies, each category needs a specific purpose description, not a generic one.

What does not work: "cookies to improve your experience." That is not a purpose. It is a vague description that provides no compliance and no protection.

What works:

"Analytics cookies: collect browsing behavior data including pages visited, session duration, and traffic source. Used to identify opportunities to improve site content and prioritize usability corrections."

"Advertising cookies: collect behavioral data across affiliated and non-affiliated websites over time to build interest profiles and display personalized ads. Include pixels from platforms such as Meta Ads, Google Ads, and programmatic DSPs."

### The categories of cookies present on the site

The Policy must list the categories of trackers operating on the site with a description of what each one does. The main categories:

**Necessary cookies:** essential for basic functionality. Authentication, session security. These do not require consent but must be documented.

**Analytics cookies:** measure browsing behavior. These generally require consent because they collect data that may identify users through cross-referencing.

**Advertising cookies:** feed ad pixels, build behavioral profiles, enable retargeting. These require explicit consent and the specific disclosure mandated by the FDBR.

**Functional cookies:** remember user preferences. May or may not require consent depending on the nature of the data.

**Third-party cookies:** fired by external services integrated into the site. [Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to document each one accurately.

### Targeted advertising: the FDBR's broader definition

The FDBR defines targeted advertising (§ 501.702(33)) as ads based on consumer activity data over time across **affiliated or non-affiliated** websites and online applications.

This is an important point of difference. The VCDPA, for example, covers only non-affiliated websites. The FDBR includes affiliated ones, meaning that trackers operating within the ecosystem of companies in the same corporate group may constitute targeted advertising under the FDBR.

§ 501.711(4) requires clear and conspicuous disclosure of any data sale or targeted advertising processing, along with the opt-out mechanism. This must be in the Cookies Policy.

### Sale of data: includes non-monetary consideration

§ 501.702(29) defines sale of personal data as sharing, disclosing, or transferring for monetary **or other valuable consideration**.

This is broader than the VCDPA, which mentions only monetary consideration. A company that exchanges user data with partners in return for services, technology, or other benefits may be conducting a "sale" under the FDBR. The Cookies Policy must assess whether site integrations fall under this definition.

### Categories of data shared with third parties via cookies

§ 501.711(1)(d) and (e) require the privacy notice to disclose which categories of data are shared with third parties and which categories of third parties receive them.

For cookies, this means clearly declaring:

If a Meta Pixel transfers behavioral data to Meta, it must be documented.

If Google Analytics sends session data to Google, it must be stated.

If CRM tools receive browsing data from the site, they must be identified.

Every data flow leaving the controller's environment via cookies must be categorized.

### Retention period: the 2-year limit

§ 501.719(3) requires adoption of a retention schedule that prohibits use or retention of personal data after the initial purpose is fulfilled, after the contract ends, or **2 years after the consumer's last interaction**.

For cookies, the Policy must document:

How long each cookie category remains active on the user's device.

How long data collected via cookies is retained in the business's systems.

How and when data is deleted, respecting the 2-year limit.

### The opt-out for sensitive data via cookies

The FDBR has a right that does not exist in other US state privacy laws: consumers may opt out of the **collection of sensitive data** (§ 501.705(2)(f)), including precise geolocation data.

If the site collects precise geolocation data (within 1,750 feet) via cookies or location scripts, this is sensitive data under the FDBR (§ 501.702(31)(d)). The consumer has the right to refuse this collection, and the opt-out mechanism must be accessible in the Cookies Policy.

### The opt-out for voice and facial recognition

The FDBR's seventh right (§ 501.705(2)(g)) guarantees consumers the opt-out of data collection via voice or facial recognition features.

If the site uses any voice recognition technology (voice chat, audio commands) or facial recognition (identity verification, camera filters), the Cookies Policy must mention these technologies, explain their purpose, and describe how the consumer can exercise the opt-out.

## What constitutes valid consent for cookies under the FDBR

§ 501.702(7) defines consent as a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement.

The correct standard: non-essential cookies off by default. The user chooses what to enable, not what to disable.

What is not valid consent:

Accepting general terms that contain cookie descriptions alongside other conditions.

Hovering over or closing a banner.

Any agreement obtained through dark patterns.

### Dark patterns prohibited by the FDBR

Dark patterns are defined in § 501.702(11) as interfaces designed with the substantial effect of subverting or impairing user autonomy, decision-making, or choice, including any practice the FTC refers to as a dark pattern.

In the context of cookies, common patterns the FDBR invalidates:

An "accept all" button prominently displayed with the reject option hard to find.

Non-essential cookies enabled by default.

Confusing language in the choice options.

Cookie walls blocking content until all cookies are accepted.

Banners that reappear repeatedly until the user accepts.

## Special protection for children's data via cookies

The FDBR defines "known child" as any individual under **18 years of age** of whose age the controller has actual knowledge or willfully disregards (§ 501.702(17)).

This is a much higher threshold than other US laws. For known children:

Between 13 and 18: their affirmative authorization is required to process sensitive data (§ 501.71(2)(d)).

Under 13: COPPA applies.

If the site may have users under 18 whose age the controller knows, the Cookies Policy must describe how their data is treated differently, including the prohibition on using dark patterns to obtain data beyond what is necessary.

Penalties for violations involving known children are **automatically tripled** under the FDBR (§ 501.72(1)(a)).

## Two or more opt-out channels: FDBR-exclusive requirement

§ 501.709 requires the controller to establish **two or more methods** for consumers to submit requests. This includes opt-out requests.

The Cookies Policy must describe at least two channels through which the consumer can exercise opt-outs for targeted advertising, data sale, sensitive data, and voice/facial recognition.

A [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) integrated into the site can be one of these channels. A DSAR form on the website can be another.

## When to update the Cookies Policy

§ 501.711(1) requires updates **at least annually**. Beyond the mandatory annual review, situations requiring immediate update include:

Adding a new advertising pixel.

A new analytics, heatmap, or session recording tool.

A new chat, support, or engagement plugin.

A new CRM or email marketing platform integration.

Any new technology that collects voice, video, or location data.

New partners receiving behavioral data from users.

Continuous [data mapping](https://goadopt.io/en/blog/data-mapping-or-data-inventory/) is what maintains synchronization between the tool inventory and the Cookies Policy.

## Enforcement: high and triplicable penalties

Violations of cookie-related requirements under the FDBR are treated as unfair trade practices, with penalties up to **US$ 50,000 per violation** (§ 501.72).

Penalties are triplicable (reaching US$ 150,000 per violation) when:

The violation involves a known Florida child.

The business continues to sell or share data after the consumer opts out.

There is a failure to delete data after an authenticated request.

The 45-day cure period is discretionary and does not apply to violations involving children.

## How AdOpt helps with the Cookies Policy under the FDBR

AdOpt's automatic scan identifies all technologies active on the site, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-essential trackers before acceptance, presents categories with clear descriptions, offers real choice options without dark patterns, and logs every interaction for audit purposes.

The system supports the configuration of FDBR-specific opt-outs, including sensitive data and voice/facial recognition.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the FDBR

**Visible link** in the site footer and within the cookie banner itself.

**Listing of cookie categories** with a description of what each one does on the site.

**Specific purpose for each category**, without vague descriptions (§ 501.711(1)(b)).

**Disclosure of targeted advertising**, including affiliated sites (§ 501.702(33)), with an accessible opt-out (§ 501.711(4)).

**Data sale declaration**, including non-monetary consideration if applicable (§ 501.702(29)).

**Notice of sensitive data sale** when applicable (§ 501.711(2)).

**Notice of biometric data sale** when applicable (§ 501.711(3)).

**Categories of data shared with third parties** via cookies (§ 501.711(1)(d)).

**Categories of third parties** that receive data via cookies (§ 501.711(1)(e)).

**Opt-out of sensitive data and geolocation** clearly described (§ 501.705(2)(f)).

**Opt-out of voice and facial recognition** described (§ 501.705(2)(g)).

**Retention period** for each category, including the 2-year limit (§ 501.719(3)).

**Non-essential cookies disabled by default**, without dark patterns (§ 501.702(11)).

**Special protection for known children** under 18 years of age (§ 501.702(17)).

**Two or more submission channels** described for opt-out requests (§ 501.709).

**Accessible language**, without legal jargon.

**No cookie walls**.

**Annual update** of the document at minimum.

## FAQ: FDBR and Cookies Policy

**1. Does the FDBR require a separate document called a "Cookies Policy"?**
Not by name. The disclosure requirements for trackers are distributed between the privacy notice (§ 501.711) and the controller's specific duties (§ 501.71). A dedicated Cookies Policy is the most organized way to meet all of these requirements in a user-accessible format.

**2. Is the FDBR's definition of targeted advertising different from other laws?**
Yes. The FDBR (§ 501.702(33)) includes ads based on activity data from affiliated or non-affiliated websites, while the VCDPA, for example, covers only non-affiliated websites. This broadens the scope of advertising practices requiring disclosure and opt-out. A retargeting campaign within the same corporate group's ecosystem may constitute targeted advertising under the FDBR.

**3. What changes for cookies when the user is a known child under 18?**
For known children between 13 and 18, their affirmative authorization is required to process sensitive data (§ 501.71(2)(d)). For children under 13, COPPA applies. A controller that willfully disregards a user's age is treated as having actual knowledge of it (§ 501.702(17)). Penalties for violations involving known children are automatically tripled.

**4. Does the FDBR require an opt-out for geolocation via cookies?**
Yes. Precise geolocation data is sensitive data under the FDBR (§ 501.702(31)(d)). The consumer has the right to opt out of the collection of sensitive data (§ 501.705(2)(f)). If the site uses location scripts that identify the user within a radius of 1,750 feet, the opt-out for this tracking must be available and described in the Cookies Policy.

**5. What are the specific penalties related to cookies under the FDBR?**
All violations can result in up to US$ 50,000 per violation (§ 501.72(1)). Penalties are triplicable for violations involving known children, continuation of sharing or selling data after consumer opt-out, and failure to delete data after an authenticated request. A cookie that continues tracking after opt-out can result in a tripled penalty for each affected consumer.

[Ready to build a Cookies Policy for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Continue learning about Florida FDBR compliance

Florida FDBR compliance rests on documents that need to agree with each other: the [privacy policy](https://goadopt.io/en/blog/florida-fdbr-privacy-policy/), which explains what you do with the data; the [privacy portal](https://goadopt.io/en/blog/florida-fdbr-dsar-privacy-portal/), which is where the consumer exercises their rights and you keep the record of it.


Florida FDBR: Cookies Policy

If the Florida Digital Bill of Rights (FDBR) applies to your business, you have specific obligations about what must be in the Privacy Policy, how it should be presented, and how often it must be updated.

This page covers one piece of the picture. For the full scope of the FDBR — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the FDBR and cookies](https://goadopt.io/en/blog/florida-fdbr-and-cookies-all-you-need-to-know/).

The FDBR (§§ 501.701 to 501.721), in effect since July 1, 2024, has one requirement that sets it apart from other US state privacy laws: the privacy notice must be updated **at least annually**, not only when there are material changes to processing practices.

This article focuses exclusively on what the FDBR requires from your Privacy Policy, point by point, based on the official text of the law.

## What the FDBR calls a Privacy Notice

The law uses the term "privacy notice." In practice, it is the Privacy Policy that most websites already have, but with specific content requirements and an annual update obligation.

§ 501.711 requires the controller to provide consumers with a privacy notice that is "reasonably accessible and clear, updated at least annually," containing six mandatory categories of information.

## What must be in the Privacy Policy under the FDBR

### 1. Categories of personal data processed

The document must list the categories of personal data the business processes, including, if applicable, any sensitive data processed (§ 501.711(1)(a)).

The FDBR is explicit in requiring specific mention of sensitive data when it is processed. This creates an additional layer of clarity compared to other state laws.

Personal data under the FDBR (§ 501.702(19)) includes any information linkable to an identified or identifiable individual, including pseudonymous data when used in conjunction with information that links the individual. Geolocation data, device identifiers, browsing history, and biometric data fall within this scope.

### 2. The purpose of processing

The document must explain what the data is used for (§ 501.711(1)(b)).

The purposes must be specific and correspond to what actually happens. § 501.71(2)(a) prohibits processing for purposes incompatible with those disclosed, except with consumer consent.

§ 501.711(5) goes further: the controller cannot collect additional categories of data or use collected data for additional purposes without providing prior notice to the consumer. Any expansion of the collection or use scope must be communicated.

### 3. How consumers exercise all seven rights

The document must describe how consumers can exercise all rights guaranteed by the FDBR (§ 501.711(1)(c)), including the appeal process.

Unlike most other state laws that guarantee five rights, the FDBR guarantees **seven**. The Privacy Policy must describe how the consumer can exercise each of them:

The right to access and confirmation.

The right to correction.

The right to deletion.

The right to portability.

The right to opt out of targeted advertising, data sale, and profiling with significant effects.

The right to opt out of collection of sensitive data, including precise geolocation.

The right to opt out of collection via voice or facial recognition features.

And how the appeal process works when a request is denied.

The [data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) must have these workflows mapped and operationally functional before publishing the document.

### 4. Categories of data shared with third parties

If the business shares data with third parties, the document must disclose which categories of data are shared (§ 501.711(1)(d)).

This covers analytics platforms, CRMs, email marketing tools, advertising networks, payment processors, and any other service that receives user data.

In the FDBR, the concept of "sale" is broader than in other laws. § 501.702(29) includes sharing for non-monetary valuable consideration in addition to monetary. A company that exchanges data with partners to receive services or other benefits may be conducting a "sale" under the FDBR definition.

### 5. Categories of third parties that receive data

In addition to the types of data, the Policy must disclose which categories of third parties receive them (§ 501.711(1)(e)).

Categories such as "digital advertising platforms," "analytics tools," "CRM systems," and "payment processors" are valid examples. Categories must be identifiable enough for the consumer to understand who accesses their data.

### 6. Description of the request submission methods

§ 501.711(1)(f) requires the Policy to describe the methods specified in § 501.709 for consumers to submit requests.

Here is a requirement specific to the FDBR: the controller must have **two or more methods** for submitting requests (§ 501.709). These methods must be secure, reliable, and clearly and conspicuously accessible. The Privacy Policy must describe all of them.

The business must also maintain a mechanism on its own website for request submission. Businesses that operate exclusively online and have a direct consumer relationship may additionally accept requests by email.

## Specific mandatory notices for sales of sensitive and biometric data

The FDBR has two specific notices that do not exist in other US state privacy laws.

If the controller engages in the sale of personal data that is sensitive data, it must display: **"NOTICE: This website may sell your sensitive personal data."** (§ 501.711(2))

If the controller engages in the sale of personal data that is biometric data, it must display: **"NOTICE: This website may sell your biometric personal data."** (§ 501.711(3))

These notices must be posted in accordance with the accessibility requirements of § 501.711(1) and are mandatory whenever these practices occur.

## Disclosure of targeted advertising and data sale

If the business sells personal data to third parties or processes it for targeted advertising, § 501.711(4) requires clear and conspicuous disclosure of this practice, along with the manner in which the consumer can opt out.

The FDBR defines targeted advertising (§ 501.702(33)) more broadly than other laws: it includes ads based on consumer activity data across **affiliated or unaffiliated** websites over time. This broadens the scope compared to laws like the [VCDPA](https://goadopt.io/en/blog/virginia-vcdpa-and-cookies-all-you-need-to-know/), which covers only non-affiliated websites.

## The mandatory annual update

§ 501.711(1) is explicit: the privacy notice must be updated **at least annually**. It is not enough to update only when there are material changes, as is common practice under other laws.

In practice, this means every company within the FDBR's scope needs an internal annual review process for the Privacy Policy, even if nothing has substantially changed in processing practices.

Situations that require immediate updates (in addition to the annual review):

Adding a new category of data collected.

Using existing data for new purposes.

New partners receiving consumer data.

Changes in data sale practices.

Introduction of new voice or facial recognition features.

## Protection of sensitive data: additional requirements

Sensitive data receives special treatment under the FDBR. The Privacy Policy must explicitly identify whether sensitive data is collected and which categories.

Under § 501.702(31), sensitive data includes: racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data for identification, known children's personal data, and precise geolocation data.

For each category of sensitive data collected, the Policy must explain how the consumer's consent is obtained and how it can be revoked.

For known children between 13 and 18, the FDBR requires their affirmative authorization (§ 501.71(2)(d)). For children under 13, COPPA applies.

## The device surveillance prohibition

§ 501.705(3) prohibits devices with voice recognition, facial recognition, video recording, audio recording, or other data collection features from being used for surveillance when not in active use by the consumer, without express authorization.

The Privacy Policy must mention this prohibition and describe how the business's devices are configured to comply with it.

## Children's data: "child" means under 18 years of age

The FDBR uses a broader definition. "Known child" (§ 501.702(17)) is any individual under **18 years of age** of whose age the controller has actual knowledge or willfully disregards.

This differs from most US laws that use 13 years as the threshold. If the site may have users under 18 whose age is known to the controller, the FDBR's special protections apply.

The Privacy Policy must describe how data of known users under 18 is treated differently.

## Data Protection Assessments

§ 501.713 requires controllers to conduct and document Data Protection Assessments for:

Processing data for targeted advertising.

Sale of personal data.

Processing for profiling with a reasonably foreseeable risk of harm.

Processing sensitive data.

Any processing presenting a heightened risk of harm.

Assessments are confidential. The Department of Legal Affairs may request access, and disclosure in response to that request does not constitute waiver of attorney-client privilege.

The Privacy Policy does not need to publish the assessments, but should communicate that the business conducts impact assessments for high-risk activities.

## Data retention: the 2-year limit

§ 501.719(3) requires adoption of a retention schedule that prohibits use or retention of personal data after:

The fulfillment of the initial collection purpose.

The expiration or termination of the contract.

**2 years after the consumer's last interaction with the controller.**

The Privacy Policy must mention the retention periods adopted for each data category and the existence of this 2-year limit.

## Enforcement and penalties

Violations of the FDBR are treated as unfair and deceptive trade practices by the Department of Legal Affairs, with penalties up to **US$ 50,000 per violation**.

Penalties are triplicable for violations involving known Florida children, failure to delete or correct data after an authenticated request, and continuation of data sale or sharing after consumer opt-out.

The 45-day cure period is discretionary. There is no guarantee it will be granted, and for violations involving children, it is not available.

## How AdOpt supports compliance with the FDBR

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the consent and opt-out mechanism works as described, including the additional rights specific to the FDBR.

Every consent interaction is logged. If the Department requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the FDBR

**Visible and accessible link** on all pages of the site.

**Updated at least annually**, even without material changes (§ 501.711(1)).

**Categories of personal data processed**, including sensitive data if applicable (§ 501.711(1)(a)).

**Purpose of processing** for each category, without vague descriptions (§ 501.711(1)(b)).

**How to exercise all 7 rights** guaranteed by the FDBR, with processes, channels, and deadlines (§ 501.711(1)(c)).

**Appeal process** described with a 60-day deadline.

**Categories of data shared with third parties** (§ 501.711(1)(d)).

**Categories of third parties** that receive data (§ 501.711(1)(e)).

**Description of the two or more submission methods** for consumer requests (§ 501.711(1)(f)).

**Notice of sensitive data sale** when applicable (§ 501.711(2)).

**Notice of biometric data sale** when applicable (§ 501.711(3)).

**Disclosure of targeted advertising or data sale** with accessible opt-out (§ 501.711(4)).

**Differentiated treatment for known children** under 18 years of age (§ 501.702(17)).

**Device surveillance prohibition** and how it is implemented (§ 501.705(3)).

**Retention periods** for each data category, including the 2-year limit (§ 501.719(3)).

**Non-discrimination policy** for consumers exercising their rights.

**Free service at least twice per year** per consumer.

## FAQ: FDBR and Privacy Policy

**1. Does the FDBR require the Privacy Policy to be updated annually even without changes?**
Yes. § 501.711(1) explicitly requires the privacy notice to be "updated at least annually." This differs from other US state privacy laws that require updates only when there are material changes. Companies within the FDBR's scope need a mandatory annual review process.

**2. What specific notices does the FDBR require that do not exist in other laws?**
The FDBR requires two specific notices. If the controller sells sensitive data, it must display: "NOTICE: This website may sell your sensitive personal data." If it sells biometric data: "NOTICE: This website may sell your biometric personal data." These notices are exclusive to the FDBR among US state privacy laws (§ 501.711(2) and (3)).

**3. How does the FDBR define "child" differently from other laws?**
The FDBR defines "known child" as any individual under 18 years of age of whose age the controller has actual knowledge or willfully disregards (§ 501.702(17)). Most other state laws use 13 years. This means businesses within the FDBR's scope need specific protections for users up to 17 years old, not just those under 13.

**4. Does the Privacy Policy need to mention the device surveillance prohibition?**
Yes. § 501.705(3) prohibits devices with voice, video, facial recognition, or other sensor features from being used for surveillance when not in active use by the consumer, without express authorization. For businesses that operate devices with these features, the Privacy Policy must describe how the prohibition is respected in practice.

**5. What happens if the Privacy Policy is not updated annually?**
The absence of an annual update constitutes a violation of § 501.711(1). The Department of Legal Affairs may grant a 45-day cure period for correction, but that period is discretionary. If not corrected, penalties reach up to US$ 50,000 per violation, potentially triplicable in specific circumstances (§ 501.72).

[Ready to build a Privacy Policy for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Continue learning about Florida FDBR compliance

Florida FDBR compliance rests on documents that need to agree with each other: the [cookies policy](https://goadopt.io/en/blog/florida-fdbr-cookies-policy/), which declares every tracker and its purpose; the [privacy portal](https://goadopt.io/en/blog/florida-fdbr-dsar-privacy-portal/), which is where the consumer exercises their rights and you keep the record of it.


Florida FDBR: Privacy Policy

The Florida Digital Bill of Rights (FDBR) guarantees seven rights to Florida consumers. For each of those rights, there is a corresponding obligation on your side: a channel to receive the request, a deadline to respond, a structured appeal process, and documentation of the entire flow.

This page covers one piece of the picture. For the full scope of the FDBR — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the FDBR and cookies](https://goadopt.io/en/blog/florida-fdbr-and-cookies-all-you-need-to-know/).

This article covers all of it: what a DSAR is under the FDBR, what the seven guaranteed rights are, how to process each type of request, the law's specific deadlines, and what happens when the process does not work as it should.

## What is a DSAR under the FDBR?

DSAR stands for Data Subject Access Request. In practice, it is any formal request from a Florida consumer to exercise the rights the FDBR (§§ 501.701 to 501.721) grants them over their own data.

The FDBR guarantees seven rights, two of which are exclusive to this law. This means that a Privacy Portal for a company within the FDBR's scope must cover more scenarios than portals configured for most other US state privacy laws.

If you are already familiar with the [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/) rights framework, the structure is familiar. The logic is the same: the consumer needs a functional channel to exercise the rights the law guarantees.

## What are the seven consumer rights under the FDBR?

Under § 501.705(2), Florida residents have the following rights:

### 1. Right to access and confirmation

The consumer may confirm whether the business processes their data and obtain a copy of the personal data the business holds, under § 501.705(2)(a).

The response must be provided in an accessible format.

### 2. Right to correction

The consumer may request correction of inaccuracies in personal data, considering the nature of the data and the purposes of processing, under § 501.705(2)(b).

The business may, if it maintains a self-service correction mechanism, direct the consumer to use it. But it must inform the consumer of this option within the response deadline (§ 501.706(3)).

### 3. Right to deletion

The consumer may request deletion of any or all data provided by or obtained about them, under § 501.705(2)(c).

The FDBR allows two forms of compliance when data was obtained from a third party (§ 501.706(6)):

Delete the data and retain only the deletion request record and the minimum data necessary to ensure the consumer's data remains deleted, without using the retained data for any other purpose.

Opt the consumer out of the processing of that data for any non-exempt purpose.

### 4. Right to portability

The consumer may obtain a copy of their data in a portable and, where technically feasible, readily usable format, if the data is available in a digital format, under § 501.705(2)(d).

### 5. Right to opt out of targeted advertising, data sale, and profiling

The consumer may refuse processing of their data for targeted advertising, sale of personal data, and profiling in furtherance of decisions with legal or similarly significant effects (§ 501.705(2)(e)).

### 6. Right to opt out of sensitive data and geolocation

The consumer may opt out of the collection of sensitive data, including precise geolocation data, or the processing of sensitive data, under § 501.705(2)(f).

This is a right exclusive to the FDBR. Sensitive data includes racial or ethnic origin, religious beliefs, health diagnosis, sexual orientation, immigration status, genetic or biometric data, known children's data, and precise geolocation (§ 501.702(31)).

### 7. Right to opt out of voice and facial recognition

The consumer may opt out of data collection via voice recognition or facial recognition features, under § 501.705(2)(g).

This is the most exclusive right of the FDBR. If the business operates voice recognition technology (virtual assistants, audio commands) or facial recognition (identity verification, expression analysis), the consumer has the right to refuse data collection via these features.

### The device surveillance prohibition

§ 501.705(3) goes beyond opt-out rights. Devices with voice, video, facial recognition, audio, or other data collection sensors cannot use these features for surveillance when not in active use by the consumer, unless they have expressly authorized it.

## What are the response deadlines?

The FDBR has deadlines that differ from other US state privacy laws.

**45 days** from receipt of an authenticated request to respond (§ 501.706(2)).

The deadline can be extended **once by 15 additional days** when reasonably necessary, considering the complexity and number of requests, as long as the consumer is notified within the initial period with the reason. The FDBR's extension period is 15 days, not 45 like other laws.

After fulfilling the request, the controller must provide **notice to the consumer within 60 days** confirming compliance (§ 501.706(4)).

**60 days** to respond to appeals (§ 501.707(3)).

Service is free **at least twice per year** per consumer (§ 501.706(5)).

## Two or more channels required for request submission

§ 501.709 requires the controller to establish **two or more methods** for submitting requests. This is a requirement exclusive to the FDBR among US state privacy laws.

The methods must be:

Secure and reliable.

Clearly and conspicuously accessible.

Appropriate for the ways consumers normally interact with the controller.

Capable of supporting authentication of the consumer's identity.

Additionally, the controller must maintain a mechanism on its own website for request submission (§ 501.709(3)). Businesses operating exclusively online with a direct consumer relationship may additionally accept requests by email.

The business cannot require consumers to create a new account to exercise their rights. It may require use of an existing account.

## How the appeal process must work

Under § 501.707, the controller must establish an appeal process that is:

Conspicuously available and easy to find.

Similar to the original request submission process.

Capable of resulting in a written response within **60 days**, including the decision and the reasoning.

The FDBR does not explicitly mention that the consumer must be informed about how to contact the Department of Legal Affairs after a denied appeal, unlike the [VCDPA](https://goadopt.io/en/blog/virginia-vcdpa-and-cookies-all-you-need-to-know/). But the business should inform consumers of available escalation channels.

## Identity verification: how to do it without creating barriers

The business needs to verify that whoever is submitting the request is the data subject. But the process cannot be a disproportionate barrier.

Under § 501.706(3), if the business cannot authenticate the request, it is not required to fulfill it, but must make a reasonable effort to request additional information reasonably necessary to authenticate the consumer and the request.

In practice:

For low-risk data: email confirmation may be sufficient.

For sensitive data or high-risk situations: a second verification factor may be justified.

What is never acceptable: disproportionate barriers relative to the type of data involved, requiring creation of a new account, or requesting more personal data than necessary to authenticate.

## Free service: at least twice per year

Service is free **at least twice per year** per consumer (§ 501.706(5)). For requests beyond that limit, or that are manifestly unfounded, excessive, or repetitive, the business may charge a reasonable fee or decline. The burden of demonstrating the excessive nature lies with the controller.

## How to process each type of DSAR in practice

### Access request

Receive and authenticate the data subject.

Locate all personal data the business holds about this consumer across all systems.

Prepare a copy in a readable and accessible format.

Include: categories of data, purposes, third parties that received the data, retention period.

Send the response within the 45-day deadline.

Send a compliance notice within 60 days (§ 501.706(4)).

### Correction request

Receive and authenticate.

Identify the inaccurate data and which systems it is stored in.

Correct in primary systems and, where applicable, notify third parties that received the data.

Confirm to the consumer that the correction was made.

If the business maintains a self-correction mechanism, it may direct the consumer to use it, but must notify within the deadline.

### Deletion request

Receive and authenticate.

Check whether a legal exception allows retaining the data.

For data obtained from third parties, choose between the two options in § 501.706(6): delete outright, or opt the consumer out of all non-exempt processing.

Notify third parties that received the data when applicable.

Confirm to the consumer what was deleted.

### Portability request

Receive and authenticate.

Generate a file with the consumer's data in a portable format, when available digitally.

Deliver to the consumer securely within the deadline.

### Opt-out of targeted advertising and data sale

Receive and authenticate.

Cease processing for targeted advertising, data sale, and profiling with significant effects without undue delay.

Configure systems to ensure this consumer is not included in those practices.

Note: continuing to sell or share data after opt-out subjects the business to **tripled penalties** (§ 501.72(1)(c)).

A [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) integrated with the business's systems automates a large part of this workflow.

### Opt-out of sensitive data and geolocation

Receive and authenticate.

Identify all sensitive data collection points on the site or in the product.

Cease collection of sensitive data for this consumer as requested.

If precise geolocation was being collected, ensure that collection stops immediately.

Document the action taken.

### Opt-out of voice and facial recognition

Receive and authenticate.

Identify all voice and camera collection features in the product.

Configure the system to not collect voice or facial recognition data from this consumer.

Document the action taken.

## What happens when the business denies a request?

The business may deny a request when:

It cannot authenticate the consumer's identity with commercially reasonable efforts.

The request is manifestly unfounded or excessive.

A legal exception justifies continued processing.

In all cases, the denial must be communicated to the consumer within the 45-day deadline (§ 501.706(3)), with:

The reason for the denial clearly stated.

Instructions on how to appeal the decision.

The appeal process must result in a written response within 60 days.

## Protection against discrimination

§ 501.71(2)(c) prohibits businesses from discriminating against consumers who exercise their rights. This includes denying products or services, charging different prices, or offering lower quality.

The exception: financial incentive programs, including payments to consumers as compensation for data processing, are permitted if the consumer gives clear prior consent to the material terms, and provided such incentives are not unjust, coercive, or unreasonable. The consent may be revoked at any time.

## Special protection: "child" means under 18 years of age

The FDBR uses a higher threshold. "Known child" (§ 501.702(17)) is any individual under **18 years of age** of whose age the controller has actual knowledge or willfully disregards.

A controller that deliberately disregards a user's age is treated as having actual knowledge of it.

For requests from known children: parents or legal guardians may exercise the seven rights on behalf of the child (§ 501.705(1)).

Penalties for violations involving known children are **automatically tripled** by the FDBR (§ 501.72(1)(a)).

## Documentation and records

Every processed request must be documented. This includes:

Date and time of receipt.

Type of request (including which of the seven rights was exercised).

Authentication process performed.

Action taken.

Date the compliance notice was sent.

In case of denial: recorded justification.

In case of appeal: complete history and final decision.

This documentation is what protects the business in the event of a Department of Legal Affairs investigation. Penalties for failure to delete or correct data after an authenticated request are tripled (§ 501.72(1)(b)).

## The FDBR cure period and DSARs

The Department of Legal Affairs may grant a **45-day cure period** before initiating action (§ 501.72(2)), but this period is **discretionary**, not guaranteed.

And there is a critical exception: **violations involving known Florida children have no cure period available** (§ 501.72(2)). The Department may initiate immediate action.

Businesses without a structured DSAR process when they receive a Department notification face significant difficulty correcting in 45 days what should have been implemented from the start.

## How AdOpt helps with the Privacy Portal under the FDBR

AdOpt logs every consent and opt-out interaction with a timestamp and unique identifier. When the consumer exercises opt-out of targeted advertising, sensitive data, or voice/facial recognition through the Privacy Portal, the system automatically updates the corresponding triggers.

AdOpt's auditable log serves as evidence that processes were completed as required by the FDBR. And when legislation changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the FDBR

**Two or more submission channels** that are secure and clearly accessible (§ 501.709).

**Mechanism on the website** for request submission (§ 501.709(3)).

**Coverage of all 7 rights** guaranteed by the FDBR, including opt-out for sensitive data and voice/facial recognition.

**Conspicuously available appeal process** similar to the original submission channel (§ 501.707).

**45-day response deadline**, with extension of only 15 additional days when necessary (§ 501.706(2)).

**Compliance notice** sent to the consumer within 60 days of fulfillment (§ 501.706(4)).

**60-day deadline** to respond to appeals (§ 501.707(3)).

**Authentication process** using commercially reasonable efforts (§ 501.706(3)).

**Free service at least twice per year** per consumer (§ 501.706(5)).

**Documented record** of each request, including which right was exercised.

**Differentiated treatment** for known children under 18 years of age (§ 501.702(17)).

**Parents and legal guardians** may exercise rights on behalf of known children (§ 501.705(1)).

**Non-discrimination protection** for consumers exercising their rights (§ 501.71(2)(c)).

## Comparison: Privacy Portal deadlines under the FDBR

| Request type | Response deadline | Extension possible |
|---|---|---|
| All 7 rights | 45 days | +15 days only (not +45) |
| Compliance notice | 60 days after fulfillment | Does not apply |
| Appeal of a decision | 60 days | Not specified |
| Cure period (general violations) | 45 days (discretionary) | No extension |
| Cure period (violations with children) | Does not exist | N/A |

## FAQ: FDBR and Privacy Portal

**1. Why does the FDBR require two or more DSAR channels while other laws require only one?**
§ 501.709 explicitly requires two or more methods for submitting requests, signaling that the Florida legislature considered a single channel insufficient for different consumer profiles. The methods must be secure, reliable, and clearly accessible, taking into account how consumers normally interact with the controller. A business could use, for example, a website form as one channel and a dedicated email address as a second.

**2. Is the FDBR's extension period really only 15 additional days?**
Yes. § 501.706(2) allows an extension of only 15 additional days beyond the initial 45 days. Other state laws like the VCDPA and [NHDPA](https://goadopt.io/en/blog/new-hampshire-nhdpa-and-cookies-all-you-need-to-know/) allow extensions of 45 additional days. This means the maximum total response period under the FDBR is 60 days, versus up to 90 days under other laws. Businesses within the FDBR's scope need more agile processes to ensure compliance.

**3. Does the FDBR have a guaranteed cure period like the VCDPA?**
No. The FDBR's 45-day cure period is discretionary (§ 501.72(2)): the Department of Legal Affairs may or may not grant it, considering the number and frequency of violations, the substantial likelihood of public harm, and the safety of persons or property. Additionally, violations involving known Florida children have no cure period available. The Department may initiate immediate action in those cases.

**4. How does the FDBR treat children differently from other laws in the context of DSARs?**
The FDBR uses an 18-year threshold for "known child" (§ 501.702(17)), not 13 as most US laws do. Parents and legal guardians may exercise all seven rights on behalf of known children (§ 501.705(1)). Violations involving known children have no cure period and penalties are automatically tripled (§ 501.72(1)(a)). A controller that deliberately disregards a user's age is treated as having actual knowledge of it.

**5. What happens if the business continues selling data after the consumer opts out?**
§ 501.72(1)(c) lists continued sale or sharing of data after consumer opt-out as one of the violations that result in **automatically tripled penalties**. Each affected consumer can be counted as a separate violation, rapidly escalating the financial exposure. The base penalty reaches US$ 50,000 per violation, triplicable to US$ 150,000. For businesses with large user bases, this can represent significant financial risk.

[Ready to build a Privacy Portal for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Continue learning about Florida FDBR compliance

Florida FDBR compliance rests on documents that need to agree with each other: the [cookies policy](https://goadopt.io/en/blog/florida-fdbr-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/florida-fdbr-privacy-policy/), which explains what you do with the data.


All posts

Colorado CPA and Cookies: All You Need to Know

Florida FDBR and Cookies: All You Need to Know

Florida FDBR: Cookies Policy

Florida FDBR: Privacy Policy

Florida FDBR: DSAR Privacy Portal