Florida’s Digital Bill of Rights (FDBR) is not a general privacy law that gives every Florida resident rights against every company. Its controller definition combines a revenue threshold of more than $1 billion in global gross annual revenue with at least one of three specific advertising or digital-platform tests. The statute also excludes certain entities, information, and processing. Even when it applies, enforcement belongs to the Florida Department of Legal Affairs: the FDBR itself does not give consumers a private right to sue for a violation.
Does the Florida Digital Bill of Rights apply to me?
It may, if you are a Florida resident or domiciliary acting in an individual or household context and a business processing your personal data meets the law’s coverage tests. The statute does not apply to someone acting in a commercial or employment context. Whether a consumer is covered therefore depends not just on residence, but also on the organization, data, and processing involved.
As an Amazon Associate I earn from qualifying purchases.
The law is Part V of Chapter 501 of the Florida Statutes. Its applicability clause addresses people doing business in Florida, producing products or services used by Florida residents, and processing or selling personal data. That clause is only part of the analysis: the defined controller category has additional, conjunctive requirements. Read the 2025 Florida Statutes, Chapter 501, alongside the statute’s specific definitions and exclusions.
Who is covered by Florida’s Digital Bill of Rights?
A controller must be a for-profit entity doing business in Florida that collects or controls the collection of consumer personal data, determines the purposes and means of processing, exceeds $1 billion in global gross annual revenue, and meets at least one of the following additional tests:
- At least half of its global gross annual revenue comes from online advertising.
- It operates a consumer smart speaker and hands-free virtual assistant service.
- It operates an app store or digital distribution platform offering at least 250,000 consumer applications.
The definition also covers entities controlling or controlled by a controller. A business’s size alone does not establish coverage: it must meet the revenue test and one of the listed business tests, as well as the other elements in the controller definition.
“Personal data” generally means information linked or reasonably linkable to an identified or identifiable individual. The statutory definition excludes certain information, including deidentified data and publicly available information. The law also defines covered consumers by their Florida residence or domicile and individual or household context.
What rights do Florida consumers have under the FDBR?
For covered processing, consumers can submit authenticated requests to:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Confirm whether their personal data is being processed and access it.
- Correct inaccuracies in personal data.
- Delete personal data they provided or that was obtained about them.
- Obtain a copy in a portable and, when technically feasible, readily usable digital format.
Consumers can also opt out of certain processing: targeted advertising, the sale of personal data, and profiling used to further a decision with a legal or similarly significant effect. Separate opt-outs address sensitive-data processing and collection through voice or facial recognition features. A parent or legal guardian may exercise rights for a known child.
How do requests and appeals work?
The statute sets process requirements rather than an unconditional promise that every request will be fulfilled. A controller must provide at least two secure, reliable methods for submitting requests and may not require a consumer to create a new account, though it may require use of an existing account. Requests must be authenticated.
- Submit an authenticated request: Use one of the controller’s required request methods and specify the right you want to exercise.
- Wait for the response: The controller generally must respond without undue delay and no later than 45 days. It may extend that period by 15 days when the statute’s conditions are met.
- Appeal a refusal: If the controller declines the request, the consumer may appeal. The controller must provide a written response to the appeal within 60 days.
Which organizations, data, and activities are excluded?
The statute excludes several categories from its applicability provisions, including state agencies and political subdivisions; certain financial institutions and data subject to specified Gramm-Leach-Bliley Act provisions; HIPAA-governed covered entities and business associates; nonprofits; and postsecondary institutions. It also excludes purely personal or household processing and processing solely to measure or report advertising performance, reach, or frequency.
Separately, the law exempts specified information, including protected health information, health records, certain research information, certain consumer-reporting information, and data regulated under other named federal laws. These are statutory categories, not a blanket exemption for every record handled by an organization in a broadly exempt industry. For specified use exemptions, a controller or processor bears the burden of showing that the processing qualifies and meets the statute’s requirements. Section 501.704 contains the detailed lists and conditions; this summary is not exhaustive.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can I sue a company under Florida’s Digital Bill of Rights?
The FDBR itself does not create a private cause of action. Section 501.72 makes violations actionable under the Florida Deceptive and Unfair Trade Practices Act solely by the Department of Legal Affairs for this statutory enforcement mechanism. The statute states: “This part does not establish a private cause of action.” See Florida Statutes section 501.72.
Best Value
The department may seek civil penalties of up to $50,000 per violation. The statute allows tripled penalties for specified violations, including those involving known children, failures to honor certain deletion or correction requests, or continued selling or sharing after an opt-out. The department may grant a 45-day cure period for an alleged violation, but that cure period does not apply to known-child violations.
This statutory limit is not a blanket statement that no consumer could ever sue a company. The statute says noncompliance alone does not create unrelated tort, contract, or consumer-protection liability, while preserving other rights and remedies under law elsewhere in the chapter. Any separate claim would depend on an independent legal basis and its facts.
What do Florida’s latest complaint figures show?
In its annual report dated February 1, 2026, the Florida Department of Legal Affairs reported for calendar year 2025:
- 1,496 consumer complaints or inquiries received.
- 685 complaints or inquiries closed as outside the law’s scope.
- 811 complaints placed under active review.
These are complaint and review-status counts, not adjudicated violations. The figures do not establish the outcome of the active reviews or show that they resulted in enforcement actions.
When did the law and its rules take effect?
The law became effective July 1, 2024, according to the Department of Legal Affairs’ 2025 report. Florida’s administrative rules index lists four implementing rules covering authorized persons, data security, enforcement, and authenticated consumer requests; those rules have an effective date of July 18, 2024. The statute’s effective date and the rules’ effective date are distinct.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
