FDBR Compliance Checklist: Florida Data Privacy

Florida Digital Bill of Rights (FDBR) compliance starts with one question most businesses can answer quickly: are you a "controller" under Fla. Stat. 501.702(9)? The core controller duties apply only to a for-profit business that makes more than $1 billion in global gross annual revenues and meets one of three big-technology prongs, so most companies are outside the central obligations. But several broader provisions reach ordinary businesses, so no Florida company should assume it has zero FDBR exposure.

As of 2026, a covered controller must publish a clear privacy notice, honor consumer rights within 45 days, obtain opt-in consent before processing sensitive data, support the sale, targeted-advertising, profiling, sensitive-data, and voice and facial recognition opt-outs, and contract properly with processors. The Florida Department of Legal Affairs enforces the FDBR with a discretionary 45-day cure period and civil penalties up to $50,000 per violation, triplable in defined cases. There is no private right of action.

Jurisdiction scope: This covers Florida's Florida Digital Bill of Rights (Fla. Stat. 501.701 et seq.). It is general legal information, not legal advice.

Step 1: Run the applicability analysis

The first step is the most decisive. The FDBR's core controller obligations apply only to a person that qualifies as a "controller" under 501.702(9). That definition requires the business to be organized for profit, to conduct business in this state, to collect personal data and determine the purposes and means of processing, to make in excess of $1 billion in global gross annual revenues, and to satisfy one of three prongs. Keep that test separate from the general applicability gate for the whole part: 501.703(1)(a) reaches a person who "conducts business in this state or produces a product or service used by residents of this state." A controller must clear both, but the controller definition itself uses only the narrower "conducts business in this state" language.

The three prongs in 501.702(9)(a)6. are: deriving 50 percent or more of global gross annual revenues from the sale of online advertisements; operating a consumer smart speaker and voice command service with an integrated virtual assistant connected to a cloud computing service; or operating an app store or digital distribution platform offering at least 250,000 different software applications.

A business that does not clear the $1 billion revenue line, or that exceeds it but fits none of the three prongs, is not a controller. Document this analysis in writing. The conclusion that you are not a controller is itself a compliance artifact worth keeping, because it explains why the core duties below do not apply to you.

Step 2: Check the broader provisions any business must heed

Concluding that you are not a controller does not end the inquiry. SB 262 created several provisions that reach businesses well beyond the $1 billion threshold, and these are where ordinary Florida companies most often have FDBR exposure.

The children's online protections in 501.1735 apply to an online platform that provides an online service, product, game, or feature likely to be predominantly accessed by children, regardless of revenue. "Online platform" is a defined term, and it is narrower than it sounds: 501.1735(1)(e) limits it to a social media platform as defined in s. 112.23(1), an online game, or an online gaming platform, so an ordinary e-commerce or content site falls outside it. Note also that 501.1735(1)(a) defines a "child" as a consumer under 18, a different trigger from the FDBR's "known child."

Within that scope, the section restricts processing a child's personal information in ways that may result in substantial harm or privacy risk, prohibits certain dark patterns, and imposes a strict-necessity rule rather than a consent rule on location data. Under 501.1735(2)(e), an online platform may not collect, sell, or share a child's precise geolocation data unless the collection is strictly necessary to provide the requested service, product, or feature, and then only for the limited time that it is necessary. Under 501.1735(2)(f), it may not collect that data without providing an obvious sign to the child for the duration of the collection. There is no consent exception, so the compliance controls here are necessity, time limits, and a visible signal, not a consent box. A social media, gaming, or online-gaming business with a youthful audience should review the section closely.

The breach-notification statute 501.171 was amended to add biometric data (as defined in 501.702) and geolocation information to the categories of personal information that trigger breach-notification duties. That broadens incident-response obligations for businesses generally. Finally, the sale-of-sensitive-data consent rule in 501.715 should be reviewed by any business that monetizes sensitive data. Map your exposure to each before assuming the FDBR does not touch you.

Step 3: Privacy notice

A covered controller must provide consumers a reasonably accessible and clear privacy notice under 501.711, updated at least annually. The notice must describe the categories of personal data the controller processes, the purposes for processing, how consumers may exercise their rights and appeal a decision, the categories of personal data the controller shares with third parties, and the categories of those third parties.

If the controller sells personal data to third parties or processes personal data for targeted advertising, the notice must clearly and conspicuously disclose that and explain how a consumer may exercise the right to opt out. The disclosure should be specific enough that a consumer can act on it, not buried in general terms of use.

If the controller sells sensitive data, 501.711(2) requires the notice to include the exact sentence "NOTICE: This website may sell your sensitive personal data." If it sells biometric data, 501.711(3) requires the exact sentence "NOTICE: This website may sell your biometric personal data." These statutory sentences must appear verbatim, not paraphrased.

Because "consent" under 501.702 excludes acceptance of general terms and the use of dark patterns, a privacy program should keep notice and consent distinct. A notice informs; consent is a separate, affirmative act. Treating a single terms-of-use acceptance as both is a common compliance gap.

Step 4: Opt-in for sensitive data, opt-outs including voice and facial recognition

A covered controller must obtain opt-in consent before processing sensitive data. Under 501.71(2)(d), a controller may not process a consumer's sensitive data without consent, and for a known child must obtain authorization from a child between 13 and 18 or comply with COPPA for a child under 13. Sensitive data under 501.702 includes health, religious, racial or ethnic, sexual orientation, immigration, genetic, biometric, known-child, and precise geolocation data.

If your business operates a search engine, 501.71(4) imposes a separate duty: publish a plain-language description of the main parameters that determine ranking, including whether political partisanship or ideology is prioritized or deprioritized, in a location that does not require a consumer to log in or register. Algorithms themselves do not need to be disclosed.

On the opt-out side, a controller must build and honor several mechanisms. Under 501.705(2)(e), consumers can opt out of the sale of personal data, targeted advertising, and profiling. Under 501.705(2)(f), consumers can opt out of the collection of sensitive data, including precise geolocation. Under 501.705(2)(g), consumers can opt out of the collection of personal data through a voice recognition or facial recognition feature.

The voice and facial recognition opt-out is the one businesses most often overlook, because it sits at the collection stage rather than the use or sale stage. A controller operating devices or features that collect voiceprints or facial geometry must give consumers a way to turn that collection off, and must not use those features for surveillance when they are not actively in use without authorization. The opt-out and opt-in mechanics are explained for consumers in the FDBR consumer rights guide.

Step 5: Consumer-request handling and processor contracts

A controller must operationalize the consumer-request lifecycle. Under 501.709(1), it must establish two or more methods for consumers to submit a request to exercise their rights under the part; a single request channel does not satisfy that express minimum. Under 501.709(2) it may not require a consumer to create a new account to exercise those rights, though it may require use of an existing account, and under 501.709(3) it must provide a mechanism on its website for a consumer to submit a request for information the part requires to be disclosed. Under 501.706(2), it must respond within 45 days, with one 15-day extension allowed when reasonably necessary. Information must be free at least twice annually per consumer, and a refusal must come with a justification and appeal instructions under 501.707.

A controller must also bind its processors. Under 501.712, a processor must adhere to the controller's instructions and assist the controller in meeting its FDBR obligations, and the relationship must be governed by a contract that sets out processing instructions, the nature and purpose of processing, the type of data, the duration, and the rights and obligations of both parties. The contract should require the processor to ensure a duty of confidentiality, delete or return data at the end of the engagement, and make available information needed to demonstrate compliance.

These contracts are a frequent enforcement focus because they allocate responsibility across the data-handling chain. A controller that relies on vendors for ad targeting, voice processing, or analytics should confirm each vendor relationship is papered to the 501.712 standard.

Step 6: Enforcement, cure period, and penalties

The Florida Department of Legal Affairs, within the Attorney General's office, has exclusive enforcement authority under 501.72. A violation of the FDBR is treated as an unfair and deceptive trade practice actionable solely by the department. Under 501.72(8), the part does not establish a private cause of action, so there is no consumer lawsuit risk under the FDBR itself.

The department may, at its discretion, grant a 45-day period to cure an alleged violation and issue a letter of guidance. Because the cure period is discretionary rather than guaranteed, a business should not count on it. The cure period is also unavailable by law for a violation involving a known child under 501.72(1)(a): 501.72(2) expressly excludes that category from the cure option, so the department can proceed straight to enforcement. Civil penalties run up to $50,000 per violation, and the department may seek injunctive relief and other remedies available under the consumer-protection chapter.

Penalties may be tripled in three defined situations under 501.72: a violation involving a Florida consumer who is a known child; a controller's failure to delete or correct a consumer's personal data after receiving an authenticated request; and a controller's continued sale or sharing of a consumer's personal data after the consumer has opted out. The penalty matrix below summarizes the enforcement structure.

The department's enforcement posture is real. Its February 2026 annual enforcement report covers January through December 2025 and shows 1,496 complaints or inquiries, 186 Notices of Alleged Violation, 64 resolved without litigation, and one active case, with no penalties yet issued or collected. That case grew out of the department's October 2025 suit against Roku alleging the company collected and sold children's viewing, voice, and geolocation data without proper parental consent or notice; Roku resolved the matter in June 2026 by committing an estimated $25 million to new parental-control and child-privacy engineering, without admitting wrongdoing or paying a civil penalty. For the law's identity, history, and the $1 billion threshold in context, see what is the FDBR.

Related guides

• Florida data privacy laws parent hub
• What is the FDBR?
• FDBR consumer rights
• State data privacy law comparison
• What is the CCPA?

More Florida Laws

• Florida Deepfake Laws
• Florida Employee Monitoring Laws
• Florida GPS Tracking Laws
• Florida Recording Laws

Frequently Asked Questions

Does my business have to comply with the Florida Digital Bill of Rights?

The core controller duties apply only if your business is for-profit, makes more than $1 billion in global gross annual revenues, and meets one of three prongs under 501.702(9): 50 percent or more revenue from online advertising, operating a consumer smart-speaker voice assistant, or operating an app store with at least 250,000 applications. Most businesses fail this test, but broader provisions like the children's protections in 501.1735 can still apply.

What is the FDBR $1 billion threshold?

Under 501.702(9), a covered controller must make in excess of $1 billion in global gross annual revenues, in addition to being for-profit and meeting one of three big-technology prongs. This revenue floor is the highest in the country for a comprehensive state privacy law and is why the FDBR's core obligations effectively target only the largest platforms.

What provisions apply to businesses under $1 billion in revenue?

Several. The children's online protections in 501.1735 apply, regardless of revenue, to an online platform (defined in 501.1735(1)(e) as a social media platform, online game, or online gaming platform) that provides a service, product, game, or feature likely to be predominantly accessed by children. The breach-notification statute 501.171 was amended to add biometric and geolocation data for businesses generally. And the sale-of-sensitive-data consent rule in 501.715 should be reviewed by any business monetizing sensitive data.

What does an FDBR privacy notice have to include?

Under 501.711, a covered controller's privacy notice must disclose the categories of personal data processed, the purposes of processing, how consumers exercise rights and appeal, the categories of data shared with third parties, and the categories of those third parties, and it must be updated at least annually. If the controller sells data or runs targeted advertising, it must clearly and conspicuously disclose that and how to opt out. A controller that sells sensitive or biometric data must also post the exact statutory notice sentence for each.

Do I need consent to collect voice or facial recognition data in Florida?

Yes for sensitive data generally. Under 501.71(2)(d), a controller must obtain opt-in consent before processing sensitive data, which includes biometric data. Separately, under 501.705(2)(g), consumers may opt out of the collection of personal data through a voice or facial recognition feature, and such features may not be used for surveillance when inactive without authorization.

How long does a controller have to honor an FDBR request?

Under 501.706(2), a controller must respond within 45 days of receiving an authenticated request, with one 15-day extension allowed when reasonably necessary. The controller must also offer two or more methods for submitting the request under 501.709(1). Information is free at least twice annually per consumer. A refusal must include the justification and instructions on how to appeal under 501.707, all within the 45-day window.

What are the penalties under the Florida Digital Bill of Rights?

Under 501.72, the Department of Legal Affairs may seek civil penalties of up to $50,000 per violation. Penalties may be tripled for violations involving a known child, a controller's failure to delete or correct after a request, or continued sale or sharing after an opt-out. The department may grant a discretionary 45-day cure period, and there is no private right of action under 501.72(8).

Is the FDBR cure period guaranteed?

No. Under 501.72, the 45-day cure period is discretionary, and 501.72(2) makes it unavailable altogether for a violation involving a known child. The Department of Legal Affairs may grant it and issue a letter of guidance for other violations, but it is not required to. A business should not assume it will get a chance to cure before penalties attach, and should build compliance proactively rather than relying on a cure window.