Florida
FDBR Consumer Rights: Florida Data Privacy Rights
Independently fact-checked against primary sources (last audited August 14, 2026). · Reviewed by the RecordingLaw editorial team. · Law checked current as of August 14, 2026. · 8 primary sources cited on this page. How we verify our legal content
Under the Florida Digital Bill of Rights (FDBR), Fla. Stat. 501.705, Florida residents can confirm and access their personal data, correct inaccuracies, delete it, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling. The FDBR adds two opt-outs found in few other states: the right to opt out of the collection and processing of sensitive data including precise geolocation, and the right to opt out of the collection of personal data through a voice recognition or facial recognition feature.
As of 2026, these rights run only against businesses that meet the FDBR's narrow "controller" definition in 501.702(9), generally for-profit firms with more than $1 billion in global revenue and a big-technology profile. A controller must respond within 45 days, may take one 15-day extension, and must offer an appeal process. The Florida Department of Legal Affairs enforces the rights; there is no private right of action.
Jurisdiction scope: This covers Florida's Florida Digital Bill of Rights (Fla. Stat. 501.701 et seq.). It is general legal information, not legal advice.
The core consumer rights under 501.705
The FDBR grants Florida consumers a defined set of rights over their personal data in 501.705(2). A "consumer" under 501.702 is an individual who is a resident of or domiciled in Florida acting only in an individual or household context, which excludes commercial and employment contexts.
The first cluster of rights is access and correction. Under 501.705(2)(a), a consumer may confirm whether a controller is processing the consumer's personal data and access that data. Under 501.705(2)(b), the consumer may correct inaccuracies, taking into account the nature of the data and the purposes of processing.
The second cluster is deletion and portability. Under 501.705(2)(c), a consumer may delete any or all personal data provided by or obtained about the consumer. Under 501.705(2)(d), the consumer may obtain a copy of the personal data in a portable and, to the extent technically feasible, readily usable format if the data is available in a digital format. Florida's digital-format condition is narrower than the portability right in several other state privacy laws, which require the copy to be transmissible to another controller without hindrance.
These rights mirror the structure of other 2023-2024 state privacy laws, but the FDBR pairs them with the opt-outs below, including two that are distinctive to Florida.
The opt-out rights: advertising, sale, and profiling
Under 501.705(2)(e), a Florida consumer may opt out of the processing of personal data for the purposes of targeted advertising, the sale of personal data, and profiling in furtherance of a decision that produces legal or similarly significant effects concerning the consumer.
"Targeted advertising" is defined in 501.702(33) as displaying an advertisement to a consumer based on personal data obtained from that consumer's activities over time across affiliated or unaffiliated websites and online applications to predict preferences or interests. The only two exclusions are an ad based on the context of a consumer's current search query on the controller's own website or application, and an ad responding to the consumer's own request for information or feedback on the controller's website or application.
"Sale of personal data" is defined as the sharing, disclosing, or transferring of personal data for monetary or other valuable consideration by the controller to a third party, with specific exclusions. Because Florida uses a broad "monetary or other valuable consideration" standard, many data-sharing arrangements can count as a sale, which makes the sale opt-out a practically important right for consumers to exercise.
The voice and facial recognition collection opt-out
The FDBR's signature consumer right appears in 501.705(2)(g): a consumer may opt out of the collection of personal data collected through the operation of a voice recognition or facial recognition feature. This is unusual. Most state privacy laws regulate the use or sale of biometric data, but the FDBR lets a consumer block the collection of data through those features in the first place.
The statute pairs this with a broader limit on surveillance in 501.705(3). A device that has a voice recognition feature, a facial recognition feature, a video recording feature, an audio recording feature, or any other electronic, visual, thermal, or olfactory feature that collects data may not use those features for the purpose of surveillance by the controller, processor, or affiliate of a controller or processor when the features are not in active use by the consumer, unless the consumer expressly authorizes it.
Together, 501.705(2)(g) and the surveillance limit reflect the FDBR's central concern with always-listening and always-watching consumer technology. They are part of why the law was written to target consumer smart speakers and voice-assistant platforms through the controller definition in 501.702(9).
The sensitive-data collection opt-out and opt-in to process
Florida gives consumers two layers of control over sensitive data. Under 501.705(2)(f), a consumer may opt out of the collection of sensitive data, including precise geolocation data, or the processing of sensitive data. Separately, and as a default rather than the only route to controlling processing, 501.71(2)(d) provides that a controller may not process a consumer's sensitive data without obtaining the consumer's consent, an opt-in model.
Sensitive data is defined in 501.702 to include personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, as well as genetic or biometric data processed to uniquely identify an individual, personal data of a known child, and precise geolocation data.
"Consent" is defined as a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement, and the statute excludes acceptance of general terms of use and the use of dark patterns. For a known child, the controller must obtain authorization from a child between 13 and 18 or comply with the Children's Online Privacy Protection Act for a child under 13. The FDBR compliance checklist walks businesses through operationalizing both the opt-in and the opt-out.
How to exercise rights: response window and appeals
A consumer exercises FDBR rights by submitting an authenticated request to a controller under 501.709. Under 501.706(2), the controller must respond without undue delay and in no case later than 45 days after receipt of the request. The controller may extend the period once by an additional 15 days when reasonably necessary, taking into account the complexity and number of requests, and must inform the consumer of the extension and the reason for it within the initial 45 days.
Under 501.706, information must be provided free of charge at least twice annually per consumer. A controller may charge a reasonable fee or decline to act only where a request is manifestly unfounded, excessive, or repetitive, and it bears the burden of demonstrating that.
If a controller declines to act on a request, 501.706 requires it to inform the consumer of the justification within the 45-day window and to provide instructions on how to appeal under 501.707. The appeal mechanism in 501.707 gives the consumer a route to have the decision reviewed, and the controller must inform the consumer in writing of the outcome within 60 days of receiving the appeal. These steps are summarized below.
| Step | FDBR provision | Key detail |
|---|---|---|
| Submit request | 501.709 | Authenticated consumer request to the controller |
| Controller response | 501.706(2) | Within 45 days; one 15-day extension allowed |
| Cost | 501.706 | Free at least twice annually; fee only if manifestly unfounded or excessive |
| Refusal | 501.706 | Justification plus appeal instructions within 45 days |
| Appeal | 501.707 | Consumer may appeal a controller's refusal to act; controller must decide and notify in writing within 60 days |
| Enforcement | 501.72 | Department of Legal Affairs only; no private right of action |
Children's protections and the limits of these rights
The FDBR builds in extra protection for children. Through the sensitive-data definition, a known child's personal data is sensitive, so processing it requires consent under 501.71(2)(d), and selling it as sensitive data triggers the consent rule in 501.715. That rule reaches further than the core 501.705 rights: 501.715 binds any for-profit business that does business in Florida and collects personal data about consumers, per 501.702(9)(a)1.-3., regardless of whether it also clears the $1 billion revenue and big-technology test that gates 501.705. Separately, 501.1735 protects children on online platforms likely to be predominantly accessed by children, regardless of the controller threshold.
The most important practical limit on FDBR consumer rights is who they run against. The rights in 501.705 are owed by "controllers," and a controller under 501.702(9) must generally exceed $1 billion in global gross annual revenues and fit a big-technology prong. A consumer cannot use 501.705 to compel a small or mid-size Florida business that is not a controller to honor an access or deletion request, although other laws and the broader FDBR provisions may still apply.
Finally, these rights are enforced only by the state. Under 501.72, the Florida Department of Legal Affairs has exclusive enforcement authority, and 501.72(8) confirms that the part does not establish a private cause of action. A consumer who believes a controller has violated the FDBR can file a complaint with the Department of Legal Affairs rather than sue directly.
Related guides
- Florida data privacy laws parent hub
- What is the FDBR?
- FDBR compliance checklist
- State data privacy law comparison
- What is the CCPA?
More Florida Laws
Frequently Asked Questions
What rights do Florida consumers have under the FDBR?
Under Fla. Stat. 501.705, Florida consumers can confirm and access their personal data, correct inaccuracies, delete it, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling. The FDBR also lets consumers opt out of the collection and processing of sensitive data including precise geolocation, and the collection of personal data through a voice recognition or facial recognition feature.
Can I opt out of voice or facial recognition data collection in Florida?
Yes. Under 501.705(2)(g), a Florida consumer may opt out of the collection of personal data collected through the operation of a voice recognition or facial recognition feature. The FDBR also bars using such features for surveillance when they are not actively in use without the consumer's authorization. This is a distinctive Florida right not found in most state privacy laws.
How long does a company have to respond to an FDBR request?
Under 501.706(2), a controller must respond without undue delay and no later than 45 days after receiving the request. It may take one additional 15-day extension when reasonably necessary and must notify the consumer of the extension within the first 45 days. Responses must be free at least twice annually per consumer.
Can I appeal if a Florida company denies my privacy request?
Yes. If a controller declines to act on your request, 501.706 requires it to tell you the justification within 45 days and provide instructions on how to appeal. The appeal process is set out in 501.707, and the controller must notify you in writing of its decision within 60 days of receiving your appeal. If the appeal is denied, you can submit a complaint to the Florida Department of Legal Affairs, which enforces the FDBR.
Does the FDBR require consent for sensitive data?
Yes, in two ways. Under 501.71(2)(d), a controller may not process a consumer's sensitive data without consent, an opt-in rule. Under 501.705(2)(f), a consumer may also opt out of the collection and processing of sensitive data, including precise geolocation. Sensitive data under 501.702 includes health, religious, sexual orientation, immigration, genetic, biometric, known-child, and precise geolocation data.
Can I sue a company under the Florida Digital Bill of Rights?
No. Under 501.72(8), the FDBR does not establish a private cause of action. Enforcement is exclusive to the Florida Department of Legal Affairs under 501.72. A consumer who believes a controller violated the law can file a complaint with that office, which can pursue civil penalties of up to $50,000 per violation, triplable in defined cases.
Who has to honor FDBR consumer rights?
Only businesses that meet the controller definition in 501.702(9), generally for-profit firms with more than $1 billion in global gross annual revenues that also fit a big-technology prong (online advertising, smart-speaker voice assistant, or a 250,000-app store). Smaller Florida businesses that are not controllers are not required to honor 501.705 requests, though other laws may apply.
Is there a fee to make an FDBR data request?
Generally no. Under 501.706, a controller must provide information free of charge at least twice annually per consumer. A controller may charge a reasonable fee or decline to act only when a request is manifestly unfounded, excessive, or repetitive, and it carries the burden of demonstrating that the request meets that standard.
Updates
Corrected the description of Florida's data portability right to match the statute's actual wording, broadened the device surveillance provision to the full list of features it covers, and removed an unsupported statement that the sensitive-data opt-out revokes prior consent.
Corrected the targeted-advertising definition and the sensitive-data opt-out to match the statute's actual scope, clarified that Fla. Stat. 501.715's sale-of-sensitive-data notice duty applies below the $1 billion controller threshold, added the 60-day appeal-decision deadline under 501.707(3), and updated the cited AG enforcement report to the current Feb. 2026 edition.
Independently fact-checked against the cited primary sources; governing law re-checked for recent changes
Corrected every citation on this page that pinned the FDBR's enumerated consumer rights (access, correction, deletion, portability, and all opt-outs) to Fla. Stat. 501.705(1) instead of the correct 501.705(2), where those rights are actually enumerated (16 instances across KeyTakeaways, the section header, both rights walkthroughs, and the FAQ).
Governing law re-checked for recent changes
Reviewed and approved by an editor
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
Florida Statutes
§ 501.705Consumer rights.In forcecited in 5 of our articles
(1) A consumer is entitled to exercise the consumer rights authorized by this section at any time by submitting a request to a controller which specifies the consumer rights that the consumer wishes to exercise. With respect to the processing of personal data belonging to a known child, a parent or legal guardian of the child may exercise these rights on behalf of the child. (2) A controller shall comply with an authenticated consumer request to exercise any of the following rights:(a) To confirm whether a controller is processing the consumer’s personal data and to access the personal data. (b) To correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data. (c) To delete any or all personal data provided by or obtained about the consumer. (d) To obtain a copy of the consumer’s personal data in a portable and, to the extent technically feasible, readily usable format if the data is available in a digital format. (e) To opt out of the processing of the personal data for purposes of:1. Targeted advertising; 2. The sale of personal data; or 3.
Official text (excerpt) · last checked 2026-08-28 · Read the full text in our law library · Verify at leg.state.fl.us
Also relied on in: Florida Data Privacy Laws: Digital Bill of Rights & Breach Rules (2026), Florida Biometric Privacy Laws: Collection, Consent & Penalties (2026), FDBR Compliance Checklist: Florida Data Privacy
§ 501.706Controller response to consumer requests.In forcecited in 2 of our articles
(1) Except as otherwise provided by this part, a controller shall comply with a request submitted by a consumer to exercise the consumer’s rights pursuant to s. 501.705, as provided in this section. (2) A controller shall respond to the consumer request without undue delay, which may not be later than 45 days after the date of receipt of the request. The controller may extend the response period once by an additional 15 days when reasonably necessary, taking into account the complexity and number of the consumer’s requests, so long as the controller informs the consumer of the extension within the initial 45-day response period, together with the reason for the extension. (3) If a controller cannot take action regarding the consumer’s request, the controller must inform the consumer without undue delay, which may not be later than 45 days after the date of receipt of the request, of the justification for the inability to take action on the request and provide instructions on how to appeal the decision in accordance with s. 501.707. A controller is not required to comply with a consumer request submitted under s. 501.705 if the controller cannot authenticate the request.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at leg.state.fl.us
§ 501.707Appeal.In force
(1) A controller shall establish a process for a consumer to appeal the controller’s refusal to take action on a request within a reasonable period of time after the consumer’s receipt of the decision under s. 501.706(3). (2) The appeal process must be conspicuously available and similar to the process for initiating action to exercise consumer rights by submitting a request under s. 501.705. (3) A controller shall inform the consumer in writing of any action taken or not taken in response to an appeal under this section within 60 days after the date of receipt of the appeal, including a written explanation of the reason or reasons for the decision.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at leg.state.fl.us
§ 501.709Submitting consumer requests.In force
(1) A controller shall establish two or more methods to enable consumers to submit a request to exercise their consumer rights under this part. The methods must be secure, reliable, and clearly and conspicuously accessible. The methods must take all of the following into account:(a) The ways in which consumers normally interact with the controller. (b) The necessity for secure and reliable communications of these requests. (c) The ability of the controller to authenticate the identity of the consumer making the request. (2) A controller may not require a consumer to create a new account to exercise the consumer’s rights under this part but may require a consumer to use an existing account. (3) A controller shall provide a mechanism on its website for a consumer to submit a request for information required to be disclosed under this part. A controller that operates exclusively online and has a direct relationship with a consumer from whom the controller collects personal data may also provide an e-mail address for the submission of requests.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at leg.state.fl.us
§ 501.702Definitions.In forcecited in 4 of our articles
As used in this part, the term:(1) “Affiliate” means a legal entity that controls, is controlled by, or is under common control with another legal entity or that shares common branding with another legal entity. For purposes of this subsection, the term “control” or “controlled” means any of the following:(a) The ownership of, or power to vote, more than 50 percent of the outstanding shares of any class of voting security of a company. (b) The control in any manner over the election of a majority of the directors or of individuals exercising similar functions. (c) The power to exercise controlling influence over the management of a company. (2) “Aggregate consumer information” means information that relates to a group or category of consumers from which the identity of an individual consumer has been removed and is not reasonably capable of being directly or indirectly associated or linked with any consumer, household, or device. The term does not include information about a group or category of consumers used to facilitate targeted advertising or the display of ads online. The term does not include personal information that has been deidentified.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at leg.state.fl.us
Also relied on in: What Is the FDBR? Florida Digital Bill of Rights
§ 501.71Controller duties.In forcecited in 2 of our articles
(1) A controller shall:(a) Limit the collection of personal data to data that is adequate, relevant, and reasonably necessary in relation to the purposes for which it is processed, as disclosed to the consumer; and (b) For purposes of protecting the confidentiality, integrity, and accessibility of personal data, establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the personal data at issue. (2) A controller may not do any of the following:(a) Except as otherwise provided by this part, process personal data for a purpose that is neither reasonably necessary nor compatible with the purpose for which the personal data is processed, as disclosed to the consumer, unless the controller obtains the consumer’s consent. (b) Process personal data in violation of state or federal laws that prohibit unlawful discrimination against consumers.
Official text (excerpt) · last checked 2026-08-28 · Read the full text in our law library · Verify at leg.state.fl.us
§ 501.715Requirements for sensitive data.In forcecited in 4 of our articles
(1) A person who meets the requirements of s. 501.702(9)(a)1.-3. for the definition of a controller may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer or, if the sensitive data is of a known child, without processing that data with the affirmative authorization for such processing by a known child who is between 13 and 18 years of age or in accordance with the Children’s Online Privacy Protection Act, 15 U.S.C. ss. 6501 et seq. for a known child under the age of 13. (2) A person in subsection (1) who engages in the sale of personal data that is sensitive data must provide the following notice: “NOTICE: This website may sell your sensitive personal data.” (3) A person who violates this section is subject to the penalty imposed under s. 501.72.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at leg.state.fl.us
§ 501.72Enforcement and implementation by the Department of Legal Affairs.In forcecited in 5 of our articles
(1) A violation of this part is an unfair and deceptive trade practice actionable under part II of this chapter solely by the Department of Legal Affairs. If the department has reason to believe that a person is in violation of this section, the department may, as the enforcing authority, bring an action against such person for an unfair or deceptive act or practice. For the purpose of bringing an action pursuant to this section, ss. 501.211 and 501.212 do not apply. In addition to other remedies under part II of this chapter, the department may collect a civil penalty of up to $50,000 per violation. Civil penalties may be tripled for any of the following violations:(a) A violation involving a Florida consumer who is a known child. A controller that willfully disregards the consumer’s age is deemed to have actual knowledge of the consumer’s age. (b) Failure to delete or correct the consumer’s personal data pursuant to this section after receiving an authenticated consumer request or directions from a controller to delete or correct such personal data, unless an exception to the requirements to delete or correct such personal data under this section applies.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at leg.state.fl.us
§ 501.701Short title.In forcecited in 6 of our articles
This part may be cited as the “Florida Digital Bill of Rights.”
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at leg.state.fl.us
Also relied on in: Florida Employee Monitoring Laws: Employer Rules (2026)
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- Fla. Stat. 501.705: Consumer rights, including voice and facial recognition opt-out(flsenate.gov).gov
- Fla. Stat. 501.706: Controller response to consumer requests(flsenate.gov).gov
- Fla. Stat. 501.707: Appeal(flsenate.gov).gov
- Fla. Stat. 501.709: Submitting consumer requests(flsenate.gov).gov
- Fla. Stat. 501.71: Controller duties (sensitive data consent, nondiscrimination)(flsenate.gov).gov
- Fla. Stat. 501.702: Definitions (consumer, sensitive data, sale, targeted advertising)(flsenate.gov).gov
- Fla. Stat. 501.715: Requirements for sensitive data(flsenate.gov).gov
- Fla. Stat. 501.72: Enforcement and implementation by the Department of Legal Affairs(flsenate.gov).gov
- Florida Department of Legal Affairs: Florida Digital Bill of Rights Annual Enforcement Report (Feb. 1, 2026, covering 2025)(myfloridalegal.com)
- Fla. Stat. 501.705 (Online Sunshine, official text): consumer rights, portability in (2)(d), sensitive-data opt-out in (2)(f), device surveillance limit in (3)(leg.state.fl.us)