The Florida Digital Bill of Rights and what it means for your marketing data

A contractor who's built the same house design in Tampa doesn't get to just copy and paste that blueprint in Orlando. The wiring specs might be different. The permitting timeline is different. Even the wind load requirements change depending on how close you are to the coast. Same house, but you need a different rulebook, and skipping the local code review is how you end up tearing out drywall you just put up.

State data privacy laws work the same way for marketing teams. If you've already built your data practices around California's rules, you might assume you're covered everywhere else, too. Florida's data privacy law, the Florida Digital Bill of Rights, has its own thresholds, its own consumer rights, and its own enforcement structure, and the differences do matter for marketing teams.

Understanding where Florida's law applies, and where it doesn't shapes what data you can collect for targeted advertising, how consumers can opt out of that collection, and what your measurement approach needs to account for as more states pass their own version of this same law. Whether your business is directly covered or not, the direction is the same: less reliance on individual-level tracking, and more scrutiny on how personal data gets used.

Key takeaways

• The Florida Digital Bill of Rights (SB 262) took effect on July 1, 2024, and only applies to for-profit companies that make more than $1 billion in global gross annual revenue and meet at least one additional criterion.
• Consumers covered by the law get rights to confirm, access, correct, delete, and port their personal data, plus the right to opt out of targeted advertising, data sales, and certain profiling.
• Sensitive data, like health information, biometric data, and precise geolocation data, requires opt-in consent rather than a simple opt-out.
• Covered businesses must conduct data protection assessments for targeted advertising, profiling, data sales, and sensitive data processing.
• Only Florida's Department of Legal Affairs can enforce this law. There's no private right of action, but penalties can reach $50,000 per violation.
• Most mid-market and DTC brands fall outside FDBR's revenue threshold, but the law is part of a bigger pattern that's reshaping how marketers can collect and use consumer data nationally.
• Because trackable, consented data keeps shrinking, measurement approaches that don't depend on individual-level tracking are becoming more valuable.

What is the Florida Digital Bill of Rights?

Governor Ron DeSantis signed Senate Bill 262 into law on June 6, 2023, and its provisions took effect on July 1, 2024. The bill's actual short title, written into the statute itself, is the "Florida Digital Bill of Rights." It landed in the middle of a wave of state data privacy laws that started with the California Consumer Privacy Act and has since spread to Virginia, Colorado, Connecticut, Utah, and several other states.

Florida's law shares plenty in common with these earlier laws:

• consumer rights around personal data
• opt-out requirements for targeted advertising
• civil penalties for noncompliance

But it also sets an unusually high revenue bar for who has to comply, which means it functions less like a broad consumer protection law and more like a targeted set of rules aimed squarely at the largest technology companies operating in the state.

It also helps to know that the Digital Bill of Rights isn't the whole bill. Florida bundled it into a broader piece of legislation, the Technology Transparency Act, which does three separate things:

• One part restricts how a governmental entity can work with a social media platform on content moderation.
• Another part adds standalone protections for children online, including a rule that bars platforms from processing a child's data when they have actual knowledge that doing so creates a substantial harm or privacy risk.
• The consumer data rules covered in this guide, the actual Digital Bill of Rights, are the third and largest part, and the one that applies most directly to how marketing teams collect and use personal data.

Who has to comply with the Florida Digital Bill of Rights

It's tempting to read "$1 billion in revenue" and assume that's the whole test, but the law actually requires a business to meet that threshold and satisfy one additional condition. A company that conducts business in Florida, collects personal data about consumers, and determines how and why it processes personal data has to make more than $1 billion in global gross annual revenues before FDBR even applies. On top of all that, it also has to meet at least one of the following criteria:

• Derives 50% or more of its global gross annual revenue from online advertising sales, including targeted advertising
• Operates a consumer smart speaker or voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation
• Operates an app store or digital distribution platform that offers at least 250,000 different software applications

That combination narrows the field considerably. This law was written with a specific type of company in mind: the largest ad platforms, the major voice assistant providers, and the app store operators. A regional retailer or a fast-growing DTC brand, even one doing hundreds of millions in revenue, isn't going to meet this bar on its own.

FDBR also exempts several categories of entities outright, regardless of revenue. These include:

• State agencies and other governmental entities
• Financial institutions and data governed by the Gramm-Leach-Bliley Act
• Covered entities and business associates under the Health Insurance Portability and Accountability Act, including data tied to health care services
• Nonprofit organizations
• Postsecondary education institutions

A few other exemptions round out the list: data covered by the Fair Credit Reporting Act, data collected under the Driver's Privacy Protection Act, and data processed in a purely personal or household context are all carved out too. So is data collected solely for measuring or reporting advertising performance, reach, or frequency, which matters if your team relies on aggregate reporting metrics rather than individual-level targeting.

It's also worth knowing who doesn't count as a consumer in the first place. FDBR only protects people acting in an individual or household context, not someone acting in a commercial or employment context. If your data practices center on B2B contacts, vendors, or job applicants, those relationships fall outside this law's definition of a consumer entirely, even if the company processing that data would otherwise meet the revenue threshold.

What counts as personal data (and what counts as sensitive data)

Before you can figure out what your obligations are, you need to know what data the law actually covers. FDBR defines personal data broadly as any information that's linked or reasonably linkable to an identified or identifiable individual. That includes pseudonymous data when a company uses it alongside other information that reasonably links it back to a specific person. It doesn't include deidentified data or information that's genuinely public.

Within that broader category, the law calls out a narrower group as sensitive data, and it treats that data very differently. Sensitive data includes:

• Personal data revealing racial or ethnic origin, religious beliefs, or sexual orientation
• Citizenship or immigration status
• A mental or physical health diagnosis
• Genetic or biometric data processed to uniquely identify someone
• Personal data collected from a known child
• Precise geolocation data, meaning it's accurate to within 1,750 feet

This distinction between a consumer's sensitive data and their general personal data is the difference between an opt-out model and an opt-in one. For most personal data, businesses can collect and process it by default, as long as they disclose what they're doing and let consumers opt out later. For sensitive data, the default flips: businesses need consumer consent before they process it in the first place, and if that sensitive data belongs to a known child between 13 and 18, the child has to provide affirmative authorization, or the business has to comply with COPPA for a child under 13.

FDBR also spells out what happens once personal data gets stripped of anything that identifies a specific person. A business holding deidentified data has to take reasonable measures to make sure it stays that way, avoid trying to reidentify it except to test its own deidentification process, and contractually bind anyone it shares that data with to the same standard. Pseudonymous data gets related but distinct treatment: as long as a business keeps the information needed to reidentify someone separate and protected, most of the consumer rights and controller duties tied to a consumer's personal data don't apply to it. The same goes for aggregate consumer information, since individual identities are already stripped out of it entirely.

Consumer rights under the Florida Digital Bill of Rights

Once a business meets the controller definition, Florida residents get a specific set of rights over how their personal data gets handled. Through an authenticated consumer request, a Florida resident can:

• Confirm whether a business is processing their personal data, and access that data
• Correct inaccuracies in their personal data
• Delete personal data the business collected about them
• Obtain a portable, readily usable copy of their personal data
• Opt out of the processing of their personal data for targeted advertising, the sale of personal data, or profiling that produces a legal or similarly significant effect
• Opt out of data collection through voice recognition or facial recognition features

Businesses have to respond to these consumer requests within 45 days, with a possible 15-day extension if the request is complex. If a business can't verify who's making a request, it has to make a reasonable effort to authenticate the consumer rather than just denying the request outright. And a business can't require someone to set up a new account just to submit one of these requests; it has to let consumers use an account they already have, or offer another accessible way to submit personal data requests.

The law also takes direct aim at dark patterns, which it defines as any user interface designed with the effect of substantially undermining a consumer's autonomy or decision-making. Consent obtained through a dark pattern doesn't count as valid consent under FDBR, and neither does hovering over, muting, pausing, or closing a piece of content. This detail matters if your team is using cookie banners or consent flows that lean on visual tricks to nudge people toward "accept all."

What businesses covered by FDBR have to do

Complying with FDBR is more than just honoring consumer requests when they come in. Covered businesses have ongoing obligations that touch privacy notices, internal risk assessments, and how they work with vendors.

• Privacy notices. Businesses have to provide consumers with a clear, accessible privacy notice, updated at least once a year, that explains what personal data they collect, why they collect it, how consumers can exercise their rights, and which third parties receive that data. If a business sells sensitive data or biometric data, it has to post specific notice language that warns consumers about it up front.
• Data protection assessments. Before processing personal data for targeted advertising, profiling, or the sale of personal data, or before processing sensitive data at all, a business has to conduct and document a data protection assessment. Assessments have to cover any processing that carries a heightened risk of harm to consumers, too, not just the categories named outright. Each data protection assessment weighs the benefits of the processing against the risks to consumers, and it has to account for how the business plans to use the data going forward.
• Data security practices. Controllers have to put reasonable administrative, technical, and physical data security practices in place, sized to the amount and sensitivity of the personal data they're handling.
• Processor agreements. If a business works with a processor, meaning a vendor that processes personal data on its behalf, that relationship has to be governed by a contract that spells out how the data gets processed, how long it's retained, and what happens to it when the engagement ends.

One detail worth calling out for marketing teams specifically: the law's definition of targeted advertising doesn't include ads based on a consumer's search query on the controller's own website. So if you're showing someone a product because they just searched for it on your own site, that's not the kind of targeting FDBR is trying to regulate. It's the cross-site, over-time profiling that draws scrutiny.

Enforcement and penalties

Florida structured enforcement narrowly, and that's worth understanding if you're trying to gauge actual legal risk. The Department of Legal Affairs, which is the Florida Attorney General's office, holds sole enforcement authority. There's no private right of action, so individual consumers can't sue a business directly over an FDBR violation.

When the department finds a violation, it can grant a 45-day period to cure it before bringing an enforcement action, though that cure period doesn't apply to violations involving a known child. Civil penalties can run up to $50,000 per violation, and that number triples for violations involving a child, a failure to delete or correct personal data after a valid request, or continuing to sell a consumer's data after they've opted out.

FDBR also preempts local law. Cities and counties in Florida can't pass their own ordinances regulating the collection, processing, or sale of consumer personal data, which keeps the compliance picture consistent across the state rather than fragmented city by city.

How Florida's law compares to other state privacy laws

If your team already has a privacy program built around California's rules, it helps to see where Florida lines up and where it diverges.

The revenue threshold is the biggest structural difference between the two. California's law reaches a much wider range of businesses, while Florida's is written to catch a small number of very large technology companies.

What this means for your marketing measurement

Even if your business doesn't meet FDBR's revenue threshold, the direction of travel here is hard to miss. State data privacy laws keep multiplying, and each one adds its own layer of opt-outs, consent requirements, and restrictions on how personal data gets used for targeted advertising. Florida's law is aimed at the biggest platforms today, but the trend across every state that's passed one of these laws is the same: less consented, individually trackable data available to marketers over time.

That's a real problem for measurement approaches that depend on stitching together an individual's journey across touchpoints. Every opt-out, every consent banner someone declines, and every browser that blocks tracking by default chips away at the completeness of that picture. A marketing mix model doesn't run into that problem, because it was never built on individual-level tracking. It works from aggregate, observable outcomes, like total sales and total spend, so it holds up whether a state has a $1 billion revenue threshold or a $25 million one, and whether consumers opt out at a 5% rate or a 50% rate.

Where Prescient comes in

Privacy laws like Florida's are a preview of where every state is headed, and marketing teams that build their measurement around individual tracking are going to feel each new law as another hit to data quality. Prescient's marketing mix model was built for this reality from the start. It measures what's actually happening with your spend and your sales, including how your campaigns influence conversions through other channels, even your sales at retail locations, without needing to track a specific consumer's clicks or know whether they opted out of anything at all.

That means your measurement stays consistent as more states pass their own version of FDBR, instead of getting patchier every time a new opt-out law takes effect. Book a demo with Prescient so we can show you around our future-proof platform and what it can reveal about your marketing data.

FAQs

Does the Florida Digital Bill of Rights apply to small businesses?

No. FDBR only applies to for-profit businesses that make more than $1 billion in global gross annual revenue and meet at least one additional criterion, like deriving half their revenue from online advertising or operating a major app store. Small and mid-sized businesses, even ones doing significant revenue, fall outside this law's scope entirely.

What's the difference between the Florida Digital Bill of Rights and California's privacy law?

The biggest difference is who has to comply. California's law reaches businesses with as little as $25 million in annual revenue, while Florida's requires more than $1 billion plus an additional qualifying factor. Both laws grant similar consumer rights, like access, deletion, and opt-outs, but California's rules apply to a much wider range of companies.

Can consumers sue under the Florida Digital Bill of Rights?

No. FDBR doesn't create a private right of action, so individual consumers can't bring a lawsuit directly against a business for violating the law. Enforcement is handled exclusively by Florida's Department of Legal Affairs, which can investigate complaints and bring civil actions on a consumer's behalf.

Does the Florida Digital Bill of Rights require opt-in or opt-out consent?

It depends on the type of data. General personal data follows an opt-out model, meaning businesses can process it by default as long as they disclose their practices and let consumers opt out. Sensitive data, like health information, biometric data, and precise geolocation data, requires opt-in consent before a business can process it at all.

What happens if a company violates the Florida Digital Bill of Rights?

Florida's Department of Legal Affairs can bring an enforcement action and collect civil penalties of up to $50,000 per violation. That amount triples for violations involving a known child, a failure to delete or correct personal data, or continuing to sell a consumer's data after they've opted out. The department can also grant a 45-day period to cure a violation before pursuing enforcement, except in cases involving children.

Is the Florida Digital Bill of Rights the same as GDPR?

No, though they share some concepts, like data minimization and giving a data subject rights over their own personal data. GDPR is a European Union regulation that applies broadly to any business processing EU residents' data, regardless of revenue. FDBR applies only to a narrow set of large companies operating in Florida and doesn't include GDPR's broader opt-in consent requirements for most types of data processing.