Florida Digital Bill of Rights (FDBR)

The Florida Digital Bill of Rights (FDBR) was signed into law on June 6, 2023, and takes effect on July 1, 2024. Florida's law is notably narrower in scope than other state privacy laws, targeting large businesses and specific digital platforms.

What Is the FDBR?

The FDBR establishes privacy rights for Florida consumers and places obligations on certain large businesses that collect or process personal data. It also includes specific provisions around children's privacy, social media platforms, and government censorship of online content.

Who Does the FDBR Apply To?

The FDBR applies to controllers that conduct business in Florida or target Florida consumers, and that have global annual revenues exceeding $1 billion and meet at least one of the following:

• Derive at least 50% of global annual revenue from the sale of online advertising; or
• Operate a consumer smart speaker and voice command component with an integrated virtual assistant connected to a cloud computing service; or
• Operate an app store or digital distribution platform with at least 250,000 different software applications.

This high threshold means the FDBR applies primarily to large technology companies rather than the broad range of businesses covered by laws like the GDPR or CCPA.

Consumer Rights Under the FDBR

Florida consumers are entitled to:

• Right to access: confirm whether a controller processes their personal data and request a copy
• Right to correction: request correction of inaccurate personal data
• Right to deletion: request deletion of their personal data
• Right to data portability: obtain a portable copy of their personal data
• Right to opt out: opt out of targeted advertising, sale of personal data, and profiling for significant decisions
• Right to appeal: appeal a controller's denial of a rights request

Controllers must respond to verified consumer requests within 45 days, extendable by a single additional 15 days when reasonably necessary, with notice to the consumer.

Sensitive Data and Children's Privacy

Processing sensitive data requires opt-in consent. The FDBR defines sensitive data broadly to include racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship status, genetic or biometric data, precise geolocation, and personal data of known children under 18.

Controllers are prohibited from processing the personal data of a known child for targeted advertising without verifiable parental consent.

Enforcement

The Florida Department of Legal Affairs enforces the FDBR. Civil penalties of up to $50,000 per violation may be imposed. Violations involving the personal data of a known child are subject to trebled penalties of up to $150,000 per violation, and the 45-day cure period does not apply to children's violations. There is no private right of action.

How UniConsent Supports FDBR Compliance

UniConsent provides the consent and preference management infrastructure businesses need to meet FDBR requirements:

• Opt-out and opt-in consent banners configurable by jurisdiction
• Children's data and parental consent workflows
• Consumer rights request management
• Integration with websites, mobile apps, and tag managers

Get started with UniConsent or explore our features.

Other US State Privacy Laws

• CCPA: California Consumer Privacy Act, learn more at CCPA
• CPRA: California Privacy Rights Act, learn more at CPRA
• CPA: Colorado Privacy Act, learn more at CPA
• VCDPA: Virginia Consumer Data Protection Act, learn more at VCDPA
• UCPA: Utah Consumer Privacy Act, learn more at UCPA
• CTDPA: Connecticut Data Protection Act, learn more at CTDPA
• TDPSA: Texas Data Privacy and Security Act, learn more at TDPSA
• DPDPA: Delaware Personal Data Privacy Act, learn more at DPDPA
• NHPA: New Hampshire Privacy Act, learn more at NHPA
• MTCDPA: Montana Consumer Data Privacy Act, learn more at MTCDPA

Compare different US State Privacy Laws