Florida Digital Bill of Rights (FDBR) Reference Guide

The FDBR defines a controller as a for-profit entity that does business in Florida, collects consumer data, determines the purposes and means of processing, makes more than $1 billion in global gross annual revenue, and satisfies at least one specified condition. Those conditions are: at least 50% of global annual revenue from selling online ads, operation of a qualifying consumer smart-speaker and voice assistant service, or an app store or digital distribution platform offering at least 250,000 applications. An entity that controls or is controlled by such a controller can also fall within the definition. Florida Senate: controller definition

Florida’s applicability clause adds the requirement of doing business in the state or producing a product or service used by residents and processing or selling personal data. Nonprofits, specified financial entities and data, HIPAA covered entities and business associates, postsecondary institutions, and certain categories of processing are excluded. Counsel should check the relationship among the definition, applicability clause, and exemptions. Florida Senate: applicability

The statute has no simple visitor-count threshold like many other state laws. A small retailer with Florida visitors is not automatically subject to the FDBR’s controller duties merely because it has cookies. It may still face other state or federal duties; a website scan does not decide those questions.

A covered controller must address eligible requests to access, correct, delete, or obtain portable data. Consumers may opt out of targeted advertising, sale of personal data, and profiling connected with legally or similarly significant decisions. Florida also lists rights to opt out of collecting or processing sensitive data, including precise location, and of collecting personal data through voice or facial recognition features. Florida Senate: consumer rights

The ordinary response period is 45 days, with one justified 15-day extension and timely notice. The statute separately requires notice of compliance within 60 days after receipt. A denial needs an available appeal process; a controller must respond to an appeal within 60 days. These workflows require legal and operational review beyond a browser scan. Florida Senate: responses Florida Senate: appeals

Florida defines a sale as sharing, disclosing, or transferring personal data for money or other valuable consideration, subject to enumerated exclusions. Its targeted-advertising definition includes activity over time across affiliated or unaffiliated websites and apps, a meaningful difference from some other states. Processing solely to measure advertising performance, reach, or frequency is separately excluded from this part. Classification depends on purpose and agreements, not simply on a vendor’s name. Florida Senate: controller definition Florida Senate: applicability and exclusions

A tag manager, embedded form, advertising pixel, or hard-coded script can transmit identifiers even when a banner says the visitor opted out. The technical test records network requests and cookies before and after the choice. The legal team determines which flows are within Florida’s statutory opt-out categories.

The FDBR grants direct consumer rights to opt out of sales and targeted advertising, and it requires covered controllers to offer accessible ways to submit rights requests. Unlike some state statutes, its text does not expressly require recognition of a universal GPC browser signal. A GPC-enabled test can still reveal website behavior and help maintain a consistent preference architecture across jurisdictions; it should not be presented as proof that Florida itself mandates GPC recognition. Florida Senate: consumer rights Florida Senate: request methods

Test the site’s direct opt-out first. If the same site uses GPC to implement privacy choices across states, compare its signal response too. Document which visitor action produced each result so an informational finding does not become a false Florida-specific legal claim.

The Florida Department of Legal Affairs alone enforces the FDBR. It may seek a civil penalty up to $50,000 per violation, with potential tripling for specified known-child violations, certain failures to delete or correct, or continuing to sell or share data after a consumer opts out. It may offer a discretionary 45-day cure after notice, but that opportunity does not apply to the specified known-child violation. The FDBR creates no private cause of action. Florida Senate: enforcement

A controller’s privacy notice must be clear and updated at least annually. It must make any applicable sale or targeting and opt-out method clear; special prescribed notices apply when selling sensitive or biometric personal data. The legal team should review the exact text and placement. Florida Senate: privacy notices

The legal and privacy team decides whether Florida’s narrow controller definition applies, then classifies vendors and data uses. The technical team implements the resulting choices through every script, tag, and endpoint. A shared inventory is essential to both.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, privacy notices, vendor contracts, rights-request procedures, sensitive-data obligations, and organizational governance should be handled by qualified privacy counsel.

This guide uses Florida statutory text for the narrow controller test, rights, notices, requests, assessments, and enforcement. The statute does not state a universal GPC recognition duty; we do not add one by inference. Secondary summaries are not authority for the legal claims on this page.

Prepared by Etalon Editorial Team. Last reviewed September 27, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website tracking: visitor choice, browser privacy signals, cookies, scripts, tags, and network requests. Your legal and privacy team remains responsible for FDBR applicability, exemptions, vendor classifications, notices, contracts, rights requests, assessments, minors, security, and governance.