Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Florida’s Digital Bill of Rights (FDBR) is not a general privacy law covering every Florida resident’s dealings with every company. Its consumer rights apply only when a business meets a demanding combination of revenue and platform or advertising criteria, and the law also contains entity and data exclusions. The statute is in Part V of Chapter 501 of the Florida Statutes.
Does the Florida Digital Bill of Rights apply to me?
It may, if you are a Florida resident or domiciliary acting as an individual or household consumer and the business processing your personal data qualifies as a covered controller. The statute excludes people acting in a commercial or employment context from its definition of “consumer.” Its applicability language also reaches a person doing business in Florida, or producing a product or service used by Florida residents, that processes or sells personal data—but that language does not make every such person a covered controller. The controller definition sets additional, narrower requirements. Florida Statutes, Chapter 501, Part V
“Personal data” generally means information linked or reasonably linkable to an identified or identifiable individual. The statute excludes categories such as deidentified and publicly available information.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWho is covered by Florida’s Digital Bill of Rights?
A controller must satisfy the applicable statutory elements together, not merely be a large company. In broad terms, it must be a for-profit entity doing business in Florida that collects or controls the collection of consumer personal data, determines the purposes and means of processing, has more than $1 billion in global gross annual revenue, and meets at least one of the following additional tests. The definition also includes entities controlling or controlled by a controller.
| Additional test | What the statute requires |
|---|---|
| Online advertising | At least half of global gross annual revenue comes from online advertising. |
| Smart speaker and assistant | The entity operates a specified consumer smart-speaker service integrated with a hands-free virtual assistant. |
| App store or digital distribution | The entity operates an app store or digital distribution platform offering at least 250,000 consumer applications. |
The $1 billion threshold and one of these platform or advertising tests are central to the scope. A business does not become covered simply because it handles Floridians’ data or has substantial revenue. Review the statutory definition and the current text of Part V of Chapter 501 for the full conditions.
What rights do Florida consumers have under the FDBR?
For covered processing, consumers can make authenticated requests to exercise several rights. The statute also permits a parent or legal guardian to exercise rights for a known child.
- Access: Confirm whether the controller processes the consumer’s personal data and access it.
- Correction: Correct inaccuracies in personal data, taking account of the data’s nature and processing purpose as the statute provides.
- Deletion: Request deletion of personal data provided by or obtained about the consumer.
- Portability: Obtain a copy in a portable and, when technically feasible, readily usable digital format.
- Opt out: Opt out of processing for targeted advertising, sale, or profiling that furthers a decision with a legal or similarly significant effect.
- Sensitive data and recognition features: Exercise the statute’s distinct opt-outs relating to sensitive data and data collected through voice or facial recognition features.
How do requests and appeals work?
Controllers must provide at least two secure and reliable methods for submitting consumer requests. A controller cannot require a consumer to create a new account to make a request, though it may require use of an existing account. Requests must be authenticated; the response deadlines therefore do not mean that an unauthenticated message automatically triggers fulfillment.
- Submit an authenticated request through one of the controller’s available secure methods. The statute does not prescribe one universal web form or account path for every business.
- Wait for the response. A controller generally must respond without undue delay and within 45 days. It may extend that period by 15 days when the statutory conditions for an extension are met, and must notify the consumer of the extension and its reason.
- Appeal a refusal. If the controller declines to act, the consumer may appeal through the controller’s appeal process. The controller must provide a written appeal response within 60 days.
These procedures appear in the statute’s consumer-request provisions. See Florida Statutes, Chapter 501, Part V.
What entities, information, and processing are excluded?
The law excludes several types of entities or activities, but an industry label alone does not mean every record or use is exempt. The statute’s applicability section identifies exclusions that include:
- State agencies and political subdivisions.
- Certain financial institutions and data subject to specified Gramm-Leach-Bliley Act provisions.
- HIPAA-governed covered entities and business associates.
- Nonprofit organizations and postsecondary institutions.
- Processing for purely personal or household purposes.
- Processing solely to measure or report advertising performance, reach, or frequency.
A separate provision exempts specified information, including protected health information, health records, certain research information, certain consumer-reporting information, and data regulated under other named federal laws. The lists and conditions are detailed; consult section 501.704 rather than assuming that everything held by an otherwise excluded organization is outside the statute. Where a controller or processor relies on specified use-based exemptions, the statute places the burden on it to show that the processing qualifies and meets the applicable requirements. Florida Statutes, Chapter 501, Part V
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Who enforces the law, and can a consumer sue under it?
The Florida Department of Legal Affairs enforces the FDBR through the statutory mechanism. A violation is actionable under the Florida Deceptive and Unfair Trade Practices Act solely by the Department for this purpose. The statute allows civil penalties of up to $50,000 per violation. Specified violations—including certain violations involving known children, failure to honor qualifying deletion or correction requests, or continued selling or sharing after an opt-out—may support tripled penalties. The Department may grant a 45-day cure period for an alleged violation, but that period does not apply to violations involving known children.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →For consumers, the key limitation is explicit: “This part does not establish a private cause of action.” That means the FDBR itself does not authorize a consumer lawsuit simply for violating this part. It is not a blanket statement that a company can never face a lawsuit: the statute addresses liability arising solely from noncompliance with this part while preserving other rights and remedies under law elsewhere in the chapter. Whether separate facts support another claim is a different legal question. Florida Statutes, section 501.72
Best Value
What do the reported 2025 complaint figures show?
In its annual report dated February 1, 2026, the Florida Department of Legal Affairs reported 1,496 consumer complaints or inquiries for calendar year 2025. It said 685 were closed as outside the Digital Bill of Rights’ scope and 811 were under active review. These are complaint and review-status counts—not findings of violations, and the active-review figure does not establish that enforcement actions resulted. Florida Department of Legal Affairs, 2025 Annual Report on the Digital Bill of Rights
When did the FDBR take effect?
The statute became effective July 1, 2024. Florida’s administrative-rules index lists four implementing rules covering authorized persons, data security, enforcement, and authenticated consumer requests, with an effective date of July 18, 2024. Those are separate dates: one for the statute’s effective date and another for the listed rules. Florida Department of Legal Affairs, 2025 Annual Report; Florida Administrative Code, Chapter 2-6
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
