Florida's main privacy law is the Florida Digital Bill of Rights (FDBR), effective July 1, 2024. It gives residents the right to access, correct, delete, and port their personal data and to opt out of targeted advertising and data sales — but it only binds companies with over $1 billion in annual revenue, so most data brokers are exempt.
That threshold is the single most important fact about Florida privacy law, and it is the part most summaries bury. Understanding who the FDBR actually reaches tells you which rights you can enforce and which removals you have to pursue voluntarily.
Who the FDBR Actually Covers
The FDBR was enacted as SB 262 and is deliberately narrow. A business is covered only if it makes more than $1 billion in global gross annual revenue and also meets at least one of these conditions:
- Derives 50% or more of its revenue from selling online advertising, including targeted advertising.
- Operates a consumer smart speaker or voice command service with an integrated virtual assistant.
- Operates an app store or digital distribution platform offering at least 250,000 applications.
Compare that to California, where the threshold starts around $25 million in revenue, or Colorado and Connecticut, which use record-count thresholds. Florida's bar is the highest in the country. It was designed to reach a handful of very large technology platforms — not the people-search and data broker industry.
What this means for data brokers
Spokeo, Whitepages, BeenVerified, Radaris, MyLife, and virtually every other people-search site fall far below $1 billion in revenue. They are not covered entities under the FDBR, so a Florida resident cannot force them to delete a listing by citing the statute. They must still honor their own voluntary opt-out processes — and they do — but the leverage is contractual, not statutory.
Your Rights Under the FDBR
Against a covered business, a Florida resident can:
- Access the personal data the company holds about them.
- Correct inaccuracies in that data.
- Delete personal data the company has collected.
- Obtain a portable copy in a usable format.
- Opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects.
- Withhold consent for sensitive data. Covered businesses may not sell sensitive data — including precise geolocation, biometric data, health data, and data revealing race, religion, or sexual orientation — without prior consent, and may not process a child's sensitive data without authorization consistent with COPPA.
The FDBR also carries provisions unrelated to data brokers, including restrictions on government-directed content moderation and requirements around search engine disclosure of political-content ranking.
How the Law Is Enforced
The Florida Department of Legal Affairs — the Attorney General's office — has exclusive enforcement authority. There is no private right of action, so Floridians cannot sue a company directly for an FDBR violation.
- Civil penalties reach up to $50,000 per violation.
- Penalties are tripled for violations involving consumers known to be under 18, failure to delete data after a request, or continued sale of data after an opt-out.
- The Department may offer a 45-day cure period before enforcement, except where a known child is involved.
Skip the manual work
PrivacyOn removes your personal information from 100+ data broker sites and keeps it removed — automatically.
Start your free scan★★★★★ 4.8/5 · Trusted by thousands of families
Florida's Data Breach Notification Law
Separately from the FDBR, the Florida Information Protection Act (FIPA) requires businesses to notify affected Floridians of a breach involving personal information within 30 days of discovery — one of the tighter windows in the country. Breaches affecting 500 or more Florida residents must also be reported to the Department of Legal Affairs.
How to Actually Get Your Data Deleted in Florida
Because the FDBR does not reach brokers, Floridians have to use the voluntary route — which works, but has to be maintained.
- Submit FDBR requests to the giants. Large ad platforms and app-store operators are covered; use their privacy portals and cite the FDBR.
- Use each broker's voluntary opt-out. Start with the PeopleConnect Suppression Center, Spokeo, Whitepages, and BeenVerified, then work down the long tail.
- Opt out of prescreened credit offers at optoutprescreen.com.
- Freeze your credit with all three bureaus — free under federal law.
- Re-check quarterly. Without a statutory deletion right behind you, relisting is the norm, not the exception.
Florida residents: automate the part the law does not cover
PrivacyOn removes your personal information from 100+ data broker and people-search sites, resubmits requests when brokers relist you, and adds dark web monitoring and family coverage for up to five people from $8.33/month. Start with a free scan.
Frequently Asked Questions
Does Florida have a data privacy law?
Yes. The Florida Digital Bill of Rights (SB 262) took effect July 1, 2024, giving residents rights to access, correct, delete, and port their personal data and to opt out of targeted advertising and data sales. It applies only to companies with more than $1 billion in annual revenue that also meet one of three additional criteria.
Can I force a data broker to delete my information under Florida law?
Generally no. People-search sites and data brokers fall well below the FDBR's $1 billion revenue threshold, so the statute does not reach them. You can still use each broker's voluntary opt-out process, which every major site offers free of charge.
Is the FDBR stricter than California's CCPA?
It is stricter in its sensitive-data consent rules and penalty multipliers, but far narrower in scope. California's CCPA covers businesses starting around $25 million in revenue and gives consumers a limited private right of action for certain breaches. Florida's $1 billion threshold means dramatically fewer companies are covered.
How do I file an FDBR complaint in Florida?
Submit a complaint to the Florida Department of Legal Affairs through the Attorney General's consumer complaint portal at myfloridalegal.com. The Department has exclusive enforcement authority; there is no private right of action, so you cannot sue a company yourself under the FDBR.
How quickly must a Florida company report a data breach?
Within 30 days of discovery under the Florida Information Protection Act. Breaches affecting 500 or more Florida residents must also be reported to the Department of Legal Affairs, and breaches affecting more than 1,000 residents require notice to the national consumer reporting agencies.
What is the fastest way for a Floridian to get off people-search sites?
Start with the PeopleConnect Suppression Center, which clears Intelius, TruthFinder, Instant Checkmate, and US Search in one request, then opt out of Spokeo, Whitepages, and BeenVerified individually. To cover the remaining hundred-plus brokers and catch relistings, PrivacyOn automates the requests and monitors continuously from $8.33/month.