Florida's approach to consumer privacy is unusual. Rather than regulating every business, the Florida Digital Bill of Rights (FDBR) targets the largest technology companies in the country. That means Floridians have some of the strongest protections in the nation when dealing with Big Tech, but may have fewer options against smaller companies. Here's what you need to know in 2026.
What Is the Florida Digital Bill of Rights?
The Florida Digital Bill of Rights, codified in SB 262, was signed into law in June 2023 and took effect on July 1, 2024. Florida Attorney General enforcement is the primary mechanism, and the AG has broad authority to investigate and penalize violators.
The FDBR is sometimes called a "Big Tech only" privacy law because of its unusually high revenue threshold. Unlike California or Texas, where most midsize businesses are covered, the FDBR only applies to companies that:
- Earn more than $1 billion in global annual gross revenue, and
- Derive 50% or more of global revenue from online advertising, or
- Operate a consumer smart speaker with a voice assistant, or
- Operate an app store or digital distribution platform with at least 250,000 applications
That's a narrow list. In practice, it covers Google, Meta, Amazon, Apple, and a handful of other tech giants. But those companies hold the vast majority of consumer data, so the law still matters enormously for Florida residents.
Your Rights as a Florida Consumer
When a covered company processes your personal data, the FDBR gives you:
- The right to know whether a business is processing your personal data.
- The right to access the personal data a business has collected about you.
- The right to correct inaccurate personal data.
- The right to delete personal data.
- The right to data portability — to obtain a copy of your data in a portable, usable format.
- The right to opt out of the sale of your data, targeted advertising, and profiling for decisions with legal or significant effects.
Covered companies must respond to your request within 45 days, with a single 45-day extension permitted if your request is unusually complex.
Florida Has Unique Biometric Protections
The FDBR is one of the only state privacy laws that explicitly gives consumers the right to opt out of the collection of personal data obtained through voice or facial recognition. If you have a smart speaker at home or use a phone with face unlock, this is a right worth exercising.
Sensitive Data Requires Opt-In Consent
Before collecting or processing sensitive categories of data, covered businesses must obtain your explicit consent. Sensitive data under the FDBR includes:
- Precise geolocation data
- Racial or ethnic origin, religious beliefs, health or sexual orientation information
- Citizenship or immigration status
- Genetic or biometric data used to identify an individual
- Personal data collected from a known child
This is a meaningful protection, especially for location data, because it forces companies to ask permission up front rather than burying consent in a terms-of-service agreement.
How to Exercise Your Rights
- Look for the privacy notice. Every covered business must publish a clear privacy notice explaining what data they collect and how to submit a request.
- Use the "Do Not Sell or Share My Personal Information" link. Covered businesses have to post this link in a conspicuous place on their website.
- Submit a verifiable request. You'll typically need to verify your identity so the business doesn't hand your data to an impersonator.
- Appeal if denied. If a business refuses your request, you have the right to appeal, and you can then file a complaint with the Florida Attorney General.
The FDBR Doesn't Cover Smaller Data Brokers
Because the law only applies to companies with more than $1 billion in annual revenue, most people-search sites, data aggregators, and mid-sized ad-tech firms are not directly regulated. Floridians still need to opt out of those sites individually to remove their personal information.
What the FDBR Doesn't Cover
The FDBR has the same sector-based exclusions you'll find in other state privacy laws. It doesn't apply to data regulated by HIPAA, the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, or the Family Educational Rights and Privacy Act. State agencies and nonprofits are also exempt.
Like other state privacy laws, there is no private right of action. You can't personally sue a company for violating the FDBR. The Florida Attorney General has exclusive authority to enforce, and penalties can reach up to $50,000 per violation, tripled for violations involving children or known willful misconduct.
Removing Your Data From Florida Data Brokers
Because the FDBR leaves most smaller data brokers unregulated, Florida residents still have the same people-search problem as everyone else. Sites like TruePeopleSearch, Whitepages, Spokeo, and dozens of regional aggregators publish Floridians' home addresses, phone numbers, relatives, and sometimes even property records. Opting out of each one individually is possible, but they typically re-scrape and re-publish within weeks.
PrivacyOn automates this process for Florida residents. We send opt-out requests to more than 100 brokers, monitor each one continuously, and re-file whenever your information reappears. Combined with exercising your FDBR rights against Big Tech, it gives you protection across both sides of the data ecosystem.
Looking Ahead
The Florida AG's office has signaled strong enforcement intent, and the Office of the Attorney General publishes an annual FDBR report highlighting compliance trends. Florida privacy law will likely expand over time as regulators learn what's working and what isn't. For now, exercise your rights against the companies the law does cover, use universal opt-out signals, and keep your footprint on unregulated data brokers as small as possible.