Privacy
Florida Digital Bill of Rights
Florida does not have a broadly applicable comprehensive privacy law. The Florida Digital Bill of Rights is a comprehensive-style law, but its main controller duties apply only to for-profit businesses that do business in Florida, make more than $1 billion in global gross annual revenue, and either derive 50 percent or more of revenue from online advertising, operate a consumer smart speaker and voice command service, or operate an app store with at least 250,000 applications (Section 501.702(9)). One provision, the sensitive-data sale rule in Section 501.715, applies to any for-profit business that does business in Florida and collects personal data.
What the website needs
- A covered controller must provide a reasonably accessible and clear privacy notice, updated at least annually, listing the categories of personal data processed, the purpose, how to exercise and appeal rights, the categories of data shared with third parties and of those third parties, and the methods for submitting requests (Section 501.711(1)).
- A covered controller must provide a mechanism on its website for consumers to submit requests (Section 501.709(3)).
- A covered controller that sells personal data or processes it for targeted advertising must clearly and conspicuously disclose that processing and how to opt out (Section 501.711(4)).


