Operates a social platform, in Florida

Fla. Stat. § 501.171(2), (8) · Read the law's page

• This binds each covered entity (a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information), each governmental entity, and each third-party agent, for the data-security duty; the disposal duty binds a covered entity or third-party agent, and its own text does not separately name a governmental entity.
• Take reasonable measures to protect and secure data in electronic form containing personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Take all reasonable measures to dispose, or arrange for the disposal, of customer records containing personal information within your custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or undecipherable through any means.
• A violation of either duty is enforced only by the Department of Legal Affairs, as an unfair or deceptive trade practice under Fla. Stat. 501.207; there is no private right of action. A willful violation draws a civil penalty of up to $10,000 under the Florida Deceptive and Unfair Trade Practices Act's general penalty provision, Fla. Stat. 501.2075; the $500,000-capped penalty Fla. Stat. 501.171(9)(b) sets applies only to a violation of the separate breach-notification duty in subsection (3) or (4).

Fla. Stat. §§ 501.2041, 106.072 · Read the law's page

• A federal court's preliminary injunction of June 30, 2021 orders the Attorney General of Florida, the members of the Florida Elections Commission and a Deputy Secretary of the Department of Management Services to take no steps to enforce section 501.2041 or section 106.072 until otherwise ordered, so read the duties below as context for a law that those officials are enjoined from enforcing. The order is addressed to those officials, and section 501.2041(6) separately gives a user a private cause of action for violations of paragraph (2)(b) and subparagraph (2)(d)1.
• Publish the standards, including detailed definitions, you use or have used for determining how to censor, deplatform and shadow ban, and apply them in a consistent manner among your users.
• Tell each user about any change to your user rules, terms and agreements before you implement it, and do not change them more than once every 30 days.
• When you censor or shadow ban a user's content or deplatform a user, notify the user in writing, by e-mail or direct electronic notification delivered within 7 days after the censoring action, with a thorough rationale and a precise and thorough explanation of how you became aware of the content, including the algorithms used, if any, to identify or flag it. You need not notify a user whose censored content is obscene.
• Give a user, on request, the number of other individual platform participants who were shown the user's content or posts, and provide a mechanism to make the request.
• Categorize the algorithms you use for post-prioritization and shadow banning, let a user opt out of those categories to see sequential or chronological posts and content, give users an annual notice on the use of those algorithms and reoffer the opt-out annually.
• Do not apply post-prioritization or shadow banning algorithms to content posted by or about a user you know to be a candidate, from the date of qualification to the date of the election or the date the candidate ceases to be a candidate, and give each user a method to be identified as a qualified candidate that lets you confirm the qualification on the Division of Elections or supervisor of elections website. Post-prioritization based on payments by the candidate or a third party is not a violation.
• Do not willfully deplatform a candidate for office whom you know to be a candidate, from the date of qualification to the date of the election or the date the candidate ceases to be a candidate.
• Let a user you have deplatformed access or retrieve all of the user's information, content, material and data for at least 60 days after the user receives your notification.
• Do not take any action to censor, deplatform or shadow ban a journalistic enterprise based on the content of its publication or broadcast, unless the content is obscene.
• Inform a candidate of the in-kind contribution when you willfully provide free advertising for the candidate.

Fla. Stat. § 836.13 · Read the law's page

• Do not willfully generate, solicit, or maliciously promote an altered sexual depiction of an identifiable person without that person's consent; each act is a separate felony of the third degree.
• An aggrieved person may sue for injunctive relief and at least $10,000 in damages or actual damages, whichever is greater, plus attorney's fees.
• If you operate a covered platform, one that primarily hosts user-generated content or that in the regular course of business publishes, hosts, or makes available nonconsensual altered sexual depictions, establish a process for a depicted person to request removal and post a clear and conspicuous notice describing it.
• Remove a validly requested altered sexual depiction, and make reasonable efforts to remove known identical copies, within 48 hours of receiving the request.

Fla. Stat. § 501.1735 · Read the law's page

• If you operate a social media platform, online game or online gaming platform that provides a service, product, game or feature likely to be predominantly accessed by children under 18, do not process a child's personal information if you have actual knowledge of, or willfully disregard, that the processing may result in substantial harm or privacy risk to children.
• Do not profile a child unless you can demonstrate appropriate safeguards and either that profiling is necessary for the feature the child is actively and knowingly using or that you have a compelling reason it poses no substantial harm or privacy risk.
• Do not collect, sell, share or retain personal information that is not necessary to provide the feature the child is actively and knowingly engaged with, and do not use it for any other reason than the one it was collected for, unless you can demonstrate a compelling reason that doing so poses no substantial harm or privacy risk to children.
• Do not collect, sell or share a child's precise geolocation data (within 1,750 feet) unless strictly necessary for the feature requested and only while necessary, and give the child an obvious sign for the duration of any collection.
• Do not use dark patterns to lead children to provide more personal information than reasonably expected, to forego privacy protections, or to take an action that may result in substantial harm or privacy risk, and do not use or keep age-estimation data for any other purpose or longer than needed.

Fla. Stat. Sec. 501.1736 · Read the law's page

• If you run a covered social media platform, do not allow a minor under 14 to hold an account.
• Obtain verified parental consent before a 14 or 15 year old holds an account.
• Terminate and permanently delete accounts that do not comply, including accounts your own analytics flag as likely belonging to a minor.