Serves under-18s, in Florida

Fla. Stat. § 501.171(2), (8) · Read the law's page

• This binds each covered entity (a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information), each governmental entity, and each third-party agent, for the data-security duty; the disposal duty binds a covered entity or third-party agent, and its own text does not separately name a governmental entity.
• Take reasonable measures to protect and secure data in electronic form containing personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Take all reasonable measures to dispose, or arrange for the disposal, of customer records containing personal information within your custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or undecipherable through any means.
• A violation of either duty is enforced only by the Department of Legal Affairs, as an unfair or deceptive trade practice under Fla. Stat. 501.207; there is no private right of action. A willful violation draws a civil penalty of up to $10,000 under the Florida Deceptive and Unfair Trade Practices Act's general penalty provision, Fla. Stat. 501.2075; the $500,000-capped penalty Fla. Stat. 501.171(9)(b) sets applies only to a violation of the separate breach-notification duty in subsection (3) or (4).

Fla. Stat. § 501.0051 · Read the law's page

• If you are a consumer reporting agency and a representative of a protected consumer (a person younger than 16 or a person represented by a guardian or advocate under chapter 39, 393, 744 or 914) asks you to freeze the protected consumer's file, place a security freeze on the consumer report within 30 days after confirming the authenticity of the request, and where you hold no report, create a record for the protected consumer and freeze the record (Florida Statutes Section 501.0051(1)(c), (3), (4)).
• Send the representative written confirmation within 10 business days after you institute the freeze, with instructions for removing it and a unique personal identifier (Section 501.0051(5)).
• Do not state or imply to any person that a security freeze reflects a negative credit score, history or rating (Section 501.0051(6)).
• Remove a freeze within 30 days after you receive a removal request that carries the proof of identification, proof of authority and personal identifier the section requires (Section 501.0051(7)).

Fla. Stat. § 1014.04(1)(g) to (i) · Read the law's page

• If you are the state, one of its political subdivisions, another governmental entity or another institution, do not make, share or store a biometric scan of a minor child without the parent's written consent (Fla. Stat. § 1014.04(1) and (1)(g)).
• If you are the state, one of its political subdivisions, another governmental entity or another institution, do not create, store or share any record of a minor child's blood or deoxyribonucleic acid (DNA) without the parent's written consent, except as required by general law or authorized pursuant to a court order (Fla. Stat. § 1014.04(1) and (1)(h)).
• If you are the state or one of its political subdivisions, do not make a video or voice recording of a minor child without the parent's written consent, unless the recording is made during or as part of a court proceeding, as part of a forensic interview in a criminal or Department of Children and Families investigation, or solely for a safety demonstration, a legitimate academic or extracurricular activity, regular classroom instruction, security or surveillance of buildings or grounds, or a photo identification card (Fla. Stat. § 1014.04(1)(i)).

Fla. Stat. § 501.1735 · Read the law's page

• If you operate a social media platform, online game or online gaming platform that provides a service, product, game or feature likely to be predominantly accessed by children under 18, do not process a child's personal information if you have actual knowledge of, or willfully disregard, that the processing may result in substantial harm or privacy risk to children.
• Do not profile a child unless you can demonstrate appropriate safeguards and either that profiling is necessary for the feature the child is actively and knowingly using or that you have a compelling reason it poses no substantial harm or privacy risk.
• Do not collect, sell, share or retain personal information that is not necessary to provide the feature the child is actively and knowingly engaged with, and do not use it for any other reason than the one it was collected for, unless you can demonstrate a compelling reason that doing so poses no substantial harm or privacy risk to children.
• Do not collect, sell or share a child's precise geolocation data (within 1,750 feet) unless strictly necessary for the feature requested and only while necessary, and give the child an obvious sign for the duration of any collection.
• Do not use dark patterns to lead children to provide more personal information than reasonably expected, to forego privacy protections, or to take an action that may result in substantial harm or privacy risk, and do not use or keep age-estimation data for any other purpose or longer than needed.