Law / United States / 
Florida
Florida Digital Bill of Rights, general applicability and large-platform threshold
Fla. Stat. §§ 501.701, 501.702(9)
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Confirm whether you are a controller under Florida's narrow test before relying on FDBR: it binds only a for-profit entity conducting business in Florida that collects personal data, determines the purposes and means of processing, makes more than $1 billion in global gross annual revenue, and either derives 50 percent or more of that revenue from online advertising, operates a qualifying smart speaker service, or operates an app store or digital distribution platform offering at least 250,000 applications.
- Do not treat FDBR as Florida's general consumer-privacy law. Outside the $1 billion-plus platform set it defines, Florida imposes no state-law data-minimization, purpose-limitation, or consumer-rights duty under Part VI at all.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does an operator of a television or streaming device with a hands-free voice assistant "operate a consumer smart speaker and voice command component service" under Fla. Stat. § 501.702(9)(a)6.b.?
- Is an affiliate that controls or is controlled by a controller under § 501.702(9)(b) itself a controller even if it alone does not make more than $1 billion in global gross annual revenues under § 501.702(9)(a)5.?
What it makes you log
Logging duty
Section 501.701 gives the Florida Digital Bill of Rights its title and section 501.702(9) defines a controller by profit purpose, doing business in the state, collecting consumer data, determining the purposes and means of processing, more than $1 billion in global gross annual revenue and one of three business lines. Neither states that a controller must keep a log or a record. The record-like duties of the Act sit in sections this row does not cite: section 501.713 requires a controller to conduct and document a data protection assessment of targeted advertising, the sale of personal data, certain profiling, the processing of sensitive data and any processing that presents a heightened risk of harm.
- Kind
- None
- As of
What this law does
FDBR binds only a 'controller': a for-profit entity conducting business in Florida that collects personal data and determines the purposes and means of processing, that also makes in excess of $1 billion in global gross annual revenue and additionally either derives 50 percent or more of its global gross annual revenue from online advertising, operates a consumer smart speaker and voice command service with an integrated virtual assistant, or operates an app store or digital distribution platform offering at least 250,000 applications.
This conjunctive-then-disjunctive threshold excludes essentially every business below $1 billion in global revenue, the overwhelming majority of controllers a peer state's comprehensive act would reach. Outside this narrow platform set, Florida imposes no state-law data-minimization, purpose-limitation, or consumer-rights duty on personal-data processing at all.
When LexLint raises it
When your app profile says your app operates an app store or processes personal data.
Back to the example · Lint your app
Page updated .