Florida Digital Bill of Rights, sensitive data and biometric data definitions

Fla. Stat. §§ 501.702(4), 501.702(31), 501.71(2)(d)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 July 2024.

A sensitive categories rule binding private bodies.

As of 27 August 2026.

What it requires

Obtain a qualifying Florida consumer's consent before processing sensitive data, including genetic or biometric data collected to uniquely identify the individual, if you meet FDBR's $1 billion-plus controller threshold.
Do not treat an identifier derived solely from a photograph, video, or audio recording as FDBR biometric data. The definition excludes any data generated from such a recording, with no exception for data generated to identify someone.
Display the notice "NOTICE: This website may sell your sensitive personal data" and obtain consent before selling a qualifying consumer's sensitive personal data.

What it reaches

Excludes recording-derived identifiersYes

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

For a qualifying controller, FDBR classifies data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, a known child's personal data, and precise geolocation data as sensitive data, which may not be processed without the consumer's prior consent.

'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, including fingerprints, voiceprints, or eye retinas or irises, but the definition carries a blanket, unconditional exclusion for physical or digital photographs, video or audio recordings, or data generated from either, with no clawback for data generated to identify someone.

A voiceprint or faceprint extracted from a recording for identification purposes is therefore categorically outside biometric, and so sensitive, data here, the opposite posture from Connecticut's and Delaware's clawback structure. A controller may not sell sensitive personal data without prior consent and must display the notice "NOTICE: This website may sell your sensitive personal data" before doing so.

When LexLint raises it

processes_biometrics
processes_voice
crawls_web
trains_models

Read the law

official Florida statute text, Florida Statutes, Florida Legislature

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app