Florida

Florida's child sexual abuse material statute defines the term to include any image that has been created, altered, adapted, or modified by electronic, mechanical, or other means to portray an identifiable minor engaged in sexual conduct, reaching an AI-generated or AI-altered depiction the same as an unaltered photograph.

Using or inducing a child in a sexual performance is a first-degree felony with a 15-year mandatory minimum, or 25 years in aggravated circumstances; promoting such a performance is a second-degree felony with a 5-year mandatory minimum; and possessing with intent to promote, or knowingly soliciting, possessing, controlling, or intentionally viewing such material, is a second-degree felony.

This AI-covering definition took effect October 1, 2022, and the surrounding evidentiary criteria were further amended in 2025.

It is a third-degree felony to willfully generate, solicit, or maliciously promote a digitally, electronically, or mechanically altered sexual depiction of an identifiable person without that person's consent, and an aggrieved person may bring a civil action for injunctive relief and at least $10,000 in damages plus attorney's fees.

A 2025 amendment cited as Brooke's Law added a duty for a covered platform, one that primarily hosts user-generated content or that in the regular course of business makes such depictions available, to establish a notice-and-removal process and to remove a validly requested depiction, and known identical copies, within 48 hours; a platform's unreasonable failure to comply is treated as an unfair or deceptive trade practice under part II of chapter 501. Florida created this prohibition in 2022. Its criminal provisions were further amended in 2025.

A political advertisement, an electioneering communication, or another advertisement of a political nature that contains images, video, audio, or graphics created in whole or in part with generative AI, that appears to depict a real person performing an action that did not occur, and that was created to injure a candidate or deceive regarding a ballot issue, must carry a prominent disclaimer stating that generative AI was used.

The disclaimer's format varies by medium, and failing to include it is a first-degree misdemeanor; any person may file a complaint with the Florida Elections Commission. Chaptered as 2024-126 and signed April 29, 2024.

A covered entity, defined broadly as any commercial entity that acquires, maintains, stores, or uses personal information, with no revenue gate of any kind, must provide notice to the Department of Legal Affairs of a breach affecting 500 or more individuals in Florida as expeditiously as practicable and no later than 30 days after determining a breach occurred or having reason to believe one occurred, and must give notice to each affected Florida individual on the same 30-day deadline, extendable by 15 days on a written good-cause showing.

This statute reaches far more entities than FDBR's $1 billion-plus controller duties and must not be conflated with FDBR. Originally enacted in 2014 (ch. 2014-189/190) and amended repeatedly since, including by the same 2023 bill that created FDBR and again by ch. 2026-52 in the 2026 session; no dated original commencement is established from the codified text, so no effective date is recorded here.

The statute expressly bars a private cause of action, so a breach violation does not reach a private plaintiff, through FDUTPA or otherwise.

FDBR binds only a 'controller': a for-profit entity conducting business in Florida that collects personal data and determines the purposes and means of processing, that also makes in excess of $1 billion in global gross annual revenue and additionally either derives 50 percent or more of its global gross annual revenue from online advertising, operates a consumer smart speaker and voice command service with an integrated virtual assistant, or operates an app store or digital distribution platform offering at least 250,000 applications.

This conjunctive-then-disjunctive threshold excludes essentially every business below $1 billion in global revenue, the overwhelming majority of controllers a peer state's comprehensive act would reach. Outside this narrow platform set, Florida imposes no state-law data-minimization, purpose-limitation, or consumer-rights duty on personal-data processing at all.

Against a qualifying controller, FDBR gives a Florida consumer confirmation and access, correction, deletion of data provided by or obtained about the consumer, data portability in a readily usable digital format, opt-out of processing for targeted advertising, sale, or profiling producing a legal or similarly significant effect, opt-out of collection or processing of sensitive data including precise geolocation, and opt-out of collection of personal data through a voice or facial recognition feature.

A controller must respond without undue delay and no later than 45 days after receipt, with one 15-day extension available, shorter than the 45-plus-45 model most peer states use, and must decide an appeal of a denial within 60 days. Rights are exercisable only against a narrowly defined controller and only by a Florida-resident consumer acting outside a commercial or employment context.

A violation of FDBR is an unfair and deceptive trade practice actionable solely by the Florida Department of Legal Affairs, with a civil penalty of up to $50,000 per violation, tripled for a known-child violation, a failure to delete or correct data after a valid request, or continuing to sell or share data after an opt-out.

After written notice of an alleged violation, the Department may, but is not required to, grant a 45-day cure period and issue a letter of guidance; that cure period does not apply to a known-child violation, and no sunset date for the cure provision appears anywhere in the text reviewed. FDBR creates no private right of action.

For a qualifying controller, FDBR classifies data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, a known child's personal data, and precise geolocation data as sensitive data, which may not be processed without the consumer's prior consent.

'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, including fingerprints, voiceprints, or eye retinas or irises, but the definition carries a blanket, unconditional exclusion for physical or digital photographs, video or audio recordings, or data generated from either, with no clawback for data generated to identify someone.

A voiceprint or faceprint extracted from a recording for identification purposes is therefore categorically outside biometric, and so sensitive, data here, the opposite posture from Connecticut's and Delaware's clawback structure. A controller may not sell sensitive personal data without prior consent and must display the notice "NOTICE: This website may sell your sensitive personal data" before doing so.

Section 815.06(2) provides that a person commits an offense if he or she willfully, knowingly, and without authorization or exceeding authorization accesses or causes access to any computer, computer system, computer network, or electronic device with knowledge that such access is unauthorized or the manner of use exceeds authorization, among other prohibited acts such as denial of service, destruction of data, and introduction of malware.

Unlike a single-prong without authorization statute, section 815.06 explicitly names both prongs the Computer Fraud and Abuse Act (CFAA) is built on, the exact wording Van Buren v. United States (593 U.S. 374, 2021) narrowed for the federal statute; that holding construes the federal CFAA and does not bind a Florida court's reading of its own statute, so Florida's exceeding-authorization prong is not automatically read narrowly simply because the federal one now is.

Section 815.06(5)(a) also creates a civil remedy for the owner or lessee of the computer harmed by a violation. No Florida appellate decision squarely addresses public-page scraping under this section. The section originates in ch. 78-92 (1978), but the exceeding-authorization prong quoted above was not yet present as of the 2018 codification; it was added by section 40 of ch. 2019-167, so the section dates to that amendment's commencement rather than to the 1978 original.

Section 501.702(19) excludes publicly available information from the FDBR's definition of personal data, and section 501.702(28) defines publicly available information as information lawfully made available through government records, or information that a business has a reasonable basis for believing is lawfully made available to the general public through widely distributed media, by a consumer, or by a person to whom a consumer has disclosed the information, unless the consumer has restricted the information to a specific audience.

That added restriction clause is narrower than Connecticut's or Delaware's equivalent definitions, which carry no comparable restriction-based carve-back.

The FDBR's applicability is far narrower than its peers: section 501.702's controller definition reaches only a for-profit entity conducting business in Florida that collects or determines the purposes and means of processing personal data, makes more than $1 billion in global gross annual revenue, and additionally either derives 50% or more of global gross annual revenue from online advertising sales, operates a consumer smart speaker and voice-command service with an integrated virtual assistant, or operates an app store with 250,000 or more digital applications.

This combination reaches essentially no ordinary scraper's target and no ordinary scraping actor, only a handful of the largest technology platforms; government agencies and non-profits are separately exempt under section 501.703(2). The FDBR was created by Senate Bill 262 of the 2023 Regular Session (ch. 2023-201) and took effect July 1, 2024.

FDUTPA prohibits unfair methods of competition and unfair or deceptive acts or practices in trade or commerce, enforceable by the Florida Attorney General and by private right of action for actual damages plus attorney's fees.

In the absence of a Florida bot-disclosure or scraping-specific statute, FDUTPA is the plausible vehicle for a claim against a scraper or a scraped-data reseller whose conduct is deceptive as to origin or authenticity, though no FDUTPA decision addressing scraping specifically was located.

FDUTPA's short title and core prohibition were both enacted by ch. 73-124, Laws of Florida (1973), confirmed against flsenate.gov's own History note to section 501.201; that note, like the Florida Senate's statute pages generally for chapters this old, does not carry the day of the year, and no located session-law or secondary source supplies it, so the commencement date is left unset rather than assumed from either Florida's constitutional 60-day-after-adjournment default or a period-typical October 1 date.

Fla. Stat. 501.171(2) requires each covered entity, governmental entity, or third-party agent to take reasonable measures to protect and secure data in electronic form containing personal information; this duty explicitly names a governmental entity as a bound party in its own text.

Fla. Stat. 501.171(8) separately requires each covered entity or third-party agent, without naming a governmental entity, to take all reasonable measures to dispose of customer records containing personal information, by shredding, erasing, or otherwise rendering the information unreadable or undecipherable, once the records are no longer to be retained.

A covered entity is defined as a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information; that definition reaches a governmental entity only for the notice duty in subsections (3) through (6). Neither subsection states further content for what 'reasonable' requires beyond the general standard.

A violation of either duty is deemed an unfair or deceptive trade practice actionable only by the Department of Legal Affairs under Fla. Stat. 501.207; the section creates no private cause of action.

The $500,000-capped civil penalty Fla. Stat. 501.171(9)(b) sets applies only to a violation of the notice duty in subsection (3) or (4), so a willful violation of the data-security or disposal duty instead draws the Florida Deceptive and Unfair Trade Practices Act's general civil penalty of up to $10,000 per violation under Fla. Stat. 501.2075.

Requires a website on which more than one third of material is harmful to minors to perform reasonable age verification before granting access, using a standard method or an anonymous age verification service the visitor selects. A separate industry lawsuit challenging this provision was voluntarily dismissed in July 2025.

Bars minors under 14 from holding a social media account and requires verified parental consent for 14 and 15 year olds; covered platforms must terminate and permanently delete noncompliant minor accounts, including those a platform's own analytics flag as likely belonging to a minor.