Florida

Florida's child sexual abuse material statute defines the term to include any image that has been created, altered, adapted, or modified by electronic, mechanical, or other means to portray an identifiable minor engaged in sexual conduct, reaching an AI-generated or AI-altered depiction the same as an unaltered photograph.

Using or inducing a child in a sexual performance is a first-degree felony with a 15-year mandatory minimum, or 25 years in aggravated circumstances; promoting such a performance is a second-degree felony with a 5-year mandatory minimum; and possessing with intent to promote, or knowingly soliciting, possessing, controlling, or intentionally viewing such material, is a second-degree felony.

This AI-covering definition took effect October 1, 2022, and the surrounding evidentiary criteria were further amended in 2025.

It is a third-degree felony to willfully generate, solicit, or maliciously promote a digitally, electronically, or mechanically altered sexual depiction of an identifiable person without that person's consent, and an aggrieved person may bring a civil action for injunctive relief and at least $10,000 in damages plus attorney's fees.

A 2025 amendment cited as Brooke's Law added a duty for a covered platform, one that primarily hosts user-generated content or that in the regular course of business makes such depictions available, to establish a notice-and-removal process and to remove a validly requested depiction, and known identical copies, within 48 hours; a platform's unreasonable failure to comply is treated as an unfair or deceptive trade practice under part II of chapter 501. Florida created this prohibition in 2022. Its criminal provisions were further amended in 2025.

A political advertisement, an electioneering communication, or another advertisement of a political nature that contains images, video, audio, or graphics created in whole or in part with generative AI, that appears to depict a real person performing an action that did not occur, and that was created to injure a candidate or deceive regarding a ballot issue, must carry a prominent disclaimer stating that generative AI was used.

The disclaimer's format varies by medium, and failing to include it is a first-degree misdemeanor; any person may file a complaint with the Florida Elections Commission. Chaptered as 2024-126 and signed April 29, 2024.

A covered entity, defined broadly as any commercial entity that acquires, maintains, stores, or uses personal information, with no revenue gate of any kind, must provide notice to the Department of Legal Affairs of a breach affecting 500 or more individuals in Florida as expeditiously as practicable and no later than 30 days after determining a breach occurred or having reason to believe one occurred, and must give notice to each affected Florida individual on the same 30-day deadline, extendable by 15 days on a written good-cause showing.

For the notice requirements in subsections (3) through (6), the term covered entity includes a governmental entity, so the duty reaches public bodies as well as commercial entities. Originally enacted in 2014 (ch. 2014-189/190) and amended repeatedly since, including by the same 2023 bill that created FDBR and again by ch. 2026-52 in the 2026 session. Chapter 2014-189, which created the section, took effect on July 1, 2014.

Subsection (10) provides that the section does not establish a private cause of action. Subsection (9) treats a violation as an unfair or deceptive trade practice in an action the Department of Legal Affairs brings under s. 501.207.

FDBR requires a controller to conduct and document a data protection assessment of each of these processing activities involving personal data: targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, the processing of sensitive data, and any processing that presents a heightened risk of harm to consumers.

Each assessment must identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the rights of the consumer, as mitigated by safeguards, and must factor in the use of deidentified data, the reasonable expectations of consumers, the context of the processing and the relationship between the controller and the consumer.

A single assessment may address a comparable set of processing operations, and an assessment conducted to comply with another law or regulation may satisfy the section if it has a reasonably comparable scope and effect. Disclosing an assessment in compliance with a request from the Attorney General under section 501.72 does not waive attorney-client privilege or work-product protection. The section applies only to processing activities generated on or after July 1, 2023.

FDBR binds only a 'controller': a for-profit entity conducting business in Florida that collects personal data and determines the purposes and means of processing, that also makes in excess of $1 billion in global gross annual revenue and additionally either derives 50 percent or more of its global gross annual revenue from online advertising, operates a consumer smart speaker and voice command service with an integrated virtual assistant, or operates an app store or digital distribution platform offering at least 250,000 applications.

This conjunctive-then-disjunctive threshold excludes essentially every business below $1 billion in global revenue, the overwhelming majority of controllers a peer state's comprehensive act would reach. Outside this narrow platform set, Florida imposes no state-law data-minimization, purpose-limitation, or consumer-rights duty on personal-data processing at all.

A health care provider that uses certified electronic health record technology must ensure that all patient information stored in an offsite physical or virtual environment, including through a third-party or subcontracted computing facility or a cloud computing service, is physically maintained in the continental United States or its territories or Canada.

Section 408.051(3) applies to all qualified electronic health records that are stored using any technology that can allow information to be electronically retrieved, accessed, or transmitted. A licensee must sign an affidavit at initial application and on each renewal attesting under penalty of perjury that it complies with section 408.051(3), and must remain in compliance or be subject to disciplinary action by the agency.

A person or entity engaged in the business of publishing or otherwise disseminating arrest booking photographs of persons who have previously been arrested may not solicit or accept a fee or other form of payment to remove the photographs. Within 10 calendar days after receiving a written removal request sent by registered mail to its registered agent, the publisher must remove the photograph without charge and may not republish it.

A person whose photograph is not removed may bring a civil action to enjoin the continued publication, and the court may impose a civil penalty of $1,000 per day for noncompliance with an injunction and shall award reasonable attorney fees and court costs. A refusal to remove a photograph after a written request, or a republication after a request, is an unfair or deceptive trade practice under part II of chapter 501.

A consumer may place a security freeze on a consumer report by making a written request by certified mail to a consumer reporting agency and including information that properly identifies the consumer. A consumer reporting agency must place the freeze no later than 5 business days after receiving the request.

Within 10 business days after instituting the freeze, the agency must send the consumer written confirmation and a unique personal identification number or password for authorizing removal of the freeze. The agency must comply with a request to temporarily lift a freeze no later than 3 business days after receiving it. The agency must remove a freeze within 3 business days after receiving the consumer's request for removal.

A freeze prohibits the agency from releasing the consumer report, credit score or any information contained within the consumer report to a third party without the express authorization of the consumer.

Rule 2-3.004 requires a controller to use a commercially reasonable method to authenticate the consumer. An authorized person who is authenticated under Rule 2-3.004 is entitled to act on a consumer's behalf to exercise the rights and protections conferred under section 501.701. The Department of Legal Affairs will not grant a 45-day period to cure for alleged violations involving a child.

Against a qualifying controller, FDBR gives a Florida consumer confirmation and access, correction, deletion of data provided by or obtained about the consumer, data portability in a readily usable digital format, opt-out of processing for targeted advertising, sale, or profiling producing a legal or similarly significant effect, opt-out of collection or processing of sensitive data including precise geolocation, and opt-out of collection of personal data through a voice or facial recognition feature.

A controller must respond without undue delay and no later than 45 days after receipt, with one 15-day extension available, shorter than the 45-plus-45 model most peer states use, and must decide an appeal of a denial within 60 days. Rights are exercisable only against a narrowly defined controller and only by a Florida-resident consumer acting outside a commercial or employment context.

Rule 69O-128.001 governs the treatment of nonpublic personal health information and nonpublic personal financial information about individuals by all licensees regulated pursuant to the Florida Insurance Code. Under rule 69O-128.005, a licensee must provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to the persons the rule lists.

Under rule 69O-128.006, a licensee must give each customer a privacy notice not less than annually during the continuation of the customer relationship. Under rule 69O-128.011, a licensee may not disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has given the consumer an initial notice, an opt out notice and a reasonable opportunity to opt out, and the consumer does not opt out.

Under rule 69O-128.017, a licensee may not disclose nonpublic personal health information about a consumer or customer unless it has obtained an authorization from that person, subject to the insurance functions the rule lists. The Office of Insurance Regulation treats a health insurer or health maintenance organization it finds in compliance, or actively undertaking compliance, with the federal Health Insurance Portability and Accountability Act (HIPAA) privacy rules as in compliance with section 626.9651.

Under section 624.4211, the office may impose a fine on an insurer in lieu of revocation or suspension of its certificate of authority, including a fine of up to $100,000 for each knowing and willful violation of a lawful order or rule of the office or commission or a provision of the Insurance Code, up to $500,000 for all such violations arising out of the same action.

A protected consumer is a person younger than 16 years of age at the time a security freeze request is made or a person represented by a guardian or other advocate under chapter 39, 393, 744 or 914. If a consumer reporting agency has no consumer report for the protected consumer when it receives a request, it must create a record for the protected consumer and place a security freeze on the record. The agency must place the freeze within 30 days after confirming the authenticity of the request.

The agency must send written confirmation to the representative within 10 business days after instituting the freeze, with instructions for removing it and a unique personal identifier. The agency must remove a freeze within 30 days after receiving a removal request from a protected consumer or the representative. The agency may not state or imply to any person that a security freeze reflects a negative credit score, a negative credit history, or a negative credit rating.

A violation of FDBR is an unfair and deceptive trade practice actionable solely by the Florida Department of Legal Affairs, with a civil penalty of up to $50,000 per violation, tripled for a known-child violation, a failure to delete or correct data after a valid request, or continuing to sell or share data after an opt-out.

After written notice of an alleged violation, the Department may, but is not required to, grant a 45-day cure period and issue a letter of guidance; that cure period does not apply to a known-child violation, and no sunset date for the cure provision appears anywhere in the text reviewed. FDBR creates no private right of action.

For a qualifying controller, FDBR classifies data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, a known child's personal data, and precise geolocation data as sensitive data, which may not be processed without the consumer's prior consent.

'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, including fingerprints, voiceprints, or eye retinas or irises, but the definition carries a blanket, unconditional exclusion for physical or digital photographs, for video or audio recordings, and for data generated from video or audio recordings, with no clawback for data generated to identify someone.

A voiceprint or faceprint extracted from a video or audio recording for identification purposes is therefore categorically outside biometric, and so sensitive, data here, the opposite posture from Connecticut's and Delaware's clawback structure. The exclusion names the photograph itself but names no data generated from a photograph.

A controller may not sell sensitive personal data without prior consent and must display the notice "NOTICE: This website may sell your sensitive personal data" before doing so.

Under section 627.4301, a health insurer, life insurer or long-term care insurer authorized to transact insurance in Florida may not, in the absence of a diagnosis of a condition related to genetic information, cancel, limit or deny coverage, or establish differentials in premium rates, based on that information.

Under section 627.4301, a health insurer, life insurer or long-term care insurer may not require or solicit genetic information, use genetic test results, or consider a person's decisions or actions relating to genetic testing in any manner for any insurance purpose.

Section 627.4301 does not apply to accident-only, hospital indemnity, fixed indemnity, dental or vision policies, and does not prevent a life or long-term care insurer from accessing a medical record as part of an application exam or from considering a diagnosis in the record. Chapter 2020-159 added life insurers and long-term care insurers to the section's prohibitions. Chapter 2020-159 applies to policies entered into or renewed on or after January 1, 2021.

Under section 624.4211, the office may impose a fine on an insurer in lieu of revocation or suspension of its certificate of authority, including a fine of up to $100,000 for each knowing and willful violation of a lawful order or rule of the office or commission or a provision of the Insurance Code, up to $500,000 for all such violations arising out of the same action.

Except as the section provides, the identity of any person upon whom an HIV test has been performed and the test results are confidential. No person who has obtained or has knowledge of a test result may disclose or be compelled to disclose the identity of the person tested, or the results in a manner that permits identification, except to the persons the paragraph lists. A general release without prior written authorization is not sufficient to release HIV test results.

Patient records may not be furnished to, and a patient's medical condition may not be discussed with, any person other than the patient, the patient's legal representative, or other health care practitioners and providers involved in the patient's care or treatment, except upon written authorization from the patient or in the circumstances the section lists.

Under section 456.057, absent a specific written release or authorization, any use of patient information for solicitation or marketing the sale of goods or services is prohibited. A practitioner must, on request of the patient or the patient's legal representative, furnish in a timely manner copies of all reports and records relating to the examination or treatment. Section 456.057 does not apply to facilities licensed under chapter 395.

A licensee in violation of section 456.057 is disciplined by the appropriate licensing authority, and the Attorney General may enforce the section against records owners not otherwise licensed by the state through injunctive relief and fines not to exceed $5,000 per violation. Chapter 2026-165 amended paragraph (a) of subsection (7) of section 456.057.

Chapter 2026-165 requires records the Department of Children and Families requests under section 39.301(9)(a) to be furnished to it within 14 days after the request. Chapter 2026-165 takes effect July 1, 2026. The provisions this entry describes came into force on different days.

Patient records of a licensed facility are confidential and must not be disclosed without the consent of the patient or the patient's legal representative, except to the persons and for the purposes the subsection lists.

Under section 395.3025, a recipient of the content of a patient treatment record other than the patient or the patient's representative may use it only for the purpose provided and may not further disclose it unless the patient expressly consents in writing, and a general authorization for the release of medical information is not sufficient.

Under section 395.3025, absent a specific written release or authorization, any use of patient information for solicitation or marketing the sale of goods or services is prohibited.

A licensed facility must, on written request and after discharge of the patient, furnish a true and correct copy of all patient records, including X rays and insurance information, to the patient or the patient's guardian, representative, next of kin or a person the patient designates in writing, on payment of the charge the section sets.

Section 395.3025 does not apply to records of a facility whose primary function is psychiatric care, to records of treatment for a mental or emotional condition governed by section 394.4615, or to records of substance abuse impaired persons governed by section 397.501. Section 395.3025 is in part I of chapter 395, which runs from section 395.001 through section 395.3042.

Under section 395.1065, the agency may impose an administrative fine, not to exceed $1,000 per violation, per day, for the violation of any provision of this part, part II of chapter 408, or applicable rules. No day on which the section came into force has been located.

Under section 760.40, a person or entity may perform DNA analysis only with express consent, and the results are the exclusive property of the person tested, are confidential, and may not be disclosed without express consent.

Under section 760.40, a person who performs DNA analysis or receives its results must notify the person tested that the analysis was performed or the information received, that it will be made available to the person's physician on request, and whether it was used in any decision to grant or deny insurance, employment, a mortgage, a loan, credit, or an educational opportunity.

Under section 817.5655, it is a first-degree misdemeanor to collect or retain another person's DNA sample willfully and without express consent with the intent to perform DNA analysis, a third-degree felony to submit a sample for analysis, conduct or procure the analysis, or disclose the results to a third party willfully and without express consent, and a second-degree felony to sell or transfer the sample or results to a third party.

Under section 817.5655, each instance of collection or retention, submission or analysis, or disclosure in violation of the section is a separate violation for which a separate penalty is authorized.

Sections 760.40 and 817.5655 do not apply to a DNA sample or analysis used for criminal investigation or prosecution, complying with a subpoena, court order or federal law, medical diagnosis and treatment of a patient in the circumstances listed, the newborn screening program, determining paternity, or research under the federal rules listed.

Sections 760.40 and 817.5655 apply only to a DNA sample collected from a person in Florida, and to use, retention, maintenance and disclosure of that person's DNA sample or the results of a DNA analysis after the effective date of the act. Section 760.40 was created by chapter 92-101 and most recently amended by chapter 2021-216.

Section 501.1735 binds an online platform that provides an online service, product, game or feature likely to be predominantly accessed by children. Section 501.1735 defines a child as a consumer under 18 years of age. Section 501.1735 defines an online platform as a social media platform as defined in section 112.23(1), an online game or an online gaming platform.

Under section 501.1735, an online platform likely to be predominantly accessed by children may not process a child's personal information if it has actual knowledge of or willfully disregards that the processing may result in substantial harm or privacy risk to children.

Under section 501.1735, an online platform likely to be predominantly accessed by children may not collect, sell, share or retain personal information that is not necessary to provide the service, product or feature with which a child is actively and knowingly engaged, unless it can demonstrate a compelling reason that doing so does not pose a substantial harm or privacy risk to children.

Under section 501.1735, an online platform bears the burden of demonstrating that its processing does not violate the prohibitions. A violation of section 501.1735 is an unfair and deceptive trade practice actionable solely by the Department of Legal Affairs, which may collect a civil penalty of up to $50,000 per violation, tripled for a violation involving a Florida child the platform knows is under 18 years of age.

Under section 501.1735, after written notice of an alleged violation the Department of Legal Affairs may in its discretion grant a 45-day period to cure. Chapter 2023-262 amended section 501.1735 to provide exemptions from public records requirements. Chapter 2026-52 amended paragraph (d) of subsection (6) of section 501.1735, which defines proprietary information for the public records exemption.

Section 1006.1494 binds an operator of an Internet website, online service, online application or mobile application with actual knowledge that it is used primarily for K-12 school purposes, or that was designed and marketed for K-12 school purposes.

Under section 1006.1494, an operator may not knowingly engage in targeted advertising based on information acquired through the K-12 service, use covered information to amass a profile of a student except in furtherance of K-12 school purposes, share, sell or rent a student's information, or disclose covered information except for the purposes the section lists.

Under section 1006.1494, an operator must collect no more covered information than is reasonably necessary, maintain reasonable security procedures and practices, and, unless a parent or guardian expressly consents to retention, delete covered information at the conclusion of the course or program and no later than 90 days after the student is no longer enrolled in a school within the district, upon notice by the school district.

Section 1006.1494 does not apply to general audience Internet websites, online services, online applications or mobile applications. A violation of section 1006.1494 is a deceptive and unfair trade practice under the Florida Deceptive and Unfair Trade Practices Act, and the Department of Legal Affairs is the sole entity authorized to bring an enforcement action.

Section 815.06(2) provides that a person commits an offense if he or she willfully, knowingly, and without authorization or exceeding authorization accesses or causes access to any computer, computer system, computer network, or electronic device with knowledge that such access is unauthorized or the manner of use exceeds authorization, among other prohibited acts such as denial of service, destruction of data, and introduction of malware.

Section 815.06(5)(a) also lets the owner or lessee of the computer, computer system, computer network, computer program, computer equipment or supplies, electronic device, or computer data bring a civil action for compensatory damages against a person convicted under the section.

The section originates in ch. 78-92 (1978) and was last amended by section 40 of ch. 2019-167, which took effect October 1, 2019, so its current text dates to that amendment's commencement rather than to the 1978 original.

Section 501.702(19) excludes publicly available information from the FDBR's definition of personal data, and section 501.702(28) defines publicly available information as information lawfully made available through government records, or information that a business has a reasonable basis for believing is lawfully made available to the general public through widely distributed media, by a consumer, or by a person to whom a consumer has disclosed the information, unless the consumer has restricted the information to a specific audience.

Section 501.702(9) defines a controller as a for-profit entity that conducts business in Florida, collects personal data about consumers or is the entity on behalf of which such information is collected, determines the purposes and means of processing personal data about consumers alone or jointly with others, makes in excess of $1 billion in global gross annual revenues, and additionally derives 50 percent or more of its global gross annual revenues from the sale of advertisements online, operates a consumer smart speaker and voice command component service with an integrated virtual assistant, or operates an app store or digital distribution platform that offers at least 250,000 different software applications; any entity that controls or is controlled by a controller is also a controller.

The FDBR was created by Senate Bill 262 of the 2023 Regular Session (ch. 2023-201) and took effect July 1, 2024.

FDUTPA declares unlawful unfair methods of competition, unconscionable acts or practices, and unfair or deceptive acts or practices in the conduct of any trade or commerce, enforceable by the state attorneys and the Department of Legal Affairs and through a private action for actual damages plus attorney's fees and court costs. A scraper or scraped-data reseller is within its reach to the extent its conduct is an unfair or deceptive act or practice in trade or commerce.

FDUTPA's short title and core prohibition were enacted by ch. 73-124, Laws of Florida (1973). The provisions this entry describes came into force on different days.

Rule 2-3.002 requires a controller to protect the confidentiality, integrity, and accessibility of the personal data it creates, receives, processes, archives, maintains, or transmits from the unauthorized access, use, disclosure, deletion, or modification of personal data.

A controller must establish, implement, and maintain data security practices that comply with the risk management framework and standards adopted by the National Institute of Standards and Technology of the United States Department of Commerce. A controller must establish, implement, and maintain procedures for the secure disposal of personal data.

A controller must designate a qualified individual responsible for overseeing and implementing the data security practices required under the Florida Digital Bill of Rights. A controller must regularly test and monitor compliance with data security practices, including key controls, systems, and procedures, to detect actual and attempted attacks on, or intrusions into systems that contain personal data.

A controller must manage access permissions, incorporating the principles of least privilege and separation of duties with respect to different types of personal data. A controller must maintain effective technical controls for personal data, including the use of encryption, audit controls that record and examine activity, time synchronization, and safeguards against unauthorized access or modification to personal data.

A controller must limit and protect any storage of personal data on mobile electronic devices and passive storage media, and unencrypted storage of personal data on those devices and media is prohibited. A controller must also apply the security practices for the most sensitive type of data within a data set with mixed levels of sensitivity.

A controller is a for-profit entity that conducts business in Florida, collects personal data about consumers, determines the purposes and means of processing it, and makes in excess of $1 billion in global gross annual revenues, and that also satisfies at least one of three further conditions.

Those conditions are deriving 50 percent or more of global gross annual revenues from the sale of advertisements online, or operating a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation. The third condition is operating an app store or digital distribution platform that offers at least 250,000 different software applications for consumers to download and install.

Any entity that controls or is controlled by a controller is also a controller. Section 501.72(5) of the Florida Statutes directs the Department of Legal Affairs to adopt rules to implement the section, including standards for data security. A violation of the Florida Digital Bill of Rights is an unfair and deceptive trade practice actionable solely by the Department of Legal Affairs, which may collect a civil penalty of up to $50,000 per violation. The part creates no private cause of action. Rule 2-3.002 took effect on July 18, 2024.

Rule 69O-128.032 requires each licensee to implement a comprehensive written information security program that includes administrative, technical, and physical safeguards for the protection of customer information. The safeguards must be appropriate to the size and complexity of the licensee and the nature and scope of its activities.

Rule 69O-128.033 requires the program to be designed to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to its security or integrity, and to protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.

A licensee under these rules means all licensed insurers, producers and other persons licensed or required to be licensed, or authorized or required to be authorized, or registered or required to be registered pursuant to the Florida Insurance Code. Rule 69O-128.031 excludes from the term licensee a purchasing group and an unauthorized insurer in regard to the surplus line business conducted under section 626.938 of the Florida Statutes.

Rule 69O-128.034 sets out non-exclusive examples of actions and procedures that licensees may follow to implement rules 69O-128.032 and 69O-128.033. Rule 69O-128.032 took effect on December 8, 2002.

Section 282.3185 of the Florida Statutes, the Local Government Cybersecurity Act, defines a local government as any county or municipality. Each local government must adopt cybersecurity standards that safeguard its data, information technology, and information technology resources to ensure availability, confidentiality, and integrity.

The cybersecurity standards must be consistent with generally accepted best practices for cybersecurity, including the National Institute of Standards and Technology Cybersecurity Framework. A county with a population of 75,000 or more had to adopt the standards by January 1, 2024, and a county with a smaller population by January 1, 2025.

A municipality with a population of 25,000 or more had to adopt the standards by January 1, 2024, and a municipality with a smaller population by January 1, 2025. Each local government must notify the Florida Digital Service of its compliance with the standards requirement as soon as possible. All local government employees with access to the local government's network must complete the basic cybersecurity training within 30 days after commencing employment and annually thereafter.

All local government technology professionals and employees with access to highly sensitive information must complete the advanced cybersecurity training within 30 days after commencing employment and annually thereafter.

A state agency, a county, or a municipality experiencing a ransomware incident may not pay or otherwise comply with a ransom demand. Chapter 2022-220, Laws of Florida, created section 282.3186. Chapter 2022-220 took effect July 1, 2022.

Section 282.318 of the Florida Statutes, the State Cybersecurity Act, reaches each state agency as defined in section 282.0041, and the term includes the Department of Legal Affairs, the Department of Agriculture and Consumer Services, and the Department of Financial Services.

The department, acting through the Florida Digital Service, is the lead entity responsible for establishing standards and processes for assessing state agency cybersecurity risks and determining appropriate security measures. Each state agency head must designate an information security manager to administer the cybersecurity program of the state agency. Each state agency head must establish an agency cybersecurity response team to respond to a cybersecurity incident.

Each state agency head must submit the strategic and operational cybersecurity plans of the state agency to the department annually by July 31. Each state agency head must conduct, and update every 3 years, a comprehensive risk assessment of the security threats to the data, information, and information technology resources of the agency.

Each state agency head must provide cybersecurity awareness training to all state agency employees within 30 days after commencing employment, and annually thereafter.

Each state agency head must ensure that the cybersecurity requirements in the written specifications for the solicitation, contracts, and service-level agreement of information technology meet or exceed the applicable state and federal laws, regulations, and standards for cybersecurity, including the National Institute of Standards and Technology Cybersecurity Framework.

Fla. Stat. 501.171(2) requires each covered entity, governmental entity, or third-party agent to take reasonable measures to protect and secure data in electronic form containing personal information; this duty explicitly names a governmental entity as a bound party in its own text.

Fla. Stat. 501.171(8) separately requires each covered entity or third-party agent, without naming a governmental entity, to take all reasonable measures to dispose of customer records containing personal information, by shredding, erasing, or otherwise rendering the information unreadable or undecipherable, once the records are no longer to be retained.

A covered entity is defined as a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information; that definition reaches a governmental entity only for the notice duty in subsections (3) through (6). Neither subsection states further content for what 'reasonable' requires beyond the general standard.

A violation of either duty is deemed an unfair or deceptive trade practice actionable only by the Department of Legal Affairs under Fla. Stat. 501.207; the section creates no private cause of action.

The $500,000-capped civil penalty Fla. Stat. 501.171(9)(b) sets applies only to a violation of the notice duty in subsection (3) or (4), so a willful violation of the data-security or disposal duty instead draws the Florida Deceptive and Unfair Trade Practices Act's general civil penalty of up to $10,000 per violation under Fla. Stat. 501.2075.

A local government must report all ransomware incidents and any cybersecurity incident it determines to be of severity level 3, 4, or 5 to the Cybersecurity Operations Center, the Cybercrime Office of the Department of Law Enforcement, and the sheriff who has jurisdiction over the local government as soon as possible, and no later than 48 hours after discovery of a cybersecurity incident and no later than 12 hours after discovery of a ransomware incident.

A local government may report a cybersecurity incident it determines to be of severity level 1 or 2 to the same three recipients. Each notification must include a summary of the facts, the date of the most recent data backup, the types of data compromised, the estimated fiscal impact, the details of any ransom demanded, and a statement requesting or declining assistance.

A local government must submit an after-action report to the Florida Digital Service within 1 week after the remediation of a cybersecurity incident or ransomware incident.

A state agency must report all ransomware incidents and any cybersecurity incident it determines to be of severity level 3, 4, or 5 to the Cybersecurity Operations Center and the Cybercrime Office of the Department of Law Enforcement as soon as possible, and no later than 48 hours after discovery of a cybersecurity incident and no later than 12 hours after discovery of a ransomware incident.

A state agency must report a cybersecurity incident it determines to be of severity level 1 or 2 to the Cybersecurity Operations Center and the Cybercrime Office of the Department of Law Enforcement as soon as possible. The incident reporting process must specify the information a state agency reports, which includes a summary of the facts, the date of the most recent data backup, the types of data compromised, the estimated fiscal impact, and the details of any ransom demanded.

The agency cybersecurity response team must immediately report all confirmed or suspected incidents to the state chief information security officer, or his or her designee. A state agency must submit an after-action report to the Florida Digital Service within 1 week after the remediation of a cybersecurity incident or ransomware incident.

The Cybersecurity Operations Center must notify the President of the Senate and the Speaker of the House of Representatives of any severity level 3, 4, or 5 incident no later than 12 hours after receiving a state agency's incident report.

Florida's Electronic Mail Communications Act does not require consent before sending a commercial email; instead it bars initiating or assisting the transmission of an unsolicited commercial email that uses a third party's Internet domain name without permission, carries falsified or missing routing information, a false or misleading subject line, or false or deceptive body content designed to damage the recipient's device, and bars distributing software designed to falsify such routing information.

Each duty is framed as a rule against falsity or deception rather than a general regulation of commercial email, the kind of state email rule that the CAN-SPAM Act's preemption clause leaves in force.

A prevailing plaintiff may enjoin future violations and recover compensatory damages or liquidated damages of $500 for each violating message, plus attorney's fees, within 4 years of the violation; a violation is also deemed an unfair and deceptive trade practice, exposing the sender to Department of Legal Affairs enforcement and the Florida Deceptive and Unfair Trade Practices Act's civil penalty of up to $10,000 for a willful violation.

Chapter 2006-232, effective July 1, 2006, added criminal penalties. A violation is a first-degree misdemeanor, rising to a third-degree felony where the sender's volume or revenue crosses one of several thresholds the section lists, where the sender uses a minor to help send the message, or on a repeat conviction within 5 years.

Florida bars any person, not only an investigative or law enforcement officer, from installing or using a pen register or a trap and trace device, a device that records or decodes the dialing, routing, addressing, or signaling information of a wire or electronic communication without capturing its contents, without first obtaining a court order.

The prohibition does not apply to a communications service provider's own network-operation, fraud-prevention, or abuse-prevention use, or to any use made with the consent of the service's user. Chapter 934 gives no civil cause of action for a violation of this section, so a person's only recourse against an unauthorized private user is criminal: a knowing violation is a misdemeanor of the first degree. The provisions this entry describes came into force on different days.

Section 934.425 of the Florida Statutes bars a person from knowingly installing or placing a tracking device or tracking application on another person's property without that person's consent, and from knowingly using a tracking device or tracking application to determine the location or movement of another person or another person's property without that person's consent.

A tracking application is a software program whose primary purpose is to track or identify the location or movement of an individual, and a tracking device is a device whose primary purpose is to reveal its location or movement by the transmission of electronic signals. The section's person is an individual and does not include a business entity.

A business entity is any form of corporation, partnership, association, cooperative, joint venture, business trust or sole proprietorship that conducts business in Florida. A person's consent is presumed revoked if the consenting person and the person to whom consent was given are lawfully married and one files a petition for dissolution of marriage, or if either files an injunction for protection against the other under section 741.30, 741.315, 784.046 or 784.0485.

The section does not apply to a person acting in good faith on behalf of a business entity for a legitimate business purpose, and that exclusion does not apply to a person engaged in private investigation on behalf of another person unless the activity would otherwise be exempt if performed by the person engaging the private investigator.

The section also does not apply to a law enforcement officer or agency that lawfully uses a tracking device or tracking application on another person's property as part of a criminal investigation. The section also does not apply to a person authorized to install, place or use a tracking device or tracking application under a court order.

The section also does not apply to a parent or legal guardian of a minor child who tracks the child's property when the parents are lawfully married and not living apart and either consents, when the parent is the sole surviving parent or guardian, when the parent has sole custody, or when divorced, separated or living-apart parents both consent.

The section also does not apply to a caregiver of an elderly person or disabled adult whose treating physician certifies that tracking is necessary to ensure the person's safety.

The section also does not apply to an owner or lessee of a motor vehicle who tracks the vehicle during the period of ownership or lease if the device or application is removed before the title is transferred or the lease expires, the new owner or lessor consents in writing to nonremoval, or the owner at the time of installation was the original manufacturer and the next owner was told where the device is and how to remove it.

A violation is a felony of the third degree, and a violation to commit or to facilitate the commission of a dangerous crime as defined in section 907.041(5)(a) is a felony of the second degree. As created in 2015 the section reached only knowingly installing a tracking device or tracking application on another person's property without the other person's consent. Chapter 2015-137, Laws of Florida, which created the section, took effect on October 1, 2015.

Chapter 2024-114, Laws of Florida, extended the prohibition to placing a tracking device or tracking application and to using one to determine the location or movement of another person or another person's property. Chapter 2024-114 took effect on October 1, 2024.

Chapter 2025-71, Laws of Florida, added enhanced criminal penalties for a person who, to commit or facilitate the commission of a dangerous crime, knowingly installs or places a tracking device or tracking application on another person's property without consent. Chapter 2025-71 took effect on October 1, 2025.

Florida makes it unlawful to intentionally intercept, or procure another person to intercept, a wire, oral, or electronic communication, and lawful interception requires the prior consent of every party to the communication, not merely one.

The all-party rule reaches an oral communication only when the speaker exhibited an expectation that it would not be intercepted under circumstances justifying that expectation, so it does not reach a public oral communication uttered at a public meeting, while a wire communication (an ordinary telephone call) carries no such qualifier and is covered regardless.

A person whose communication is intercepted, disclosed, or used in violation has a civil action for actual damages, but not less than liquidated damages of $100 a day of violation or $1,000, whichever is higher, plus punitive damages and attorney's fees, brought within 2 years of discovering the violation; an intentional violation is ordinarily a third-degree felony, reduced to a first- or second-degree misdemeanor only for a first, non-tortious, non-commercial interception of specific kinds of unscrambled radio communications the statute lists. The provisions this entry describes came into force on different days.

The Florida Telemarketing Act requires a commercial telephone seller and its salespersons to hold a Department of Agriculture and Consumer Services license, on a written application accompanied by a bond, letter of credit, or certificate of deposit and a $1,500 fee. It bars a commercial telephone seller or salesperson from placing a commercial telephone solicitation call before 8 a.m. or after 8 p.m. local time in the called person's time zone.

It also bars a commercial telephone seller or salesperson from making more than three such calls to one person on the same subject within a 24-hour period, and from displaying a false caller identification number to conceal the caller's identity, calling-conduct duties chapter 2021-185 added effective July 1, 2021 alongside the parallel rewrite of Fla. Stat. § 501.059 above.

A person injured by a violation may sue for actual and punitive damages, costs, and attorney's fees, and the Department may separately impose a civil penalty, an administrative fine, or license denial, suspension, or revocation; soliciting or employing a salesperson without a license, and otherwise violating any provision of the Act, are each a third-degree felony (a second-degree felony on a repeat conviction), while using caller-identification-spoofing technology on a commercial telephone solicitation call carries its own, narrower second-degree misdemeanor. The sections this entry groups came into force on different days.

The Florida Telephone Solicitation Act requires a telephone solicitor to identify itself immediately by its true name and the business it solicits for, to screen against the Department of Agriculture and Consumer Services' 'no sales solicitation calls' listing, and to honor a called party's own request not to be contacted again, whether the call is for a sale or a charitable solicitation.

The identification, listing and automated-system rules reach only an unsolicited telephonic sales call, which excludes a call made in response to the called person's express request, a call primarily about an existing debt or contract not yet paid or performed, a call to a person with whom the solicitor has a prior or existing business relationship, and a newspaper publisher's call about its business.

Since chapter 2021-185 (CS/SB 1120, effective July 1, 2021) rewrote the section, a person may not place an unsolicited telephonic sales call, text message, or voicemail that uses an automated system for the selection and dialing of telephone numbers or a recorded message without the called party's prior express written consent, a definition chapter 2023-150 (CS/CS/HB 761, effective May 25, 2023) narrowed from a system that selects or dials numbers to one that both selects and dials them.

A called party aggrieved by a violation may sue to enjoin it and recover actual damages or $500, whichever is greater, trebled up to $1,500 for a willful or knowing violation, but a suit over text message solicitations requires the called party to first reply STOP and give the sender 15 days to comply. The Department of Agriculture and Consumer Services or the Department of Legal Affairs may separately bring a civil, not criminal, penalty action.

Requires a website that contains a substantial portion of material harmful to minors, as the applicability criteria define it, to perform reasonable age verification before granting access, using a standard method or an anonymous age verification service the visitor selects. A separate industry lawsuit challenging this provision was voluntarily dismissed in July 2025.

Bars minors under 14 from holding a social media account and requires verified parental consent for 14 and 15 year olds; covered platforms must terminate and permanently delete noncompliant minor accounts, including those a platform's own analytics flag as likely belonging to a minor.