Key Facts
Overview
Florida's FDBR has the narrowest applicability among US state privacy laws, effectively targeting only major technology companies through its $1 billion revenue threshold and additional digital business criteria. However, it has the highest base penalty ($50,000) and treble damages ($150,000) for violations involving children.
What This Means for Your Website
- Only applicable to very large tech companies ($1B+ revenue with specific digital business criteria)
- Highest base penalty among US states: $50,000 per violation
- Treble damages ($150,000) for violations involving children
- Consumer rights include opting out of targeted advertising, data sales, and profiling
- Smart speaker and virtual assistant surveillance restrictions apply
Key Requirements
The Florida AG enforces the FDBR with penalties up to $50,000 per violation, tripling to $150,000 for children's data violations. A discretionary 45-day cure period applies except for known violations involving children. The narrow applicability means only a handful of companies are directly subject.
How ConsentStack Handles This
ConsentStack applies Florida's opt-out model for applicable businesses, with enhanced protections for children's data to avoid treble penalty exposure.
Penalties
Up to $50,000 per violation; treble ($150,000) for violations involving children.
Key Requirements
- Consent before selling sensitive data
- Consumer rights: access, correct, delete, portability, opt-out
- Right to opt out of targeted advertising, data sales, and profiling
- Enhanced protections for children's data
- Restrictions on surveillance through smart speakers and virtual assistants
Notable Provisions
- Narrowest applicability: effectively targets only major tech companies
- Highest base penalty ($50,000) among US states
- Treble damages for children ($150,000)
- Smart speaker surveillance restrictions
Data Subject Rights
Confirm whether a controller is processing your personal data and access that data.
Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.
Have a controller delete any or all personal data you provided to it or that it obtained about you.
Obtain a copy of your personal data in a portable and, where technically feasible, readily usable format when the data is available in digital form.
Opt out of the processing of your personal data for targeted advertising.
Opt out of the sale of your personal data.
Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, such as decisions about financial or lending services, housing, insurance, health care, education enrollment, employment, criminal justice or access to basic necessities.
Opt out of the collection or processing of your sensitive data, such as precise geolocation, a health diagnosis, racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, or genetic or biometric data used to identify you.
Appeal a controller's refusal to act on your request through a conspicuously available process similar to the request process, and receive a written explanation of the decision on the appeal.
A controller may not discriminate against you for exercising your rights, such as by denying goods or services, charging different prices or rates, or providing a different level of quality, though it may vary price or service if you opt out or join a bona fide loyalty program.
Revoke at any time the consent you gave to a financial incentive program under which a controller compensates you for processing your personal data.
Have an authorized person, such as someone you gave express written authority, an agent under a power of attorney, or a child's parent or legal guardian, exercise your rights for you once the controller authenticates them.
US State Specifics
Other North America Regulations
Frequently Asked Questions
Stay compliant with FDBR
ConsentStack helps you implement Opt-out consent for Florida, United States automatically.