Open workspace

Guide · US state law

The Florida Digital Bill of Rights, explained for those who live off ads

Florida's privacy law has applied since July 1, 2024, but most of its rules only reach giant companies. In this guide you will understand that narrow scope, the sensitive data rule that applies to many more companies and what Google does with the opt-out of people who visit your site from Florida.

Audit my site for the USRead the guide
  • ✓Based on the text of the Florida Statutes, sections 501.701 to 501.722
  • ✓Practical examples for sites with ads
  • ✓Read-only scan, no changes to the site
$1Bin global annual gross revenue: the threshold to be a controller under the law
50%or more of revenue from selling online ads: one of the three entry points
$50Kmaximum civil penalty per violation, which can be tripled in certain cases
45 daysto answer consumer requests, with a 15-day extension

What it is

A privacy law made for the biggest tech companies

The Florida Digital Bill of Rights, or FDBR, is Florida's privacy law. It was signed on June 6, 2023 and took effect on July 1, 2024. The law is in Part V of Chapter 501 of the Florida Statutes, sections 501.701 to 501.722.

The rights given to consumers are similar to those in other states: access, correction, deletion, portability and opt-out of targeted advertising, sale and automated profiling. Florida adds rights of its own, such as opting out of data collection through voice or face recognition.

What makes the law different is its scope. Most obligations only apply to controllers with global revenue above $1 billion that also fit one of three very specific profiles. In practice, this targets large ad platforms, voice assistants and app stores.

Even so, a small site should not ignore the law. A rule on the sale of sensitive data applies to any for-profit company that does business in Florida and collects data. And the ad partners that receive data from your site may be covered by the law.

Checklist

What you need to meet

Most of the law only applies to giant controllers, but the sensitive data rule reaches many more sites.

  1. Do not sell sensitive data without consent

    The rule applies to a for-profit company that does business in Florida and collects data, without the US$ 1 billion threshold. Selling sensitive data requires prior consent.

    Example

    Before passing health data to a partner, ask permission with the options Allow and Do not allow.

  2. Publish the exact sentence if you sell sensitive data

    Anyone who sells sensitive data must publish a notice with fixed text, in English.

    Example

    NOTICE: This website may sell your sensitive personal data.

  3. Take care with minors' sensitive data

    If the sensitive data belongs to a known minor between 13 and 18, the sale requires their authorization. Under 13, the federal law COPPA applies, with parental consent.

  4. If you are a controller: notice reviewed every year

    The notice must be clear and list data, purposes, third parties, rights, appeal and request channels. It must be updated at least once a year.

  5. If you are a controller: sentence for biometric data

    Anyone who sells biometric data also publishes a notice with fixed text, in English.

    Example

    NOTICE: This website may sell your biometric personal data.

  6. If you are a controller: say how to opt out

    Anyone who sells data or does targeted advertising must say so clearly and visibly and explain how to opt out.

    Example

    Footer link: Do Not Sell or Share My Personal Information.

  7. Pass the opt-out to Google

    Google does not require a CMP for US states. Use the US state regulations message, in Privacy & messaging, or turn on restricted data processing, RDP, in the tag for people who opted out. Florida has its own section in GPP, and Google accepts that section.

    Example

    AdSense or Ad Manager: Privacy & messaging, US state regulations card, Create. Then choose the sites and publish.

    <!-- Só para o visitante que recusou -->
<ins class="adsbygoogle"
  data-ad-client="ca-pub-0000000000000000"
  data-ad-slot="0000000000"
  data-restrict-data-processing="1"></ins>

In practice

Right and wrong

Official tools

Certified CMPs and official links

Google does not require a certified CMP or GPP for US state laws. You can use Google's own message or turn on RDP in the tag. Florida is one of the few states with its own GPP section accepted by Google.

Who must comply

The narrow scope of a controller in Florida

To be a controller, the company must be for-profit, do business in Florida, collect consumer data, decide how that data is used, have global revenue above $1 billion and fit at least one of the profiles below.

Revenue from ads

Half or more of global annual gross revenue comes from selling online ads, including targeted advertising.

Voice assistant

Operates a smart speaker or voice command service with a cloud-connected virtual assistant activated hands-free. Vehicle manufacturers' systems are excluded.

App store

Operates an app store or digital distribution platform with at least 250,000 different apps.

Related companies

Companies that control a controller, or are controlled by one, are also included in the definition.

The sensitive data rule applies to more people

The ban on selling sensitive data without consent reaches any for-profit company that does business in Florida and collects data, with no $1 billion threshold.

Who is a consumer

A resident or person domiciled in Florida acting as an individual or in a household context. Those acting in a commercial or work context are excluded.

Definitions

The words of the law, in plain site-owner language

The definitions are in section 501.702 and closely follow the model of other state laws.

Personal data

Any information linked, or reasonably linkable, to an identified or identifiable person, including pseudonymous data when it can be linked to the person with additional information. De-identified and public data are excluded.

Sensitive data

Racial or ethnic origin, religious belief, health diagnosis, sexual orientation, immigration status, genetic or biometric data that identify the person, data of a known child and precise geolocation.

Sale

Sharing, disclosing or transferring personal data to a third party in exchange for money or other valuable consideration. Transfers to processors and at the consumer's request are excluded.

Targeted advertising

An ad chosen based on the consumer's activity over time across multiple sites and apps. An ad based on the context of a search on the site itself does not count.

People's rights

What the Florida consumer can ask for

The controller responds within 45 days and can extend once for another 15 days, notifying the consumer within the initial period. It must also offer a way to appeal.

Access

Know whether the company processes their data and see that data.

Correct and delete

Correct wrong data and request deletion of some or all personal data.

Portability

Receive a copy of the data in a format that can be used in another service, when feasible.

Opt out of targeted ads, sale and profiling

Opt out of targeted advertising, the sale of data and profiling that leads to decisions with legal or similar effects.

Opt out of sensitive data

Opt out of the collection or processing of sensitive data, including precise geolocation.

Opt out of voice and face

Opt out of data collection through voice recognition or facial recognition features.

Obligations

What the controller must have working

  1. Privacy notice reviewed every yearThe notice must be accessible and clear and list the categories of data processed, including sensitive data, the purpose, how to exercise rights and appeal, the categories of data shared, the categories of third parties and the channels for sending requests. It must be updated at least once a year.
  2. Standardized sale noticesThose who sell sensitive data must publish the notice NOTICE: This website may sell your sensitive personal data. Those who sell biometric data must publish NOTICE: This website may sell your biometric personal data.
  3. Disclosure of sale and targeted advertisingIf the controller sells data or does targeted advertising, it must say so clearly and visibly and explain how the consumer can opt out.
  4. Data protection assessmentThe law requires documented assessments for higher-risk processing, such as targeted advertising, sale of data, profiling and sensitive data.
  5. Contract with processorsVendors that process data on behalf of the controller follow its instructions and need a contract with the rules of the processing.
  6. Consent for sensitive dataNo company covered by the rule can sell sensitive data without the consumer's prior consent. For children, separate rules and the federal COPPA law apply.

Enforcement and fines

The highest fines among the state laws

Enforcement is by the Department of Legal Affairs, part of the Florida attorney general's office. The law expressly states that it does not create a private right of action for consumers.

Up to $50,000 per violation

The maximum civil penalty is $50,000 per violation, in addition to other measures provided in Florida's deceptive and unfair trade practices law.

Tripled fine

The amount can be tripled when it involves a known child, when the company does not delete or correct data after a valid request, or when it keeps selling data after an opt-out.

45 days to fix it, if the agency chooses

The agency may give the company 45 days to fix the failure, but that is its decision, not a right of the company. Violations involving children do not get this period.

Annual public report

Every year, by February 1, the agency publishes a report with complaints, actions and fines imposed and received.

Timeline

The FDBR dates

The law had a year of preparation between signing and taking effect.

  1. June 6, 2023

    Signing

    The governor signs bill SB 262, which creates the Florida Digital Bill of Rights.

  2. July 1, 2024

    Entry into force

    The law takes effect. Controllers must respond to requests, offer opt-out and publish the privacy notice.

  3. Every February 1

    Enforcement report

    The Department of Legal Affairs publishes on its website the annual summary of complaints, actions and fines.

  4. September 2025

    Google updates the GPP

    Google starts accepting version 2 of the GPP US National section, while also keeping the Florida-specific section among those accepted.

Sites with AdSense and Ad Manager

How the Florida opt-out reaches Google

The FDBR does not require the site to recognize universal opt-out signals, such as Global Privacy Control, or GPC. The visitor must use the path the site offers. Even so, honoring GPC is a good practice and applies to states where it is mandatory.

Google offers a US state regulations message in AdSense and Ad Manager, under Privacy & messaging. Florida is on the list of states covered. The message shows the Do Not Sell or Share link, and the visitor's opt-out turns on restricted data processing, called RDP, which prevents ads based on previous behavior.

For those using their own CMP, Florida is one of the few states with its own GPP section that Google accepts. In that section, an opt-out of sale or targeted advertising turns on RDP. The US National section is also accepted and works the same way for sale, sharing and targeted advertising.

There is also the path through the tag itself: the restrictDataProcessing parameter in GPT or the data-restrict-data-processing attribute in AdSense, used only for those who requested an opt-out. Whatever the path, the test is the same: the ad request must change after the opt-out.

In practice

What is and is not allowed in Florida

Examples for a site that receives Florida visitors and monetizes with programmatic ads.

Allowed

  • Show contextual ads to people who opted out of targeted advertising
  • Using the Florida section or the GPP US National section to tell Google about the opt-out
  • Use Google's state regulations message to offer the opt-out link
  • Keeping a single privacy notice for the US, as long as it includes what Florida requires
  • Reviewing and updating the privacy page at least once a year

Not allowed

  • Selling sensitive data, such as precise geolocation, without prior consent, even as a small company
  • Selling sensitive data without publishing the standardized notice required by the law
  • Continuing to sell or share data after the opt-out, the case that can triple the fine
  • Leaving the opt-out link hidden on a page that nobody finds
  • Assuming the ad partner is outside the law just because your site is small

Common errors

Where sites stumble with the Florida law

The law's narrow scope makes many people think they do not need to do anything. These are the most common slips.

Ignoring the sensitive data rule

The site uses an SDK or script that collects precise geolocation and passes it to partners. This sale requires consent, even without the $1 billion threshold.

Stale privacy policy

The privacy page has not changed in years. The law requires at least an annual update for controllers.

Message without Florida

Google's opt-out message was turned on only for California, and Florida traffic never sees the link.

Wrong state section in the GPP

The CMP sends a section that Google does not accept and leaves out the Florida and US National ones. The opt-out does not reach the ads.

Opt-out that does not stop the sale

The visitor clicks, but ad requests keep carrying data for personalization. In Florida, this can triple the fine.

Forgetting minors

Violations involving a known child have no cure period and can carry a tripled fine.

In ConsentMode

What the audit checks for Florida

  • Opens the site as a visitor from the United States and looks for the opt-out link in the footer, the menu and the privacy message.
  • Identifies the CMP or Google's state regulations message from the page code.
  • Reads the GPP string and says whether it includes the Florida section or the US National section, and whether it changes after the opt-out.
  • Turns on the GPC signal in the audit browser and shows whether the page and ad requests react.
  • Checks whether the privacy page mentions sale, targeted advertising, rights, appeal and the sensitive data sale notices when applicable.
Run an auditSee everything that is checked

Frequently asked questions

My site is small. Does the Florida law apply to me?

Most obligations do not, because the controller must have global revenue above $1 billion and fit one of the law's three profiles. But the rule that bans selling sensitive data without consent applies to any for-profit company that does business in Florida and collects data.

Then why worry about the Florida opt-out?

Because the partners that buy and serve ads on your site may be controllers under the law, and because other states with lower thresholds may reach your business. Offering the opt-out to all US traffic simplifies the operation.

Does Florida require me to honor GPC?

No. The law does not provide for universal opt-out signals. Even so, many CMPs handle GPC in all states, which helps with the laws that require it.

Does Google read the Florida section in the GPP?

Yes. Florida is on the list of sections accepted by Google, along with US National, California, Colorado, Connecticut and Virginia. An opt-out of sale or targeted advertising in that section turns on restricted data processing.

What is the NOTICE the law requires?

It is a standardized text in English that those who sell sensitive or biometric data must publish. It warns that the site may sell this type of data. Most sites with ads do not sell this type of data and do not need the notice.

Does ConsentMode make my site comply with the Florida law?

ConsentMode is not a CMP or a law firm. The audit shows, with screenshots, what the site does with the opt-out, the GPP and the privacy page, so you can fix it with your provider and your lawyer.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

Find out whether the Florida opt-out reaches your ads

The audit opens the site as a US visitor and shows what to fix, without changing anything.

Start the audit