Who does the FDBR apply to?

The FDBR applies only to entities with $1 billion+ in annual global gross revenue that also meet additional conditions related to data processing, ad revenue, or platform operation. This extremely high threshold means it primarily targets major tech companies.

What makes the FDBR unique?

The FDBR has the highest revenue threshold ($1 billion) of any state privacy law, includes specific social media platform provisions for minor safety, and has penalties of up to $50,000 per violation.

Does Florida have data broker registration requirements?

Yes. Florida has a separate data broker registration law requiring annual registration with the Department of Agriculture and Consumer Services, with fines up to $1,000 per day for non-compliance.

What is the cure period under the FDBR?

The FDBR provides a 45-day cure period. Businesses have 45 days to cure alleged violations after being notified by the Attorney General.

Florida Privacy Law

Florida Digital Bill of Rights

Effective: July 1, 2024Active

Overview

The Florida Digital Bill of Rights (FDBR) was signed into law on June 6, 2023, and became effective on July 1, 2024. Florida's law is unique among state privacy laws for its extremely high applicability threshold, effectively limiting the law's reach to very large technology companies and data-heavy businesses. The FDBR also includes notable provisions targeting large social media platforms. The FDBR provides Florida consumers with privacy rights including the right to access, correct, delete, and port personal data, as well as opt-out rights for data sales, targeted advertising, and profiling. However, the extremely high revenue threshold of $1 billion means that very few businesses are actually subject to the law. The FDBR also includes specific provisions for social media platforms, particularly regarding minor safety. The law applies to entities conducting business in Florida that have annual global gross revenue exceeding $1 billion AND meet additional conditions: making a significant portion of revenue from data-related activities, operating online platforms or search engines used by consumers, or processing substantial amounts of personal data. The FDBR includes a 45-day cure period and penalties of up to $50,000 per violation, enforced by the Florida Department of Legal Affairs (Attorney General).

Applicability Thresholds

Conditions are joined by AND — ALL conditions must be met.

$1000M+

Annual gross revenue

Annual global gross revenue exceeding $1 billion, plus additional conditions related to data processing activities, ad revenue, or platform operation. Also applies to entities controlled by or in control of qualifying organizations.

Consumer Rights

Right to Access

Right to Delete

Right to Correct

Data Portability

Opt-Out of Sale

Opt-Out of Targeted Ads

Opt-Out of Profiling

Limit Sensitive Data Use

Right to Appeal

Private Right of Action

Key Changes in 2025-2026

Continued enforcement of the very-high-threshold FDBR targeting major tech companies
Separate data broker registration law enforcement continues
Social media minor safety provisions under active enforcement
Potential amendments to lower thresholds or expand applicability

Enforcement Details

Enforced By

Florida Department of Legal Affairs (Attorney General)

Penalty Per Violation

$50,000

Cure Period

45 days

Private Right of Action

No — AG enforcement only

Sensitive Data Categories

Consent model: opt-in

Racial or ethnic originReligious beliefsMental or physical health diagnosisSexual orientationCitizenship or immigration statusBiometric data for identification

Universal Opt-Out / GPC Requirements

No Universal Opt-Out Requirement

The FDBR does not require businesses to honor universal opt-out mechanisms. Given the very high threshold, the law targets large tech companies that typically have sophisticated opt-out processes.

Minor / Child Protections

The FDBR includes strong social media-focused minor protections. It prohibits social media platforms from processing personal data of children under 13 and requires parental consent mechanisms. For teens under 18, platforms must provide age-appropriate privacy defaults and restrict certain data processing activities.

Compliance Checklist

1Determine whether your organization meets the $1 billion revenue threshold and additional qualifying conditions
2If applicable, update privacy notices with all FDBR-required disclosures
3Implement consumer rights request mechanisms with 45-day response period
4Obtain opt-in consent for processing sensitive personal data
5For social media platforms, implement age verification and minor safety protections
6If operating as a data broker, register with the Florida Department of Agriculture and Consumer Services

Florida Privacy Law FAQ

Official Resources

Disclaimer: PrivacyLawMap provides general information about US state privacy laws for educational purposes only. This is NOT legal advice. Privacy laws are complex and frequently amended. Consult with a qualified privacy attorney for advice specific to your business. PrivacyLawMap makes no warranties about the accuracy or completeness of this information.