Florida's Digital Bill of Rights: Who It Covers and What It Lets You Do
Since July 1, 2024, a Florida law has given residents new rights over the personal data that some of the world's largest tech companies collect about them. The law is known as the Florida Digital Bill of Rights.
Where it came from
The protections were created by Senate Bill 262, which the Legislature passed in 2023. Gov. Ron DeSantis approved it on June 6, 2023, and it became Chapter 2023-201, Laws of Florida, according to the bill's history on the Florida Senate website. Most of the law took effect July 1, 2024.
Which companies it covers
The law reaches only a narrow group of very large companies. Under the definition of "controller" in Section 501.702, Florida Statutes, a covered business must operate for profit, do business in Florida, decide how consumers' personal data is used and bring in more than $1 billion a year in global gross revenue.
It must also meet at least one of three tests:
Earn at least half its global revenue from selling online ads, including targeted ads.
Run a smart speaker and voice command service with a built-in virtual assistant that wakes up hands-free.
Run an app store offering at least 250,000 different apps.
Companies that control, or are controlled by, a covered business are also covered. The law firm Carlton Fields summarized the same thresholds when the bill passed.
What rights Floridians get
Under Section 501.705, a consumer can ask a covered company to:
Confirm whether it is processing their personal data, and see that data.
Correct inaccurate data.
Delete data they provided or that was gathered about them.
Hand over a portable copy of their data.
Stop using their data for targeted ads, stop selling it and stop certain profiling.
Stop collecting or processing sensitive data, including precise location.
Stop collecting data through voice or facial recognition.
Parents and guardians can make these requests for their children. The statute also bars covered devices with voice or video features from using them to surveil consumers who aren't actively using them, unless the consumer expressly agrees.
Who enforces it
Only the state's Department of Legal Affairs, which is run by the attorney general, can enforce the law, under Section 501.72. Individuals cannot sue. The department can seek up to $50,000 per violation, and that amount can be tripled in some cases, including violations involving a known child. The department may give a company 45 days to fix a problem before suing, except in cases involving known children.
How we reported this: This explainer was drafted with AI assistance from the sources linked above, and every fact was checked against those sources. See an error? Contact us and we'll correct it.
Share this story: Facebook · Threads · X · LinkedIn · WhatsApp · Email