Florida Digital Bill of Rights Compliance with ConsentX

The Florida Digital Bill of Rights (FDBR) is Florida's comprehensive consumer data privacy law. It establishes consumer rights over personal data and imposes obligations on covered controllers and processors. The law became effective on July 1, 2024.

Florida consumers generally have the right to confirm whether their personal data is being processed, access their personal data, correct inaccuracies, request deletion of personal data, obtain a portable copy of their personal data, opt out of targeted advertising, opt out of the sale of personal data, opt out of certain profiling activities, opt out of the collection or processing of sensitive data and opt out of certain voice recognition and facial recognition data collection.

The FDBR does not require consent for every type of personal-data processing. However, specific consent requirements apply to certain activities, including the sale of sensitive personal data. Controllers must obtain prior consumer consent before selling sensitive data, subject to specific rules for known children.

Sensitive data includes categories such as racial or ethnic origin, religious beliefs, mental or physical health conditions or diagnoses, sexual orientation, citizenship or immigration status, genetic or biometric data used for identification, precise geolocation, and personal data of a known child. The FDBR provides consumers with a right to opt out of the collection or processing of sensitive data.

Yes. Consumers have the right to opt out of processing their personal data for targeted advertising.

Yes. The FDBR provides consumers with the right to opt out of the sale of their personal data.

Yes. Consumers can opt out of profiling in furtherance of a decision that produces a legal or similarly significant effect concerning them.

Yes. Consumers have a right to opt out of the collection of personal data through the operation of a voice recognition or facial recognition feature. The law also restricts certain surveillance uses of device features such as voice, facial, video, audio, visual, thermal, or olfactory capabilities when those features are not actively being used by the consumer, unless otherwise expressly authorized.

The FDBR regulates personal-data processing rather than cookies as a standalone technology. Cookies, pixels, advertising tags, SDKs, and other tracking technologies may nevertheless collect or process personal data or support targeted advertising. Tracker discovery and privacy preference enforcement can therefore form an important part of an FDBR compliance program.

Yes. Controllers must provide a privacy notice describing relevant personal-data processing and consumer privacy rights. The notice should provide consumers with meaningful information about how their personal data is collected, used, disclosed, and managed.

Yes. Controllers must conduct and document data protection assessments for specified processing activities, including targeted advertising, the sale of personal data, certain profiling, sensitive-data processing, and other processing presenting a heightened risk of harm to consumers.

Controllers generally must respond without undue delay and no later than 45 days after receiving a consumer request. The response period may be extended once by an additional 15 days when reasonably necessary, provided the consumer is notified within the initial 45-day period and given the reason for the extension.

Yes. Controllers must establish a process through which consumers can appeal a refusal to take action on a privacy request. The controller must provide a written decision on the appeal within 60 days of receiving the appeal.

Controllers must establish at least two secure, reliable, and clearly accessible methods for consumers to submit privacy rights requests. A controller may not require a consumer to create a new account solely to exercise privacy rights, although an existing account may be used for authentication.

Yes. The FDBR contains specific protections relating to known children's data, including special requirements concerning sensitive-data sales and parental consent. The FDBR also operates alongside Florida's separate requirements concerning children's online privacy.

The Florida Department of Legal Affairs is responsible for enforcement and implementation of the FDBR. Florida has already reported consumer complaints and enforcement activity under the law, demonstrating that the FDBR is an active compliance obligation rather than a purely future-facing framework.

ConsentX can help operationalize important privacy controls such as consent management, tracker discovery, prior-script blocking, consumer opt-out management, rights-request workflows, and audit evidence. However, no software can independently guarantee legal compliance. Organizations should assess their complete privacy program against the FDBR and all other applicable laws.