Florida Privacy Law

Florida (FDBR)

Last updated Sep 30, 2026

FDBR Enacted, in effect

Who this affects: This page tracks Florida’s FDBR, which governs controllers and processors.

Who it applies to: Any for-profit entity that conducts business in Florida and collects consumers' personal data, and meets: more than $1,000,000,000 in global gross annual revenue and at least one of: 50%+ of global revenue from online ad sales, a cloud-connected, hands-free smart speaker/voice service, or an app store with 250,000+ apps; some provisions apply under a separate test (see below).

Content on this page is not legal advice

Must, Can't, Should FDBR Timeline

July 1, 2024

Effective ↗

Department of Legal Affairs

Enforced by ↗

$50,000

Maximum penalty per violation ↗

None

Private right of action ↗

The law, in plain English

Must · Can’t · Should

FDBR, distilled to what actually changes your week. Read one column to know your floor, your hard limits, and the further obligations and good practices worth planning for.

Must

Answer authenticated rights requests within 45 days; extend once by 15 days only with notice and reason inside the first 45. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. FL-501.705 “A controller shall comply with an authenticated consumer request to exercise any of the following rights” Read the statute FL-501.706 “A controller shall respond to the consumer request without undue delay, which may not be later than 45 days after the date of receipt of the request” Read the statute FL-501.706 “The controller may extend the response period once by an additional 15 days when reasonably necessary, taking into account the complexity and number of the consumer’s requests, so long as the controller informs the consumer of the extension within the initial 45-day response period, together with the reason for the extension” Read the statute
Honor opt-outs of sale, targeted advertising, significant-decision profiling, and voice or facial recognition data collection. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. FL-501.711 “the controller must clearly and conspicuously disclose that process and the manner in which a consumer may exercise the right to opt out of that process” Read the statute FL-501.705 “The sale of personal data; or” Read the statute FL-501.705 “Targeted advertising;” Read the statute FL-501.705 “Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer.” Read the statute FL-501.705 “To opt out of the collection of personal data collected through the operation of a voice recognition or facial recognition feature.” Read the statute
Keep a clear privacy notice updated at least annually, and post the statutory notice if you sell sensitive or biometric data. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. FL-501.711 “A controller shall provide consumers with a reasonably accessible and clear privacy notice, updated at least annually, that includes all of the following information” Read the statute FL-501.715 “A person in subsection (1) who engages in the sale of personal data that is sensitive data must provide the following notice: “NOTICE: This website may sell your sensitive personal data.”” Read the statute FL-501.711 “the controller must provide the following notice: “NOTICE: This website may sell your biometric personal data.”” Read the statute

Can't

Process or sell sensitive data without consent or, for a known child between 13 and 18 years of age, the child's authorization. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. FL-501.71 “Process the sensitive data of a consumer without obtaining the consumer’s consent, or, in the case of processing the sensitive data of a known child, without processing that data with the affirmative authorization for such processing by a known child who is between 13 and 18 years of age or in accordance with the Children’s Online Privacy Protection Act, 15 U.S.C. ss. 6501 et seq. for a known child under the age of 13” Read the statute FL-501.715 “may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer or, if the sensitive data is of a known child, without processing that data with the affirmative authorization for such processing by a known child who is between 13 and 18 years of age or in accordance with the Children’s Online Privacy Protection Act, 15 U.S.C. ss. 6501 et seq. for a known child under the age of 13” Read the statute
Use device voice, facial, video or audio features for surveillance when not in active use, absent express consumer authorization. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. FL-501.705 “A device that has a voice recognition feature, a facial recognition feature, a video recording feature, an audio recording feature, or any other electronic, visual, thermal, or olfactory feature that collects data may not use those features for the purpose of surveillance by the controller, processor, or affiliate of a controller or processor when such features are not in active use by the consumer, unless otherwise expressly authorized by the consumer.” Read the statute
Require a consumer to create a new account to exercise rights, though requiring use of an existing account is allowed. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. FL-501.709 “A controller may not require a consumer to create a new account to exercise the consumer’s rights under this part but may require a consumer to use an existing account” Read the statute

Should

Sign processor contracts setting instructions, nature and purpose, data type, duration, and both parties' rights and obligations. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. FL-501.712 “A contract between a controller and a processor governs the processor’s data processing procedures with respect to processing performed on behalf of the controller. The contract must include all of the following information: (a) Clear instructions for processing data. (b) The nature and purpose of processing. (c) The type of data subject to processing. (d) The duration of processing. (e) The rights and obligations of both parties.” Read the statute
Offer two or more request methods, including a website mechanism, and answer appeals in writing with reasons within 60 days. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. FL-501.709 “A controller shall establish two or more methods to enable consumers to submit a request to exercise their consumer rights under this part” Read the statute FL-501.709 “A controller shall provide a mechanism on its website for a consumer to submit a request for information required to be disclosed under this part” Read the statute FL-501.707 “A controller shall inform the consumer in writing of any action taken or not taken in response to an appeal under this section within 60 days after the date of receipt of the appeal, including a written explanation of the reason or reasons for the decision” Read the statute
Conduct and document data protection assessments for covered processing, with processors supplying the needed information. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. FL-501.713 “A controller shall conduct and document a data protection assessment of each of the following processing activities involving personal data” Read the statute FL-501.712 “Providing necessary information to enable the controller to conduct and document data protection assessments under s. 501.713” Read the statute

These are the highlights we judge most important, not everything FDBR requires. The comprehensive law section below covers the full detail, fact by fact, with the statutory text behind every one.

The comprehensive law

Florida Digital Bill of Rights

FDBR (SB 262) is Florida’s comprehensive privacy law. Every fact was extracted from the primary statute by the DataGrail regulation engine and is grounded to the cited source. Scan the facts; the exact statutory text sits one click away on each source link.

Status

Enacted, in effect

Fla. SB 262 (2023, enrolled) § 27 Archived excerpt — the text we read Section 27. Except as otherwise expressly provided in this act and except for this section, which shall take effect upon this act becoming a law, this act shall take effect July 1, 2024. Archived from source — captured 2026-08-14 · snapshot f717b224 Verify at the source

Effective

July 1, 2024

Signed

June 6, 2023

“Approved by the Governor June 6, 2023.” View the source

Enforced by

Department of Legal Affairs

Archived excerpt — the text we read 501.72 Enforcement and implementation by the Department of Legal Affairs.— (1) A violation of this part is an unfair and deceptive trade practice actionable under part II of this chapter solely by the Department of Legal Affairs. If the department has reason to believe that a person is in violation of this section, the department may, as the enforcing authority, bring an action against such person for an unfair or deceptive act or practice. For … Archived from source — captured 2026-09-28 · snapshot 35b376cb Verify at the source

Maximum penalty per violation

$50,000; may be tripled (some violations)

May be tripled for violations involving a known child, ignored deletion requests, or selling after an opt-out. Source for each figure$50,000 · FL-501.72 $50,000, may be tripled · FL-501.72 $50,000, may be tripled · FL-501.72 $50,000, may be tripled · FL-501.72 “the department may collect a civil penalty of up to $50,000 per violation” View the statute

Right to cure

45 days (discretionary)

Discretionary: the Department may allow 45 days to cure. No cure for violations involving a known child. Archived excerpt — the text we read …s section applies. (c) Continuing to sell or share the consumer’s personal data after the consumer chooses to opt out under this part. (2) After the department has notified a person in writing of an alleged violation, the department may grant a 45-day period to cure the alleged violation and issue a letter of guidance. The 45-day cure period does not apply to an alleged violation of paragraph (1)(a). The department may consider the number and frequency of violations, the substantial likelihood of injury to the public, and the safety … Archived from source — captured 2026-09-28 · snapshot 35b376cb Verify at the source

Private right of action

No private right of action.

Archived excerpt — the text we read …n this section. (7) Liability for a tort, contract claim, or consumer protection claim unrelated to an action brought under this section does not arise solely from the failure of a person to comply with this part. (8) This part does not establish a private cause of action. (9) The department may employ or use the legal services of outside counsel and the investigative services of outside personnel to fulfill the obligations of this section. (10) For purposes of bringing an action pursua… Archived from source — captured 2026-08-14 · snapshot d0a51abd Verify at the source

Universal opt-out signal

Not required

Corroborated by Privacy-law tracker

What the law gives consumers

Right to access Archived excerpt — the text we read …a known child, a parent or legal guardian of the child may exercise these rights on behalf of the child. (2) A controller shall comply with an authenticated consumer request to exercise any of the following rights: (a) To confirm whether a controller is processing the consumer’s personal data and to access the personal data. (b) To correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data. (c) To delete any or all personal da… Archived from source — captured 2026-09-28 · snapshot f75978de Verify at the source
Right to correct Archived excerpt — the text we read …ontroller shall comply with an authenticated consumer request to exercise any of the following rights: (a) To confirm whether a controller is processing the consumer’s personal data and to access the personal data. (b) To correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data. (c) To delete any or all personal data provided by or obtained about the consumer. (d) To obtain a copy of the consumer’s personal data in a portable and, to the extent technically feasible, readily usable format if t… Archived from source — captured 2026-09-28 · snapshot f75978de Verify at the source
Right to delete Archived excerpt — the text we read …and to access the personal data. (b) To correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data. (c) To delete any or all personal data provided by or obtained about the consumer. (d) To obtain a copy of the consumer’s personal data in a portable and, to the extent technically feasible, readily usable format if the data is available in a digital format. (e) To opt out of the processing of the p… Archived from source — captured 2026-09-28 · snapshot f75978de Verify at the source
Right to data portability Archived excerpt — the text we read …onal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data. (c) To delete any or all personal data provided by or obtained about the consumer. (d) To obtain a copy of the consumer’s personal data in a portable and, to the extent technically feasible, readily usable format if the data is available in a digital format. (e) To opt out of the processing of the personal data for purposes of: 1. Targeted advertising; 2. The sale of personal data; or 3. Profiling in furtherance of a decision that produces a legal or similarly significan… Archived from source — captured 2026-09-28 · snapshot f75978de Verify at the source
Right to opt out of sale Archived excerpt — the text we read … portable and, to the extent technically feasible, readily usable format if the data is available in a digital format. (e) To opt out of the processing of the personal data for purposes of: 1. Targeted advertising; 2. The sale of personal data; or 3. Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer. (f) To opt out of the collection of sensitive data, including precise geolocation data, or the pro… Archived from source — captured 2026-09-28 · snapshot f75978de Verify at the source
Right to opt out of targeted advertising Archived excerpt — the text we read …sumer’s personal data in a portable and, to the extent technically feasible, readily usable format if the data is available in a digital format. (e) To opt out of the processing of the personal data for purposes of: 1. Targeted advertising; 2. The sale of personal data; or 3. Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer. (f) To opt out of the collection of sensitive data, including pr… Archived from source — captured 2026-09-28 · snapshot f75978de Verify at the source
Right to opt out of profiling for significant decisions Archived excerpt — the text we read …ically feasible, readily usable format if the data is available in a digital format. (e) To opt out of the processing of the personal data for purposes of: 1. Targeted advertising; 2. The sale of personal data; or 3. Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer. (f) To opt out of the collection of sensitive data, including precise geolocation data, or the processing of sensitive data. (g) To opt out of the collection of personal data collected through the operation of a voice… Archived from source — captured 2026-09-28 · snapshot f75978de Verify at the source
Sensitive data: opt-in consent required Also a consumer right to opt out of the collection or processing of sensitive data, including precise geolocation data (501.705(2)(f)). Archived excerpt — the text we read …he material terms of the financial incentive program and provided that such incentive practices are not unjust, unreasonable, coercive, or usurious in nature. The consent may be revoked by the consumer at any time. (d) Process the sensitive data of a consumer without obtaining the consumer’s consent, or, in the case of processing the sensitive data of a known child, without processing that data with the affirmative authorization for such processing by a known child who is between 13 and 18 years of age or in accord… Archived from source — captured 2026-09-28 · snapshot f7a45f0a Verify at the source
Right to appeal Archived excerpt — the text we read 501.707 Appeal.— (1) A controller shall establish a process for a consumer to appeal the controller’s refusal to take action on a request within a reasonable period of time after the consumer’s receipt of the decision under s. 501.706(3). (2) The appeal process must be conspicuously available and similar to the process for initiating action to exercise consumer rights by submitting a request under s. 501.705. (3) A controller shall inform the consumer … Archived from source — captured 2026-09-28 · snapshot 74e7773c Verify at the source
Right against discrimination Archived excerpt — the text we read …ocessed, as disclosed to the consumer, unless the controller obtains the consumer’s consent. (b) Process personal data in violation of state or federal laws that prohibit unlawful discrimination against consumers. (c) Discriminate against a consumer for exercising any of the consumer rights contained in this part, including by denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods or services to the consumer. A controller may offer financial incenti… Archived from source — captured 2026-09-28 · snapshot f7a45f0a Verify at the source
Right to opt out of voice or facial recognition data collection Archived excerpt — the text we read … a decision that produces a legal or similarly significant effect concerning a consumer. (f) To opt out of the collection of sensitive data, including precise geolocation data, or the processing of sensitive data. (g) To opt out of the collection of personal data collected through the operation of a voice recognition or facial recognition feature. (3) A device that has a voice recognition feature, a facial recognition feature, a video recording feature, an audio recording feature, or any other electronic, visual, thermal, or olfactory feature that collects data … Archived from source — captured 2026-09-28 · snapshot f75978de Verify at the source
Not granted: Private right of action Archived excerpt — the text we read …n this section. (7) Liability for a tort, contract claim, or consumer protection claim unrelated to an action brought under this section does not arise solely from the failure of a person to comply with this part. (8) This part does not establish a private cause of action. (9) The department may employ or use the legal services of outside counsel and the investigative services of outside personnel to fulfill the obligations of this section. (10) For purposes of bringing an action pursua… Archived from source — captured 2026-08-14 · snapshot d0a51abd Verify at the source

Who the law governs

Controllers Archived excerpt — the text we read … for the profit or financial benefit of its shareholders or owners; 2. Conducts business in this state; 3. Collects personal data about consumers, or is the entity on behalf of which such information is collected; 4. Determines the purposes and means of processing personal data about consumers alone or jointly with others; 5. Makes in excess of $1 billion in global gross annual revenues; and 6. Satisfies at least one of the following: a. Derives 50 percent or more of its global gross annual revenues from the sale of advertisements onli… Archived from source — captured 2026-09-28 · snapshot 7256c13d Verify at the source
Processors Archived excerpt — the text we read … of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data. (24) “Processor” means a person who processes personal data on behalf of a controller. (25) “Profiling” means any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual’s economic situation, heal… Archived from source — captured 2026-09-28 · snapshot 7256c13d Verify at the source

Exemptions

State agency or political subdivision Archived excerpt — the text we read …a) Conducts business in this state or produces a product or service used by residents of this state; and (b) Processes or engages in the sale of personal data. (2) This part does not apply to any of the following: (a) A state agency or a political subdivision of the state. (b) A financial institution or data subject to Title V, Gramm-Leach-Bliley Act, 15 U.S.C. ss. 6801 et seq. (c) A covered entity or business associate governed by the privacy, security, and breach notification regulati… Archived from source — captured 2026-09-28 · snapshot d4488901 Verify at the source
GLBA: financial institutions and data subject to Title V Entity- and data-level Archived excerpt — the text we read …ervice used by residents of this state; and (b) Processes or engages in the sale of personal data. (2) This part does not apply to any of the following: (a) A state agency or a political subdivision of the state. (b) A financial institution or data subject to Title V, Gramm-Leach-Bliley Act, 15 U.S.C. ss. 6801 et seq. (c) A covered entity or business associate governed by the privacy, security, and breach notification regulations issued by the United States Department of Health and Human Services, 45 C.F.R. parts 160 and 164, establ… Archived from source — captured 2026-09-28 · snapshot d4488901 Verify at the source
HIPAA covered entities and business associates Archived excerpt — the text we read …s part does not apply to any of the following: (a) A state agency or a political subdivision of the state. (b) A financial institution or data subject to Title V, Gramm-Leach-Bliley Act, 15 U.S.C. ss. 6801 et seq. (c) A covered entity or business associate governed by the privacy, security, and breach notification regulations issued by the United States Department of Health and Human Services, 45 C.F.R. parts 160 and 164, established under the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq., and the Health Information Technology for Economic and Clinical Health Act, Division A, Title XIII and Div… Archived from source — captured 2026-09-28 · snapshot d4488901 Verify at the source
Nonprofit organizations Archived excerpt — the text we read …rtability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq., and the Health Information Technology for Economic and Clinical Health Act, Division A, Title XIII and Division B, Title IV, Pub. L. No. 111-5. (d) A nonprofit organization. (e) A postsecondary education institution. (f) The processing of personal data: 1. By a person in the course of a purely personal or household activity. 2. Solely for measuring or reporting advertising performance, r… Archived from source — captured 2026-09-28 · snapshot d4488901 Verify at the source
Postsecondary education institutions Only Florida College System institutions, state universities, and nonpublic postsecondary institutions that receive state funds, 501.702(21). Archived excerpt — the text we read …t of 1996, 42 U.S.C. ss. 1320d et seq., and the Health Information Technology for Economic and Clinical Health Act, Division A, Title XIII and Division B, Title IV, Pub. L. No. 111-5. (d) A nonprofit organization. (e) A postsecondary education institution. (f) The processing of personal data: 1. By a person in the course of a purely personal or household activity. 2. Solely for measuring or reporting advertising performance, reach, or frequency. (3) A controller or pro… Archived from source — captured 2026-09-28 · snapshot d4488901 Verify at the source
Purely personal or household activity processing Archived excerpt — the text we read …r Economic and Clinical Health Act, Division A, Title XIII and Division B, Title IV, Pub. L. No. 111-5. (d) A nonprofit organization. (e) A postsecondary education institution. (f) The processing of personal data: 1. By a person in the course of a purely personal or household activity. 2. Solely for measuring or reporting advertising performance, reach, or frequency. (3) A controller or processor that complies with the authenticated parental consent requirements of the Children’s Online Privacy Prot… Archived from source — captured 2026-09-28 · snapshot d4488901 Verify at the source
Advertising performance measurement processing Archived excerpt — the text we read … Title IV, Pub. L. No. 111-5. (d) A nonprofit organization. (e) A postsecondary education institution. (f) The processing of personal data: 1. By a person in the course of a purely personal or household activity. 2. Solely for measuring or reporting advertising performance, reach, or frequency. (3) A controller or processor that complies with the authenticated parental consent requirements of the Children’s Online Privacy Protection Act, 15 U.S.C. ss. 6501 et seq., with respect to data collected online, is co… Archived from source — captured 2026-09-28 · snapshot d4488901 Verify at the source
Protected health information Archived excerpt — the text we read 501.704 Exemptions.—All of the following information is exempt from this part: (1) Protected health information under the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq. (2) Health records. (3) Patient identifying information for purposes of 42 U.S.C. s. 290dd-2. (4) Identifiable private information: (a) For purposes of the federal policy for the protection of human subjects under 45… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Health records Archived excerpt — the text we read 501.704 Exemptions.—All of the following information is exempt from this part: (1) Protected health information under the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq. (2) Health records. (3) Patient identifying information for purposes of 42 U.S.C. s. 290dd-2. (4) Identifiable private information: (a) For purposes of the federal policy for the protection of human subjects under 45 C.F.R. part 46; (b)… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Patient identifying information under 42 U.S.C. s. 290dd-2 Archived excerpt — the text we read …s.—All of the following information is exempt from this part: (1) Protected health information under the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq. (2) Health records. (3) Patient identifying information for purposes of 42 U.S.C. s. 290dd-2. (4) Identifiable private information: (a) For purposes of the federal policy for the protection of human subjects under 45 C.F.R. part 46; (b) Collected as part of human subjects research under the good clinical pract… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Human subjects research information under federal policy Archived excerpt — the text we read …nsurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq. (2) Health records. (3) Patient identifying information for purposes of 42 U.S.C. s. 290dd-2. (4) Identifiable private information: (a) For purposes of the federal policy for the protection of human subjects under 45 C.F.R. part 46; (b) Collected as part of human subjects research under the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use or the prot… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Good clinical practice/human subjects research information Archived excerpt — the text we read … (3) Patient identifying information for purposes of 42 U.S.C. s. 290dd-2. (4) Identifiable private information: (a) For purposes of the federal policy for the protection of human subjects under 45 C.F.R. part 46; (b) Collected as part of human subjects research under the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use or the protection of human subjects under 21 C.F.R. parts 50 and 56; or (c) That is personal data used or shared in research conducted in accordance with this part or other research conducted in accordance with applicable law. (5) Information and documents created for purposes of the … Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Personal data used in research conducted in accordance with the part or applicable law Archived excerpt — the text we read …clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use or the protection of human subjects under 21 C.F.R. parts 50 and 56; or (c) That is personal data used or shared in research conducted in accordance with this part or other research conducted in accordance with applicable law. (5) Information and documents created for purposes of the Health Care Quality Improvement Act of 1986, 42 U.S.C. ss. 11101 et seq. (6) Patient safety work product for purposes of the Patient Safety and Quality Improve… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Health Care Quality Improvement Act information Archived excerpt — the text we read …tion of human subjects under 21 C.F.R. parts 50 and 56; or (c) That is personal data used or shared in research conducted in accordance with this part or other research conducted in accordance with applicable law. (5) Information and documents created for purposes of the Health Care Quality Improvement Act of 1986, 42 U.S.C. ss. 11101 et seq. (6) Patient safety work product for purposes of the Patient Safety and Quality Improvement Act of 2005, 42 U.S.C. ss. 299b-21 et seq. (7) Information derived from any of the health-care-related information listed in t… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Patient safety work product Archived excerpt — the text we read …ance with this part or other research conducted in accordance with applicable law. (5) Information and documents created for purposes of the Health Care Quality Improvement Act of 1986, 42 U.S.C. ss. 11101 et seq. (6) Patient safety work product for purposes of the Patient Safety and Quality Improvement Act of 2005, 42 U.S.C. ss. 299b-21 et seq. (7) Information derived from any of the health-care-related information listed in this section which is deidentified in accordance with the requirements for deidentification under the Health Insurance Portability and A… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
HIPAA-deidentified health information Archived excerpt — the text we read …of the Health Care Quality Improvement Act of 1986, 42 U.S.C. ss. 11101 et seq. (6) Patient safety work product for purposes of the Patient Safety and Quality Improvement Act of 2005, 42 U.S.C. ss. 299b-21 et seq. (7) Information derived from any of the health-care-related information listed in this section which is deidentified in accordance with the requirements for deidentification under the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq. (8) Information originating from and intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this section which is maintained by a covered entity or business as… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Information intermingled with HIPAA-exempt information Archived excerpt — the text we read …d information listed in this section which is deidentified in accordance with the requirements for deidentification under the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq. (8) Information originating from and intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this section which is maintained by a covered entity or business associate as defined by the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq. or by a program or a qualified service organization as defined by 42 U.S.C. s. 290dd-2. (9) Information include… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
HIPAA limited data set Archived excerpt — the text we read … business associate as defined by the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq. or by a program or a qualified service organization as defined by 42 U.S.C. s. 290dd-2. (9) Information included in a limited data set as described by 45 C.F.R. s. 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified by 45 C.F.R. s. 164.514(e). (10) Information used only for public health activities and purposes as described in 45 C.F.R. s. 164.512. (11) Information collected or used only for public health activities and purposes as authorized by the Health … Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Public health activities information under 45 C.F.R. 164.512 Archived excerpt — the text we read …2. (9) Information included in a limited data set as described by 45 C.F.R. s. 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified by 45 C.F.R. s. 164.514(e). (10) Information used only for public health activities and purposes as described in 45 C.F.R. s. 164.512. (11) Information collected or used only for public health activities and purposes as authorized by the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq. (12) The collection, main… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
HIPAA-authorized public health activities information Archived excerpt — the text we read …at the information is used, disclosed, and maintained in the manner specified by 45 C.F.R. s. 164.514(e). (10) Information used only for public health activities and purposes as described in 45 C.F.R. s. 164.512. (11) Information collected or used only for public health activities and purposes as authorized by the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq. (12) The collection, maintenance, disclosure, sale, communication, or use of any personal data bearing on a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal charact… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
FCRA-regulated data Archived excerpt — the text we read …capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency or furnisher that provides information for use in a consumer report, or by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the Fair Credit Reporting Act, 15 U.S.C. ss. 1681 et seq. (13) Personal data collected, processed, sold, or disclosed in compliance with the Driver’s Privacy Protection Act of 1994, 18 U.S.C. ss. 2721 et seq. (14) Personal data regulated by the Family Educational Rights and … Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Driver's Privacy Protection Act data Archived excerpt — the text we read … information for use in a consumer report, or by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the Fair Credit Reporting Act, 15 U.S.C. ss. 1681 et seq. (13) Personal data collected, processed, sold, or disclosed in compliance with the Driver’s Privacy Protection Act of 1994, 18 U.S.C. ss. 2721 et seq. (14) Personal data regulated by the Family Educational Rights and Privacy Act of 1974, 20 U.S.C. s. 1232g. (15) Personal data collected, processed, sold, or disclosed in compliance with the Farm Credit Act of 1971, 12… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
FERPA-regulated data Archived excerpt — the text we read …der the Fair Credit Reporting Act, 15 U.S.C. ss. 1681 et seq. (13) Personal data collected, processed, sold, or disclosed in compliance with the Driver’s Privacy Protection Act of 1994, 18 U.S.C. ss. 2721 et seq. (14) Personal data regulated by the Family Educational Rights and Privacy Act of 1974, 20 U.S.C. s. 1232g. (15) Personal data collected, processed, sold, or disclosed in compliance with the Farm Credit Act of 1971, 12 U.S.C. ss. 2001 et seq. (16) Data processed or maintained in the course of an individual applying to, bein… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Farm Credit Act data Archived excerpt — the text we read …, or disclosed in compliance with the Driver’s Privacy Protection Act of 1994, 18 U.S.C. ss. 2721 et seq. (14) Personal data regulated by the Family Educational Rights and Privacy Act of 1974, 20 U.S.C. s. 1232g. (15) Personal data collected, processed, sold, or disclosed in compliance with the Farm Credit Act of 1971, 12 U.S.C. ss. 2001 et seq. (16) Data processed or maintained in the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data i… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Employment data Archived excerpt — the text we read …by the Family Educational Rights and Privacy Act of 1974, 20 U.S.C. s. 1232g. (15) Personal data collected, processed, sold, or disclosed in compliance with the Farm Credit Act of 1971, 12 U.S.C. ss. 2001 et seq. (16) Data processed or maintained in the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role. (17) Data processed or maintained as the emergency contact information of an individual under this part which is used for emergency contact purposes. (18) Data that is processed or maintained and that is necessary to … Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Emergency contact information Archived excerpt — the text we read …vidual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role. (17) Data processed or maintained as the emergency contact information of an individual under this part which is used for emergency contact purposes. (18) Data that is processed or maintained and that is necessary to retain to administer benefits for another individual which relates to an individual described in subsection (16) and which is used for the purposes of … Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Benefits administration data Archived excerpt — the text we read …he data is collected and used within the context of that role. (17) Data processed or maintained as the emergency contact information of an individual under this part which is used for emergency contact purposes. (18) Data that is processed or maintained and that is necessary to retain to administer benefits for another individual which relates to an individual described in subsection (16) and which is used for the purposes of administering those benefits. (19) Personal data collected and transmitted which is necessary for the sole purpose of sharing such personal data with a financial service provider solely to facilitate short-term, transactional payment processing for… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Short-term transactional payment processing data Archived excerpt — the text we read …ntained and that is necessary to retain to administer benefits for another individual which relates to an individual described in subsection (16) and which is used for the purposes of administering those benefits. (19) Personal data collected and transmitted which is necessary for the sole purpose of sharing such personal data with a financial service provider solely to facilitate short-term, transactional payment processing for the purchase of products or services. (20) Personal data collected, processed, sold, or disclosed in relation to price, route, or service as those terms are used in the Airline Deregulation Act, 49 U.S.C. ss. 40101 et seq., by entities subject to that act,… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Airline Deregulation Act preempted data Archived excerpt — the text we read …d which is necessary for the sole purpose of sharing such personal data with a financial service provider solely to facilitate short-term, transactional payment processing for the purchase of products or services. (20) Personal data collected, processed, sold, or disclosed in relation to price, route, or service as those terms are used in the Airline Deregulation Act, 49 U.S.C. ss. 40101 et seq., by entities subject to that act, to the extent the provisions of this act are preempted by 49 U.S.C. s. 41713. (21) Personal data shared between a manufacturer of a tangible product and authorized third-party distributors or vendors of the product, as long as such personal data is used solely for advertising, marketing, or serv… Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Manufacturer-distributor data used only for marketing/servicing Manufacturer-authorized distributor/vendor shared data used solely for advertising, marketing, or servicing the product (no onward sale or sharing). Archived excerpt — the text we read …oute, or service as those terms are used in the Airline Deregulation Act, 49 U.S.C. ss. 40101 et seq., by entities subject to that act, to the extent the provisions of this act are preempted by 49 U.S.C. s. 41713. (21) Personal data shared between a manufacturer of a tangible product and authorized third-party distributors or vendors of the product, as long as such personal data is used solely for advertising, marketing, or servicing the product that is acquired directly through such manufacturer and such authorized third-party distributors or vendors. Such personal data may not be sold or shared unless otherwise authorized under this part. History.—s. 7, ch. 2023-201. Copyright © 1995-2026 The Florida Legislature • Privacy Statement • Contact Us Archived from source — captured 2026-09-28 · snapshot 09d59e2d Verify at the source
Privileged communications to a person covered by an evidentiary privilege Archived excerpt — the text we read …ion, it must provide prior notice of the new or changed practice to the consumer. The notice must be sufficiently prominent and robust to ensure that consumers can easily exercise choices consistent with this part. (2) This part may not be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of this state as part of a privileged communication. (3) This part may not be construed as imposing a requirement on controllers and processors which adversely affects the rights or freedoms of any person, including the right of free speech. (4) This part may not be con… Archived from source — captured 2026-09-28 · snapshot 1098b9ea Verify at the source
Evidentiary privilege (compliance would violate a Florida evidentiary privilege) Archived excerpt — the text we read …ller; or 3. Otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party. (2) A requirement imposed on a controller or processor under this part does not apply if compliance with the requirement by the controller or processor, as applicable, would violate an evidentiary privilege under the laws of this state. History.—s. 20, ch. 2023-201. Copyright © 1995-2026 The Florida Legislature • Privacy Statement • Contact Us Archived from source — captured 2026-09-28 · snapshot 63571984 Verify at the source
Trade secrets (no obligation to disclose) Archived excerpt — the text we read …rivileged communication. (3) This part may not be construed as imposing a requirement on controllers and processors which adversely affects the rights or freedoms of any person, including the right of free speech. (4) This part may not be construed as requiring a controller, processor, third party, or consumer to disclose a trade secret. History.—s. 19, ch. 2023-201. Copyright © 1995-2026 The Florida Legislature • Privacy Statement • Contact Us Archived from source — captured 2026-09-28 · snapshot 1098b9ea Verify at the source
Rights and freedoms of others, including free speech Archived excerpt — the text we read … construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of this state as part of a privileged communication. (3) This part may not be construed as imposing a requirement on controllers and processors which adversely affects the rights or freedoms of any person, including the right of free speech. (4) This part may not be construed as requiring a controller, processor, third party, or consumer to disclose a trade secret. History.—s. 19, ch. 2023-201. Copyright © 1995-2026 The Florida Legislature • Privacy Stat… Archived from source — captured 2026-09-28 · snapshot 1098b9ea Verify at the source

Published Sep 30, 2026 from the DataGrail regulation engine; each fact links to its primary source.

Timeline

FDBR milestones

This state currently has one dated milestone on the books.

Enforcement July 1, 2024

FDBR took effect

Enforcement began — obligations have been live since this date.

Source: primary citation

Published Sep 30, 2026 from the DataGrail regulation engine; each fact links to its primary source. Reference only, not legal advice.

Status Signed Who it applies to Enforced by Universal opt-out signal — Privacy-law tracker

When staying on top of the law isn't enough, DataGrail automates the work.

DSR automation and regulatory tracking — handled by the platform behind this reference.

How DataGrail helps

Back to the Regulations Hub Reference only — not legal advice. Published Sep 30, 2026