Florida Digital Bill of Rights (FDBR) Assessment

It correctly starts with this threshold gateway. The FDBR only applies if there is a Florida connection and the organization processes or sells personal data.

Florida’s official statute makes FDBR applicability unusually narrow. The covered controller generally must be a for-profit legal entity with annual global revenue over $1 billion and must meet at least one of these criteria: derive 50% of global gross annual revenue from sales of online advertisements, operate a consumer smart speaker/voice assistant service, or operate an app store or digital distribution platform with at least 250,000 different software applications.

It lists major exemptions, including state agencies and political subdivisions, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions, Health Insurance Portability and Accountability Act (HIPAA) covered entities and business associates, nonprofits, post-secondary institutions, and several exempt data categories such as certain medical data, research data, GLBA data, Fair Credit Report Act (FCRA) data, Family Educational Rights and Privacy Act (FERPA) data, Farm Credit Act (FCA) data, Driver’s Privacy Protection Act (DPPA) data, employment data, and emergency-response data. Florida’s statute also includes carve-outs for purely personal or household activity and measuring or reporting advertising performance, reach, or frequency.

It treats data mapping and classification as foundational because organizations need to know what personal data they collect, where it is stored, how it flows, who has access, and what safeguards apply.

The FDBR gives covered consumers rights to access, correction, deletion, portability, and opt out of targeted advertising, sale, profiling with significant effects, collection of sensitive data, and collection of personal data through certain voice or facial recognition features.

It tracks the FDBR timelines: generally 45 days to respond, one possible 15-day extension when justified, denial notices with reasons and appeal instructions, and an appeal process with a response generally due within 60 days.

It maps several notice and transparency duties. For a public assessment, this question checks whether your organization can explain what data it collects, why it uses it, what rights are available, and how consumers exercise them.

Florida provides certain consumer-rights exemptions for pseudonymous data or aggregate consumer information if organizations can demonstrate that identifying information is kept separate and subject to effective controls that they do not improperly re-identify or misuse such data.

It references data protection assessments and risk-related handling, and Florida’s FDBR includes obligations around handling sensitive data and documenting certain higher-risk processing.

It includes controller, processor, affiliate, and sharing concepts, and FDBR compliance depends in part on whether your organization can show appropriate control over how personal data is handled across the ecosystem.

It incorporates Florida’s children’s online protections. Florida’s current statute defines “child” as a consumer under 18 years of age and imposes separate obligations for child-directed online offerings.

The assessment includes provisions related to Florida children’s protections. In a public assessment, this question checks for governance over child-directed features and privacy-by-design for minors.

Because it is now April 2026, this matters. Florida’s statutes are updated from time to time, and the official Florida statutes page states that changes effective through January 1, 2026 are already treated as current for the published statutes.