Who the Florida Digital Bill of Rights Reaches: The Controller Tests, Section 501.715 and the 2024 Rules

The $1 Billion Controller Threshold

The Senate record for CS/CS/SB 262 lists the 2023 bill as "Technology Transparency," a title that covers more than privacy: it also restricts government employees' requests to social media platforms and regulates online platforms used by children. The bill passed the Senate 40 to 0 and the House 110 to 2 in final form on May 4, 2023, was approved by the Governor on June 6, 2023, and was assigned chapter number 2023-201, Laws of Florida, effective July 1, 2024 except as otherwise provided. The privacy portion is part V of chapter 501, sections 501.701 through 501.722, titled the Florida Digital Bill of Rights by section 501.701.

Section 501.703(1) states the part's outer boundary broadly. It applies only to a person who conducts business in Florida or produces a product or service used by Florida residents, and who processes or engages in the sale of personal data. Almost every operative duty, however, is written for a "controller," and the definition of that word in section 501.702(9) is where the statute departs from the Virginia template that other states followed. Under paragraph (a), a controller is a sole proprietorship, partnership, limited liability company, corporation, association or other legal entity that meets all six of these requirements:

• It is organized or operated for the profit or financial benefit of its shareholders or owners
• It conducts business in Florida
• It collects personal data about consumers, or is the entity on whose behalf that information is collected
• It determines the purposes and means of processing personal data about consumers, alone or jointly with others
• It makes in excess of $1 billion in global gross annual revenues
• It satisfies at least one of the three tests in subparagraph 6

Paragraph (b) adds "any entity that controls or is controlled by a controller," with control measured by more than 50 percent of voting shares, control over the election of a majority of directors, or the power to exercise a controlling influence over management. A subsidiary or parent of a qualifying company is therefore a controller in its own right, whatever its own revenue.

Section 501.703(2) then removes whole classes of entity: state agencies and political subdivisions, financial institutions or data subject to Title V of the Gramm-Leach-Bliley Act, HIPAA covered entities and business associates, nonprofit organizations as defined in section 501.702(18), and postsecondary education institutions. It also excludes processing in the course of a purely personal or household activity and processing solely for measuring or reporting advertising performance, reach or frequency. Section 501.704 lists 21 categories of exempt information, from protected health information to personal data shared between a manufacturer and its authorized distributors solely for advertising, marketing or servicing the product.

The Three Alternative Tests

Subparagraph 6 of section 501.702(9)(a) is what confines the controller class to a small number of businesses. An entity satisfies it in any one of three ways:

• It derives 50 percent or more of its global gross annual revenues from the sale of advertisements online, including providing targeted advertising or the sale of ads online
• It operates a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation
• It operates an app store or a digital distribution platform that offers at least 250,000 different software applications for consumers to download and install

Each test has its own boundary. The advertising test is measured against global revenue, not Florida revenue, so the share of a company's worldwide income that comes from online advertising decides it. The smart speaker test excludes "a motor vehicle or speaker or device associated with or connected to a vehicle which is operated by a motor vehicle manufacturer or a subsidiary or affiliate thereof," so an in-car voice assistant run by a carmaker does not qualify on that basis. The app store test turns on a count of distinct applications offered to consumers.

Two further provisions reach a subset of controllers. Section 501.71(4) requires a controller that operates a search engine to publish, without a login, a plain-language description of the main parameters that determine ranking, "including the prioritization or deprioritization of political partisanship or political ideology in search results." Section 501.72(10) provides that a controller which collects, shares or sells Floridians' personal data is considered to be doing business in Florida and subject to the jurisdiction of its courts for an enforcement action.

Consumer Rights Under §§ 501.705-501.709

Section 501.705(2) lists seven rights that a controller honors on an authenticated request. Five follow the familiar pattern: confirmation and access, correction, deletion, a portable copy, and opting out of targeted advertising, sale and profiling that produces legal or similarly significant effects. Two are distinctive. Paragraph (f) gives a right to opt out of "the collection of sensitive data, including precise geolocation data, or the processing of sensitive data," and paragraph (g) a right to opt out of personal data "collected through the operation of a voice recognition or facial recognition feature." Subsection (3) separately bars a device with a voice recognition, facial recognition, video recording, audio recording or other data-collecting feature from using it for surveillance by the controller or processor when the feature is not in active use by the consumer, unless the consumer expressly authorizes it.

The procedure runs through four sections. Under section 501.706 a controller responds within 45 days, extendable once by 15 days, and gives notice within 60 days of receipt that it has complied. A controller is not required to act on a request it cannot authenticate but must make a reasonable effort to obtain the information needed to do so. Section 501.707 requires an appeal process, with a written decision within 60 days of the appeal. Section 501.708 voids any contract term that waives or limits these rights, and section 501.709 requires two or more secure, reliable and conspicuous request methods, plus a mechanism on the controller's website.

Rule 2-3.004 of the Florida Administrative Code, effective July 18, 2024, sets the authentication standard: a commercially reasonable method chosen by weighing the rights sought, the type, sensitivity, value and volume of the data, the possible harm from improper access, and cost. A controller may not charge a fee for authentication, must delete any additional information it collects for that purpose once authentication is complete, and uses its existing login process where the consumer holds a password-protected account. Rule 2-3.001 defines who may act for a consumer, including a person with express written authority, an agent under a power of attorney, and a parent or legal guardian of a child.

The Sensitive Data Sale Provision That Reaches Everyone

Section 501.715 is drafted differently from the rest of the part. Its subject is "a person who meets the requirements of s. 501.702(9)(a)1.-3. for the definition of a controller," which incorporates only the first three conditions: operated for profit, conducting business in Florida, and collecting personal data about consumers. The revenue floor and the three business-model tests do not apply. Such a person "may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer." For a known child, the alternative is affirmative authorization by a child between 13 and 18 years of age, or processing in accordance with COPPA for a child under 13.

Subsection (2) requires anyone covered by the section who sells sensitive data to post the notice "NOTICE: This website may sell your sensitive personal data." Subsection (3) makes a violation subject to the penalty in section 501.72. Three definitions shape the provision's reach:

• Sensitive data, in section 501.702(31), is personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data processed to uniquely identify an individual; personal data collected from a known child; and precise geolocation data
• Sale of personal data, in section 501.702(29), is sharing, disclosing or transferring personal data "for monetary or other valuable consideration" to a third party, subject to four exclusions including disclosures to a processor and transfers in a merger or acquisition
• Consent, in section 501.702(7), is a clear affirmative act, and expressly excludes acceptance of general terms of use, hovering over, muting, pausing or closing content, and agreement obtained through dark patterns

Controllers carry a parallel set of notice duties in section 501.711: an annually updated privacy notice, the same sensitive data notice where they sell sensitive data, and a separate "NOTICE: This website may sell your biometric personal data" where they sell biometric data.

Children and Online Platforms

The Act's definition of a child, in section 501.702(6), is "an individual younger than 18 years of age." A known child, under subsection (17), is one whose age the controller actually knows "or willfully disregards." Section 501.71(2)(d) applies the same consent structure as section 501.715 to all processing of a known child's sensitive data, and section 501.705(1) lets a parent or legal guardian exercise the consumer rights on behalf of a known child.

Rule 2-3.003 explains willful disregard. A controller willfully disregards a consumer's age if, based on facts or circumstances readily available to it, it "should reasonably have been aroused to question whether a consumer was a child and thereafter failed to perform reasonable age verification." The department will not make that finding where the controller applies a reasonable age verification method to all of its consumers and the method indicated an adult, unless the controller later learned otherwise and failed to act. The same rule requires reasonable parental verification before a person is allowed to exercise rights as a known child's parent.

The same 2023 bill created a separate statute for children outside part V. Section 501.1735 applies to an "online platform," meaning a social media platform as defined in section 112.23(1), an online game or an online gaming platform, that provides a service, product, game or feature "likely to be predominantly accessed by children." It prohibits processing a child's personal information where the platform knows or willfully disregards that the processing may result in substantial harm or privacy risk to children, restricts profiling, collection and secondary use, limits precise geolocation collection to what is strictly necessary and requires an obvious sign during it, and bars dark patterns. The platform bears the burden of showing its processing complies. Enforcement is by the Department of Legal Affairs alone, at up to $50,000 per violation, tripled for a violation involving a Florida child the platform actually knows is under 18.

Department of Legal Affairs Enforcement

Section 501.72(1) makes a violation of part V an unfair and deceptive trade practice "actionable under part II of this chapter solely by the Department of Legal Affairs," and states that sections 501.211 and 501.212 do not apply to those actions. The department may collect a civil penalty of up to $50,000 per violation, which may be tripled for a violation involving a known Florida child, a failure to delete or correct data after an authenticated request, or continuing to sell or share data after an opt-out. Subsection (2) gives the department discretion to grant a 45-day cure period after written notice, weighing the number and frequency of violations, the likelihood of public injury and safety, but the cure period does not apply to the known-child category. Actions may be brought only on behalf of a Florida consumer, and subsection (8) states that the part does not establish a private cause of action.

Subsection (5) directed the department to adopt rules. It did so in chapter 2-3 of the Florida Administrative Code, four rules effective July 18, 2024. Rule 2-3.002 requires a controller to maintain data security practices that comply with the NIST risk management framework incorporated by reference, to designate a qualified individual to oversee them, to protect a mixed data set at the level of its most sensitive data, and not to store unencrypted personal data on mobile devices or passive storage media. Rule 2-3.003 lists what a consumer complaint to the department contains and provides that the department will not grant a cure period for alleged violations involving a child.

Subsection (4) requires the department to publish, by February 1 each year, a report giving the number of complaints, the enforcement actions taken and their outcomes, and the complaints resolved without litigation. The department's posted report could not be retrieved for this article: its website returned an access error when requested, so no complaint or penalty figures are reported here. Records the department receives in an investigation are confidential under section 501.722 until the investigation is completed or ceases to be active, and that exemption is scheduled to be repealed on October 2, 2028 unless the Legislature saves it.

Frequently Asked Questions