Florida Digital Bill of Rights (Fla. Stat. 501.701 to 501.722; ch. 2023-201, CS/CS/SB 262): profiling opt-out and data protection assessments

Summary

Florida's Digital Bill of Rights, enacted in SB 262 (chapter 2023-201) and in force since July 1, 2024, gives consumers rights against a narrowly defined set of controllers: for-profit businesses with more than $1 billion in global gross annual revenue that also meet one of three tests (at least half of revenue from online advertising, operating a consumer smart speaker and voice-command service, or operating an app store with at least 250,000 applications). Consumers may opt out of profiling in furtherance of a decision that produces a legal or similarly significant effect, defined to include decisions on financial and lending services. Profiling means solely automated processing to evaluate or predict personal aspects such as economic situation, reliability or behavior. Controllers must conduct and document a data protection assessment of profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial, physical or reputational injury. Financial institutions and GLBA-covered data are excluded. Violations are unfair and deceptive trade practices enforced only by the Department of Legal Affairs, with civil penalties of up to $50,000 per violation, tripled in specified cases.

Key dates

1. June 6, 2023Enacted
2. July 1, 2024Takes effect
3. October 16, 2026Checked against sources
4. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. This part may be cited as the “Florida Digital Bill of Rights.”

   Supports: Name

   Fla. Stat. 501.701, Short title (2026 Florida Statutes) Florida Legislature (Online Sunshine) Primary source

2. Approved by the Governor June 6, 2023.

   Supports: Approval date

   this act shall take effect July 1, 2024.

   Supports: Effective date

   Chapter 2023-201, Laws of Florida (CS/CS/SB 262) Florida Department of State (laws.flrules.org) Primary source

3. Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer.

   Supports: Profiling opt-out

   Fla. Stat. 501.705, Consumer rights Florida Legislature (Online Sunshine) Primary source

4. means any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual’s economic situation

   Supports: Profiling definition

   Makes in excess of $1 billion in global gross annual revenues

   Supports: Controller revenue threshold

   means a decision made by a controller which results in the provision or denial by the controller of any of the following:

   Supports: Significant-decision definition (first item: financial and lending services)

   Fla. Stat. 501.702, Definitions Florida Legislature (Online Sunshine) Primary source

5. The processing of personal data for purposes of profiling if the profiling presents a reasonably foreseeable risk of:

   Supports: Assessment duty for risky profiling

   Fla. Stat. 501.713, Data protection assessments Florida Legislature (Online Sunshine) Primary source

6. A financial institution or data subject to Title V, Gramm-Leach-Bliley Act, 15 U.S.C. ss. 6801 et seq.

   Supports: Financial institution and GLBA exclusion

   Fla. Stat. 501.703, Applicability Florida Legislature (Online Sunshine) Primary source

7. the department may collect a civil penalty of up to $50,000 per violation

   Supports: Penalty and enforcement

   Fla. Stat. 501.72, Enforcement and implementation by the Department of Legal Affairs Florida Legislature (Online Sunshine) Primary source