USA – FLORIDA Trends and Developments Contributed by: Jason Loring, Andrew Lee and Lara Sevener, Jones Walker LLP
Jones Walker LLP Brickell World Plaza 600 Brickell Avenue Suite 3300 Miami, Florida, 33131 USA Tel: +1 404 870 7531 Email: jloring@joneswalker.com Web: www.joneswalker.com
Florida’s Privacy Landscape: A Targeted Approach Unlike broad consumer privacy laws adopted by oth - er states, Florida’s framework is intentionally narrow, targeted and politically shaped. Florida focuses on Big Tech monopolies, foreign ownership risks and AI accountability rather than generalised privacy compli - ance. The result: Many businesses operate without comprehensive privacy obligations, while a select few face intense scrutiny. As 2026 unfolds, Florida’s strat - egy is generating significant enforcement actions and legislative momentum that warrant close attention. With a selective approach to privacy, many busi - nesses are outside the scope of Florida’s omnibus consumer privacy rights law, the Florida Digital Bill of Rights (FDBR) but still face breach notification and security duties under the Florida Information Protec - tion Act (FIPA), and they may have additional obliga - tions if their online platforms or services are directed at, or substantially used by, minors. Florida has no general privacy notice requirement for most compa - nies, no mandated consumer rights mechanisms, and no affirmative data governance obligations outside the narrow FDBR context. Certain categories, however, do face heavy scrutiny: Big Tech platforms subject to the FDBR, foreign-owned healthcare companies col - lecting biometric or demographic data and operators of AI systems interacting with children. Understand - ing whether an organisation falls into one of these targeted categories is essential for 2026 compliance planning.
The Florida Digital Bill of Rights: A Big Tech Law The FDBR took effect in July 2024 and targets the world’s largest technology platforms. The law applies exclusively to controllers with more than USD1 billion in global gross annual revenue that also meet one of three criteria: (i) derive 50% or more of revenue from online advertising, (ii) operate a smart speaker or voice command service not integrated into vehicles, or (iii) operate an app store with at least 250,000 applica - tions. This threshold limits coverage to a small group of global platforms such as Google, Meta, Apple and Amazon, while exempting mid-market businesses entirely. (Importantly, Florida imposes no comprehen - sive privacy programme, notice or data rights obliga - tions on mid-market or small businesses.) For covered entities, the obligations are substantial. The FDBR provides Florida consumers with access, correction, deletion and portability rights, plus the ability to opt out of targeted advertising, sales and profiling activities. Controllers must respond to con - sumer requests within 45 days, with a possible one- time extension of 15 days when reasonably neces - sary. The law requires controllers to provide at least two accessible methods for consumers to submit requests, accommodating how consumers normally interact with the controller. Controllers must conduct data protection assess - ments for high-risk processing activities. These assessments must identify and weigh the benefits and risks of processing, considering the use of de- identified data, reasonable consumer expectations and the relationship between controller and consum -
576 CHAMBERS.COM
Powered by FlippingBook