USA – FLORIDA Trends and Developments Contributed by: Jason Loring, Andrew Lee and Lara Sevener, Jones Walker LLP
er. Required assessments cover targeted advertising, sale of personal data, profiling that presents reason - ably foreseeable risks, processing of sensitive data and other processing involving heightened risk. These assessments must be documented and made avail - able to the Florida Department of Legal Affairs (the “Department”) upon request. Enforcement rests exclusively with the Department, which can assess penalties of up to USD50,000 per violation, tripled for violations involving children or fail - ures to honour deletion and opt-out requests. The law provides a 45-day cure period for alleged violations, though this opportunity does not apply to violations that knowingly involve children. If, after notification of an alleged violation, the entity cures the violation with - in 45 days and provides proof to the Department, no enforcement action can proceed, though the Depart - ment may issue a letter of guidance that no future cure period will apply. First Enforcement: The Roku Action In October 2025, Attorney General (AG) James Uth - meier brought Florida’s first FDBR enforcement action against video streaming provider Roku. The complaint alleged that Roku collected and sold children’s sen - sitive data without obtaining required consent and notice, enabled reidentification of children’s data and failed to provide effective privacy controls and opt-out mechanisms, violating both the FDBR and the Florida Deceptive and Unfair Trade Practices Act. This enforcement action signals several enforcement priorities for the AG’s office. First, protection of chil - dren’s data receives heightened attention, consist - ent with the statute’s tripled penalties for violations involving minors. Second, transparency in data sales practices is non-negotiable; controllers must clearly disclose when they sell personal data and provide effective opt-out mechanisms. Third, the AG expects covered entities to obtain affirmative consent before collecting children’s information, not merely rely on age-neutral consent mechanisms. The timing of the Roku action, coming barely 15 months after the FDBR’s effective date, signals that Big Tech platforms subject to the law should expect active enforcement. Covered entities should review
their practices with regard to collection of children’s data, data sales disclosures and opt-out mechanisms to ensure compliance. The CHINA Prevention Unit: Targeting Foreign- Owned Healthcare Companies While FDBR enforcement has begun targeting plat - form behaviour, Florida’s privacy regulators are also targeting a different category of risk: foreign owner - ship and sensitive data collection. In February 2026, Uthmeier announced the creation of the CHINA Prevention Unit, a specialised enforce - ment initiative within the AG’s office investigating foreign corporations, particularly those with Chinese ownership, that collect consumer data from Florida residents. The AG’s office has identified healthcare as a primary enforcement focus, citing concerns that sensitive health data may be shared with foreign adversaries. The unit has already issued subpoenas to medical device manufacturers, including demands for audits to identify ties to China and verify whether biometric or patient data is being transmitted to for - eign servers. This development creates immediate compliance risks for healthcare technology companies with for - eign ownership or investment. The CHINA Prevention Unit’s mandate encompasses Florida’s data breach notification law, data security requirements and con - sumer protection statutes. Its creation reflects con - cerns that foreign adversaries could exploit health data access for intelligence purposes, individual tar - geting or infrastructure vulnerability assessment. Telehealth platforms, health and fitness apps, genetic testing companies and medical device manufacturers with foreign ties should conduct ownership structure assessments and data transfer audits. Key compli - ance steps include documenting the corporate owner - ship chain, mapping data flows to determine whether personal information is transferred internationally and assessing whether business relationships with foreign entities create exposure under the CHINA Prevention Unit’s mandate. The CHINA Prevention Unit reflects broader concerns about foreign access to sensitive health information.
577 CHAMBERS.COM
Powered by FlippingBook