On June 6, 2023, the governor signed the Florida Digital Bill of Rights into law. We previously covered the consumer privacy bill here. The law targets larger companies because a “controller” must have $1 billion in global gross revenue, plus one of the following:

1. 50% of global gross revenue comes from the sale of advertisements online;
2. operates a consumer smart speaker and voice command service; or
3. operates an app store or digital distribution platform with at least 250,000 different software applications.

Fla. Stat. 501.702(9).

Of note, for controllers, the definition of targeting advertising includes some first-party targeting, which has typically been excluded from other consumer privacy laws. In Florida, “targeted advertising” is more broadly defined as, “displaying to a consumer an advertisement selected based on personal data obtained from that consumer’s activities over time across affiliated or unaffiliated websites and online applications used to predict the consumer’s preferences or interests.” Fla. Stat. 501.702(33) (emphasis added). Excluded from definition is “an advertisement that is:

1. Based on the context of a consumer’s current search query on the controller’s own website or online application; or
2. Directed to a consumer search query on the controller’s own website or online application in response to the consumer’s request for information or feedback.”

Fla. Stat. 501.702(33).

Typically, other states excluded affiliated websites and applications from the definition of targeted advertising. Like other states with consumer privacy laws, Florida requires controllers to allow consumers to opt out of the processing personal data for targeted advertising. But, because of the broad definition of targeted advertising, Florida’s opt-out now covers practices previously excluded under other state laws.

All businesses, regardless of whether they hit the controller revenue and processing thresholds, must obtain consent from a consumer prior to selling that consumer’s sensitive personal data. If a business sells sensitive personal data, its website must include a specific disclosure, “NOTICE: This website may sell your sensitive personal data.” Fla. Stat. 501.715(2).