Florida has become the latest state to enact a comprehensive privacy law this year when SB 262 was signed by Governor DeSantis last week. It combines some new, and some familiar, provisions. It has also passed a child privacy law, similar to parts of California’s Age Appropriate Design Act, going into effect July 1, 2024.
The Florida Digital Bill of Rights Law
Entities that will be covered by this law are very limited. The law will apply only to those who earn $1 billion in global gross annual revenues and either (1) receive 50% of gross annual revenue from the sale of online ads, (2) operate cloud-connected smart speakers with virtual assistants, or (3) have an app store or digital distribution platform that has at least 250,000 apps available for download.
Like other states, the Florida law applies to consumer information, and provides many exemptions. This includes financial institutions subject to GLBA, HIPAA covered entities and business associates, non-profits, and higher education institutions. Aside from entity exemptions, there are also data exemptions. For example, information collected as part of human subject research.
Violations carry high possible penalties: $50,000 per violation. The AG has discretion on whether to offer companies a 45 cure period. The AG must adopt rules about authenticated consumer requests, enforcement, data security, and authorized agents. The law has no private right of action.
The requirements for the limited number of companies to whom this Florida law applies are similar to those in other states. This includes giving consumers rights of access, correction and deletion. Consumers can also opt out of targeted advertising and profiling that could create significant legal impacts. An opt-in is required for processing sensitive information. The law provides for data minimization and content requirements in privacy notices.
Given the narrow scope of companies to which the law applies, it does have some unique features not seen elsewhere. These include, among other things:
- Allowing consumers to opt out of the collection of personal data from voice recognition or facial recognition technology features.
- Controllers that operate a search engine must publish an up-to-date plain language description of how search results are ranked, including the prioritization or de-prioritization of political partisanship or political ideology in search results.
- Companies must establish data retention schedules and, in the absence of a schedule, must dispose of consumer data two years after the last interaction.
Florida’s New Children’s Privacy Law for Social Media Platforms
As part of the bill, Florida also passed a new law that will apply to operators of social media platforms who have platforms that are accessed by Florida children. These companies will have restrictions similar to California’s Age Appropriate Design Act. (But by contrast, the California law applies more broadly than just to social media platforms and includes those who provide online products, services or features to children.) This Florida law also follows Utah laws from earlier this year (which go into effect in March 2024). Those, as we have written, apply to social media companies with more than five million account holders worldwide and are thus narrower in scope than the new Florida law.
Restrictions under Florida’s law include not processing children’s data if substantial harm will result. Social media platforms also cannot profile a child unless necessary, and will not be able to use a child’s information for any reason other than the stated purpose of collecting the information.
As in California, children are defined as those under 18. Violations carry high possible penalties ($50,000 per violation), but companies have a 45 cure period. The law provides for potential rulemaking, and has no private right of action.
Putting it into Practice: Florida has now joined the growing number of states with comprehensive privacy laws (currently, ten in total), although its requirements will likely not apply to most entities. It also joins California in targeting legislation towards social media platforms, something we may see in more states in the coming months.