On June 6, 2023, the governor signed the Florida Digital Bill of Rights into law. We previously covered the consumer privacy bill here. The law targets larger companies because a “controller” must have $1 billion in global gross revenue, plus one of the following:
- 50% of global gross revenue comes from the sale of advertisements online;
- operates a consumer smart speaker and voice command service; or
- operates an app store or digital distribution platform with at least 250,000 different software applications.
Fla. Stat. 501.702(9).
Of note, for controllers, the definition of targeting advertising includes some first party targeting, which has typically been excluded from other consumer privacy laws. In Florida, “targeted advertising” is more broadly defined as, “displaying to a consumer an advertisement selected based on personal data obtained from that consumer’s activities over time across affiliated or unaffiliated websites and online applications used to predict the consumer’s preferences or interests.” Fla. Stat. 501.702(33) (emphasis added). Excluded from definition is “an advertisement that is:
- Based on the context of a consumer’s current search query on the controller’s own website or online application; or
- Directed to a consumer search query on the controller’s own website or online application in response to the consumer’s request for information or feedback.”
Fla. Stat. 501.702(33).
Typically, other states excluded affiliated websites and applications from the definition of targeted advertising. Like other states with consumer privacy laws, Florida requires controllers to allow consumers to opt out of the processing personal data for targeted advertising. But, because of the broad definition of targeted advertising, Florida’s opt-out now covers practices previous excluded under other state laws.
All businesses, regardless of whether they hit the controller revenue and processing thresholds, must obtain consent from a consumer prior to selling that consumer’s sensitive personal data. If a business sell’s sensitive personal data, its website must include a specific disclosure, “NOTICE: This website may sell your sensitive personal data.” Fla. Stat. 501.715(2).
For more information, please contact the author or your SPB relationship partner.
Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only, and is not intended to constitute or be relied upon as legal advice.