# The Florida Privacy Rule That Reaches You

> Florida’s privacy law exempts almost every small business through a $1 billion threshold. One section drops it, and prescribes an exact website notice.

[Home](https://seoagencynaples.com/) / [Blog](https://seoagencynaples.com/blog/) / Compliance Florida Compliance
# Most of Florida’s Privacy Law Skips Your Business. One Section Does Not.
Florida businesses keep being sold compliance packages for a state privacy law whose main obligations begin at a billion dollars in revenue. The sales pitch is wrong. It is also not the whole story, because one section quietly leaves the threshold out.

By [Jamie Kloncz](https://seoagencynaples.com/jamie-kloncz/), Founder and CEO, SEO Elite Agency ** 15 min read ** Published August 31, 2026

The Florida Digital Bill of Rights is real, it is in force, and for almost every business in Southwest Florida its headline obligations do not apply. The definition that switches them on requires an entity to make in excess of one billion dollars in global gross annual revenues, and then to also be an online advertising business, a smart speaker maker, or an app store operator [1](#ref-1).
That is the part worth knowing before you buy anything. It is not, however, the end of the analysis, and this is where most coverage stops. One section of the same statute cites only the first three subparagraphs of that definition, deliberately leaving out the revenue threshold and the platform test [2](#ref-2). What remains reaches ordinary Florida businesses that collect personal data.
This guide sets out where the line actually falls, what the statute counts as sensitive data and as a sale, the exact notice text it prescribes, and who can enforce it. One thing it is not is legal advice. Whether any particular arrangement on your website amounts to a sale of sensitive data is a legal question about your specific business, and the right person to answer it is a Florida attorney.

## The threshold that excuses almost everybody
The controller definition requires all six of its conditions, including revenues in excess of one billion dollars and being an advertising business, smart speaker maker or app store operator. A Naples business does not meet it, and the consumer rights machinery turns on it.
Start with what does not apply, because it is most of the law and it is what the compliance emails are about. To be a controller, an entity has to satisfy every one of six conditions: it is organized for profit, conducts business in the state, collects personal data about consumers, determines the purposes and means of processing, makes in excess of one billion dollars in global gross annual revenues, and then satisfies at least one more test [1](#ref-1).
That last test narrows it further still. The entity must derive fifty percent or more of its global gross annual revenues from selling advertisements online including targeted advertising, or operate a consumer smart speaker with an integrated virtual assistant, or operate an app store or digital distribution platform offering at least 250,000 different applications [1](#ref-1).
Read as a whole, that describes a very short list of companies, and a Naples med spa, law firm or roofing contractor is not on it. So the machinery people associate with state privacy laws, the consumer access and deletion requests and the formal privacy notice obligations, is not switched on for you by this statute. If somebody has sold you a compliance package on the basis that Florida law requires it, that is the claim to go back and ask about.
It is worth being precise about what that does and does not settle. It settles the controller obligations. It does not settle whether some other part of the same statute reaches you, and it says nothing about federal law, about other states whose residents you may serve, or about the accuracy of the privacy claims you already make. Those are separate questions with separate answers.

## The section that leaves the threshold out
The sensitive data section applies to a person meeting subparagraphs one through three of the controller definition: organized for profit, doing business in Florida, collecting personal data. The revenue threshold and platform test are not referenced, so ordinary businesses are within scope.
Here is the sentence that changes the analysis. The statute says a person who meets the requirements of section 501.702(9)(a)1. through 3. for the definition of a controller may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer [2](#ref-2). Look carefully at the cross-reference: subparagraphs one through three, not the whole definition.
Those first three subparagraphs are being organized or operated for the profit or financial benefit of shareholders or owners, conducting business in this state, and collecting personal data about consumers or being the entity on whose behalf it is collected [1](#ref-1). There is no revenue figure among them and no platform test. A for-profit Florida business with a website that collects customer information meets all three.
The drafting looks deliberate rather than accidental, because the rest of the part refers to controllers without qualification. Whatever the intent, the effect is that this particular restriction operates on a much wider population than the law it sits inside, and it is routinely described as though it did not.
This is also the reason we checked each section separately rather than reading the controller definition once and assuming it governed everything. Had we stopped at the billion dollar threshold, the conclusion would have been that Florida privacy law is irrelevant to a small business here, and that conclusion would have been wrong in a way that mattered.
Condition in the controller definition Main obligations Sensitive data section
Organized for profit Required Required
Conducts business in Florida Required Required
Collects personal data about consumers Required Required
Determines purposes and means of processing Required Not referenced
Revenue in excess of $1 billion Required **Not referenced**
Ad business, smart speaker or app store Required **Not referenced**

Source: Florida Statutes sections 501.702, 501.715 and 501.72, 2025 edition Download SVG

## What counts as sensitive data, and what counts as a sale
Sensitive data covers health diagnosis, religious belief, ethnicity, sexual orientation, immigration status, biometrics, anything collected from a person under eighteen, and precise geolocation within 1,750 feet. A sale includes transfers made for other valuable consideration, not only those made for money, which is a considerably wider net.
The category is broader than most people assume. Sensitive data includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status. It also includes genetic or biometric data processed to identify someone uniquely, personal data collected from a known child, and precise geolocation data [1](#ref-1).
Two of those deserve a second look by any local business. Precise geolocation is defined as identifying a location within a radius of 1,750 feet [1](#ref-1), which is well within the accuracy of an ordinary mobile browser. And a child is defined as anyone younger than eighteen, with a known child being one whose age the business actually knows or willfully disregards [1](#ref-1). That is a higher age than most operators have in mind.
The other half is what counts as a sale, and the wording is wider than the word suggests. It means the sharing, disclosing or transferring of personal data for monetary or other valuable consideration to a third party [1](#ref-1). Arrangements involving no money at all can still fall inside a definition written that way, which is precisely why this needs a lawyer rather than a marketer.
There are meaningful carve-outs, and they matter. Disclosure to a processor who handles data on your behalf is excluded, as is disclosure to a third party for the purpose of providing a product or service the consumer requested [1](#ref-1). For a med spa or medical practice, where health information and marketing tools meet, the distinction between those categories is exactly the question worth putting to counsel, alongside the separate advertising rules we covered in [the piece on before and after photos](https://seoagencynaples.com/blog/med-spa-before-after-photos-ftc-rules/).

## The notice the statute writes for you
Where the section applies, it prescribes the exact words: NOTICE: This website may sell your sensitive personal data. It also defines consent in a way that excludes acceptance of broad terms of use, incidental interactions, and anything obtained through dark patterns.
Statutes rarely dictate copy, which is what makes this unusual and easy to check. A person engaging in the sale of sensitive data must provide the following notice: "NOTICE: This website may sell your sensitive personal data." [2](#ref-2) That is the text, given in the statute itself rather than described, so there is nothing to paraphrase or improve.
The consent requirement that sits alongside it is equally specific, and it rules out the mechanisms most sites rely on. Consent means a clear affirmative act signifying a freely given, specific, informed and unambiguous agreement, and the statute expressly says it does not include acceptance of a general or broad terms of use document, nor hovering over, muting, pausing or closing a piece of content [1](#ref-1).
It also excludes agreement obtained through the use of dark patterns, defining a dark pattern as a user interface designed or manipulated with the effect of substantially subverting or impairing user autonomy, decisionmaking or choice, and adding that the term includes any practice the Federal Trade Commission refers to as a dark pattern [1](#ref-1). A banner whose decline option is deliberately hard to find is squarely the thing being described.
For a business that does not sell sensitive data, none of this creates an obligation, and adding the notice when it does not apply would be its own kind of inaccuracy. The useful exercise is narrower and more uncomfortable: find out what your website actually transmits and to whom, because most owners have never been told, and the answer usually involves tools somebody installed years ago.

- **Rule out the main obligations first.** Revenue in excess of a billion dollars plus a platform test. Almost certainly not you.
- **Then read the sensitive data section separately.** It cites only subparagraphs one through three, so the threshold does not protect you here.
- **Inventory what your site actually collects.** Forms, chat, booking, analytics, advertising pixels, anything capturing location or health details.
- **Ask where each of those sends data, and why.** The processor and requested-service carve-outs turn on that answer.
- **Take the sale question to a Florida attorney.** Whether an arrangement is a sale is a legal judgment, not a marketing one.
- **Make your privacy policy describe reality.** A generated policy that misdescribes what you do is a separate problem regardless of this statute.

## Who can actually enforce this
A violation is an unfair and deceptive trade practice actionable solely by the Department of Legal Affairs, so there is no private right of action. Penalties run to fifty thousand dollars per violation and may be tripled where a known child is involved.
The enforcement picture is narrower than the penalty figure suggests, and the narrow part is the reassuring part. A violation of this part is an unfair and deceptive trade practice actionable solely by the Department of Legal Affairs [3](#ref-3), which is the Florida Attorney General. That word solely is doing real work: there is no private right of action, so this is not a statute that generates demand letters from consumers.
The penalty is up to fifty thousand dollars per violation [3](#ref-3). Penalties may be tripled in two situations: where the violation involves a Florida consumer who is a known child, and where there is a failure to delete or correct personal data after an authenticated consumer request [3](#ref-3). On age specifically, the statute says a controller that willfully disregards a consumer age is deemed to have actual knowledge of it [3](#ref-3).
That last clause is worth sitting with if you have ever considered not asking. Deliberate ignorance of a visitor age is treated as knowledge, which removes the usual incentive to avoid finding out. For businesses whose services or content plausibly attract people under eighteen, that changes how the question should be approached rather than whether it should be.
And the boundary we hold to on every one of these. This is a description of what a published statute says, not advice about your situation, and nothing here should be actioned without a Florida attorney who can look at your specific data flows. What we can usefully do alongside that is the technical half: establishing what your website actually collects and transmits, which is the factual groundwork any legal analysis has to start from. Our [free SEO audit](https://seoagencynaples.com/free-seo-audit/) covers part of that picture, and the credential and access questions in [who can log into your website](https://seoagencynaples.com/blog/website-passwords-mfa-admin-access/) are the adjacent piece.

- No private right of action. Only the Attorney General can bring an action.
- Up to fifty thousand dollars per violation, tripled in two named situations.
- Willfully disregarding a visitor age counts as knowing it.
- A child here means anyone under eighteen, not under thirteen.
- Nothing above is legal advice, and the sale question needs a lawyer.

Test yourself
## Where does Florida’s privacy law actually reach?
Five questions from the 2025 Florida Statutes, sections 501.702, 501.715 and 501.72, all linked in this guide.

- 1 What revenue does the main controller definition require? $25 million $100 million In excess of $1 billion There is no threshold **Answer:** In excess of $1 billion The definition requires an entity to make in excess of one billion dollars in global gross annual revenues, and then to also satisfy at least one further test: deriving half its revenue from online advertising, operating a consumer smart speaker with a virtual assistant, or running an app store with at least 250,000 applications. Almost no Florida business clears the first bar, and fewer still clear the second.
- 2 Does that mean the whole law skips a small business? Yes, entirely No, one section cites only part of the definition Only if it has no website Only for businesses under ten staff **Answer:** No, one section cites only part of the definition This is the detail that gets missed. The sensitive data section applies to a person meeting the requirements of subparagraphs one through three of the controller definition, which are being organized for profit, conducting business in the state, and collecting personal data about consumers. It deliberately leaves out the revenue threshold and the platform test, so it reaches ordinary Florida businesses.
- 3 Which of these counts as sensitive data under the statute? Email addresses Precise geolocation data Business phone numbers Company names **Answer:** Precise geolocation data Sensitive data includes precise geolocation, defined as identifying a location within a radius of 1,750 feet. It also covers data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship status, along with biometric data used to identify someone and any personal data collected from a known child, meaning anyone under eighteen.
- 4 What does the statute count as a sale of personal data? Only exchanges for cash Sharing or transferring for monetary or other valuable consideration Only transfers to data brokers Only transfers outside Florida **Answer:** Sharing or transferring for monetary or other valuable consideration The definition covers sharing, disclosing or transferring personal data for monetary or other valuable consideration to a third party. The phrase covering other valuable consideration is the one that matters, because arrangements that involve no money can still qualify. There are carve-outs, including disclosure to a processor acting on your behalf and disclosure needed to provide something the customer asked for.
- 5 Who can bring an action under this part of the statute? Any consumer Class action attorneys Solely the Department of Legal Affairs Any competitor **Answer:** Solely the Department of Legal Affairs A violation is treated as an unfair and deceptive trade practice actionable solely by the Department of Legal Affairs, which is the Florida Attorney General. There is no private right of action, which is genuinely reassuring and rarely mentioned. The civil penalty is up to fifty thousand dollars per violation, and penalties may be tripled where the consumer is a known child.
Honest self-check. There is no sign-up, and nothing is stored.

Questions answered
## Straight answers to the common questions
The questions readers ask about this topic, answered directly. **No forms, no sales pitch.**

JAMIE KLONCZ · SEO AGENCY NAPLES ************** ONLINE
Pick a question on the left, or search above. You will get the direct answer, the way an answer engine would give it.

← PREV NEXT → [FREE AUDIT →](https://seoagencynaples.com/free-seo-audit/)

- **Does the Florida Digital Bill of Rights apply to my small business?** Its main obligations almost certainly do not. To be a controller under the statute an entity must satisfy all six conditions in the definition, including making in excess of one billion dollars in global gross annual revenues, and additionally being an online advertising business deriving half its revenue from ad sales, a consumer smart speaker maker, or an app store operator offering at least 250,000 applications. Very few companies anywhere meet that, and no ordinary Southwest Florida business does. However, one section of the same statute uses a narrower cross-reference that omits the revenue threshold, so the answer is not a simple no.
- **Which part of the law can still reach a small business?** The section dealing with sensitive data. It applies to a person meeting the requirements of subparagraphs one through three of the controller definition, which are being organized or operated for profit, conducting business in this state, and collecting personal data about consumers. It does not reference the billion dollar revenue threshold or the platform test that the rest of the definition contains. A for-profit Florida business whose website collects customer information meets those three conditions, which is why reading the controller definition once and assuming it governs the whole statute produces the wrong answer.
- **What does the statute treat as sensitive data?** A broader category than most people expect. It covers personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status. It also covers genetic or biometric data processed to uniquely identify an individual, any personal data collected from a known child, and precise geolocation data. Two definitions are worth noting: precise geolocation means identifying a location within a radius of 1,750 feet, which an ordinary mobile browser can achieve, and a child means anyone younger than eighteen rather than the thirteen that many operators assume.
- **What counts as selling data if no money changes hands?** Possibly quite a lot, because the definition is not limited to money. The statute defines a sale as the sharing, disclosing or transferring of personal data for monetary or other valuable consideration to a third party. Arrangements where data flows to a platform in exchange for services or capabilities rather than cash can fall within wording drafted that way. There are exclusions that matter, including disclosure to a processor handling data on your behalf and disclosure to a third party in order to provide a product or service the consumer requested. Whether a specific arrangement is a sale is a legal question for a Florida attorney.
- **Is there really a required notice, word for word?** Yes, which is unusual for a statute and makes this easy to check. Where the sensitive data section applies, a person engaging in the sale of sensitive data must provide the following notice: NOTICE: This website may sell your sensitive personal data. The statute sets out that sentence itself rather than describing what the notice should convey, so there is no room for a better wording. Equally important is the flip side: if the section does not apply to your business, publishing that notice anyway would misdescribe what you do, which is its own problem.
- **Does a cookie banner count as consent?** Not on its own, and the statute is specific about what does not qualify. Consent means a clear affirmative act signifying a freely given, specific, informed and unambiguous agreement. It expressly excludes acceptance of a general or broad terms of use or similar document, and excludes hovering over, muting, pausing or closing a piece of content. It also excludes agreement obtained through dark patterns, which the statute defines as an interface designed or manipulated to substantially subvert or impair user autonomy, decisionmaking or choice, and says the term includes any practice the Federal Trade Commission refers to as a dark pattern.
- **Can a customer sue us under this law?** No. The statute states that a violation of this part is an unfair and deceptive trade practice actionable solely by the Department of Legal Affairs, which is the Florida Attorney General. There is no private right of action, so this particular law does not generate consumer lawsuits or the demand letter traffic seen with some other website compliance issues. Enforcement carries a civil penalty of up to fifty thousand dollars per violation, and penalties may be tripled where the consumer is a known child or where there is a failure to delete or correct data after an authenticated request. None of this is legal advice about your situation.

## References

- Florida Legislature. Florida Statutes s. 501.702, Definitions (2025). accessed 31 August 2026. [https://www.flsenate.gov/Laws/Statutes/2025/501.702](https://www.flsenate.gov/Laws/Statutes/2025/501.702)
- Florida Legislature. Florida Statutes s. 501.715, Requirements for sensitive data (2025). accessed 31 August 2026. [https://www.flsenate.gov/Laws/Statutes/2025/501.715](https://www.flsenate.gov/Laws/Statutes/2025/501.715)
- Florida Legislature. Florida Statutes s. 501.72, Enforcement and implementation by the Department of Legal Affairs (2025). accessed 31 August 2026. [https://www.flsenate.gov/Laws/Statutes/2025/501.72](https://www.flsenate.gov/Laws/Statutes/2025/501.72)

Written by
## [Jamie Kloncz](https://seoagencynaples.com/jamie-kloncz/)
Founder and CEO, SEO Elite Agency
Jamie Kloncz is the founder and CEO of SEO Elite Agency, the firm behind SEO Agency Naples. An engineer who scaled his own plumbing business to 3 million dollars in revenue and led growth for over 200 teams, he built this agency on one principle: every SEO action must connect directly to revenue, not vanity metrics.
[More about Jamie →](https://seoagencynaples.com/jamie-kloncz/)

Free · No pressure
## See where your business actually stands
Start with a free audit of your rankings, Google Business Profile, technical health, and AI-search visibility, with a prioritized plan and an honest quote for your situation.
[Get your free audit](https://seoagencynaples.com/free-seo-audit/)

Keep reading
## Related guides
[Compliance How Med Spas Can Advertise Before-and-After Results Within the FTC Guides Read guide →](https://seoagencynaples.com/blog/med-spa-before-after-photos-ftc-rules/)[Local SEO Why the Same SEO Playbook Fails Across Naples Industries Read guide →](https://seoagencynaples.com/blog/naples-industry-ranking-constraints/)[Technical SEO The Password Rules Your Business Follows Are the Ones NIST Tells You to Stop Using Read guide →](https://seoagencynaples.com/blog/website-passwords-mfa-admin-access/)