Most of Florida’s Privacy Law Skips Your Business. One Section Does Not.

The threshold that excuses almost everybody

The controller definition requires all six of its conditions, including revenues in excess of one billion dollars and being an advertising business, smart speaker maker or app store operator. A Naples business does not meet it, and the consumer rights machinery turns on it.

Start with what does not apply, because it is most of the law and it is what the compliance emails are about. To be a controller, an entity has to satisfy every one of six conditions: it is organized for profit, conducts business in the state, collects personal data about consumers, determines the purposes and means of processing, makes in excess of one billion dollars in global gross annual revenues, and then satisfies at least one more test¹.

That last test narrows it further still. The entity must derive fifty percent or more of its global gross annual revenues from selling advertisements online including targeted advertising, or operate a consumer smart speaker with an integrated virtual assistant, or operate an app store or digital distribution platform offering at least 250,000 different applications¹.

Read as a whole, that describes a very short list of companies, and a Naples med spa, law firm or roofing contractor is not on it. So the machinery people associate with state privacy laws, the consumer access and deletion requests and the formal privacy notice obligations, is not switched on for you by this statute. If somebody has sold you a compliance package on the basis that Florida law requires it, that is the claim to go back and ask about.

It is worth being precise about what that does and does not settle. It settles the controller obligations. It does not settle whether some other part of the same statute reaches you, and it says nothing about federal law, about other states whose residents you may serve, or about the accuracy of the privacy claims you already make. Those are separate questions with separate answers.

The section that leaves the threshold out

The sensitive data section applies to a person meeting subparagraphs one through three of the controller definition: organized for profit, doing business in Florida, collecting personal data. The revenue threshold and platform test are not referenced, so ordinary businesses are within scope.

Here is the sentence that changes the analysis. The statute says a person who meets the requirements of section 501.702(9)(a)1. through 3. for the definition of a controller may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer². Look carefully at the cross-reference: subparagraphs one through three, not the whole definition.

Those first three subparagraphs are being organized or operated for the profit or financial benefit of shareholders or owners, conducting business in this state, and collecting personal data about consumers or being the entity on whose behalf it is collected¹. There is no revenue figure among them and no platform test. A for-profit Florida business with a website that collects customer information meets all three.

The drafting looks deliberate rather than accidental, because the rest of the part refers to controllers without qualification. Whatever the intent, the effect is that this particular restriction operates on a much wider population than the law it sits inside, and it is routinely described as though it did not.

This is also the reason we checked each section separately rather than reading the controller definition once and assuming it governed everything. Had we stopped at the billion dollar threshold, the conclusion would have been that Florida privacy law is irrelevant to a small business here, and that conclusion would have been wrong in a way that mattered.

What counts as sensitive data, and what counts as a sale

Sensitive data covers health diagnosis, religious belief, ethnicity, sexual orientation, immigration status, biometrics, anything collected from a person under eighteen, and precise geolocation within 1,750 feet. A sale includes transfers made for other valuable consideration, not only those made for money, which is a considerably wider net.

The category is broader than most people assume. Sensitive data includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status. It also includes genetic or biometric data processed to identify someone uniquely, personal data collected from a known child, and precise geolocation data¹.

Two of those deserve a second look by any local business. Precise geolocation is defined as identifying a location within a radius of 1,750 feet¹, which is well within the accuracy of an ordinary mobile browser. And a child is defined as anyone younger than eighteen, with a known child being one whose age the business actually knows or willfully disregards¹. That is a higher age than most operators have in mind.

The other half is what counts as a sale, and the wording is wider than the word suggests. It means the sharing, disclosing or transferring of personal data for monetary or other valuable consideration to a third party¹. Arrangements involving no money at all can still fall inside a definition written that way, which is precisely why this needs a lawyer rather than a marketer.

There are meaningful carve-outs, and they matter. Disclosure to a processor who handles data on your behalf is excluded, as is disclosure to a third party for the purpose of providing a product or service the consumer requested¹. For a med spa or medical practice, where health information and marketing tools meet, the distinction between those categories is exactly the question worth putting to counsel, alongside the separate advertising rules we covered in the piece on before and after photos.

The notice the statute writes for you

Where the section applies, it prescribes the exact words: NOTICE: This website may sell your sensitive personal data. It also defines consent in a way that excludes acceptance of broad terms of use, incidental interactions, and anything obtained through dark patterns.

Statutes rarely dictate copy, which is what makes this unusual and easy to check. A person engaging in the sale of sensitive data must provide the following notice: "NOTICE: This website may sell your sensitive personal data."² That is the text, given in the statute itself rather than described, so there is nothing to paraphrase or improve.

The consent requirement that sits alongside it is equally specific, and it rules out the mechanisms most sites rely on. Consent means a clear affirmative act signifying a freely given, specific, informed and unambiguous agreement, and the statute expressly says it does not include acceptance of a general or broad terms of use document, nor hovering over, muting, pausing or closing a piece of content¹.

It also excludes agreement obtained through the use of dark patterns, defining a dark pattern as a user interface designed or manipulated with the effect of substantially subverting or impairing user autonomy, decisionmaking or choice, and adding that the term includes any practice the Federal Trade Commission refers to as a dark pattern¹. A banner whose decline option is deliberately hard to find is squarely the thing being described.

For a business that does not sell sensitive data, none of this creates an obligation, and adding the notice when it does not apply would be its own kind of inaccuracy. The useful exercise is narrower and more uncomfortable: find out what your website actually transmits and to whom, because most owners have never been told, and the answer usually involves tools somebody installed years ago.

1. Rule out the main obligations first. Revenue in excess of a billion dollars plus a platform test. Almost certainly not you.
2. Then read the sensitive data section separately. It cites only subparagraphs one through three, so the threshold does not protect you here.
3. Inventory what your site actually collects. Forms, chat, booking, analytics, advertising pixels, anything capturing location or health details.
4. Ask where each of those sends data, and why. The processor and requested-service carve-outs turn on that answer.
5. Take the sale question to a Florida attorney. Whether an arrangement is a sale is a legal judgment, not a marketing one.
6. Make your privacy policy describe reality. A generated policy that misdescribes what you do is a separate problem regardless of this statute.

Who can actually enforce this

A violation is an unfair and deceptive trade practice actionable solely by the Department of Legal Affairs, so there is no private right of action. Penalties run to fifty thousand dollars per violation and may be tripled where a known child is involved.

The enforcement picture is narrower than the penalty figure suggests, and the narrow part is the reassuring part. A violation of this part is an unfair and deceptive trade practice actionable solely by the Department of Legal Affairs³, which is the Florida Attorney General. That word solely is doing real work: there is no private right of action, so this is not a statute that generates demand letters from consumers.

The penalty is up to fifty thousand dollars per violation³. Penalties may be tripled in two situations: where the violation involves a Florida consumer who is a known child, and where there is a failure to delete or correct personal data after an authenticated consumer request³. On age specifically, the statute says a controller that willfully disregards a consumer age is deemed to have actual knowledge of it³.

That last clause is worth sitting with if you have ever considered not asking. Deliberate ignorance of a visitor age is treated as knowledge, which removes the usual incentive to avoid finding out. For businesses whose services or content plausibly attract people under eighteen, that changes how the question should be approached rather than whether it should be.

And the boundary we hold to on every one of these. This is a description of what a published statute says, not advice about your situation, and nothing here should be actioned without a Florida attorney who can look at your specific data flows. What we can usefully do alongside that is the technical half: establishing what your website actually collects and transmits, which is the factual groundwork any legal analysis has to start from. Our free SEO audit covers part of that picture, and the credential and access questions in who can log into your website are the adjacent piece.

• No private right of action. Only the Attorney General can bring an action.
• Up to fifty thousand dollars per violation, tripled in two named situations.
• Willfully disregarding a visitor age counts as knowing it.
• A child here means anyone under eighteen, not under thirteen.
• Nothing above is legal advice, and the sale question needs a lawyer.