Does the Florida Digital Bill of Rights apply to my business?

Florida passed a privacy law that sounds sweeping and applies narrowly. The Florida Digital Bill of Rights took effect on July 1, 2024, but the definition of who has to comply is unusual: the core duties reach only for-profit companies above a $1 billion revenue line that also run a specific kind of tech business. For most Florida companies, the honest answer to "does it apply to me?" is no, and the useful work is confirming that quickly.

Who counts as a controller under the FDBR?

Under Fla. Stat. Section 501.702(9), a controller is a for-profit legal entity that conducts business in Florida, collects personal data about consumers, determines the purposes and means of processing, makes in excess of $1 billion in global gross annual revenues, and satisfies at least one of three additional tests. All of those have to be true together. An entity that controls or is controlled by such a controller is also covered. The revenue figure is a floor, not a ceiling, and it is what removes almost everyone from the core obligations.

What is the $1 billion threshold?

The three tests sit on top of the revenue floor. A controller qualifies if it derives 50 percent or more of its global gross annual revenues from the sale of online advertisements, or operates a consumer smart speaker and voice command service with an integrated virtual assistant, or operates an app store or digital distribution platform that offers at least 250,000 different software applications for download. This is why the law is often described as aimed at big-tech platforms: the combination of a billion-dollar floor and these prongs was drafted to land there.

Does the FDBR reach small businesses?

For the core controller duties, no. A company under $1 billion in global revenue, or one that clears the revenue line but fails all three prongs, is outside them. That does not mean Florida imposes nothing: some narrower provisions of the law use different definitions and can apply more broadly, and a smaller business selling to Florida residents may still fall under other states' privacy laws that use far lower applicability thresholds. The point is to run the FDBR test on its own terms rather than assume a new state law automatically applies.

How Florida compares with other states

Florida sits at one extreme of a spectrum. The Texas TDPSA has no revenue threshold at all and gates on the federal small-business definition, while the California CCPA uses a $25 million revenue or 100,000-consumer test. A mid-sized SaaS company can be squarely covered in Texas and California yet fall entirely outside Florida's core duties. That is why a single "are we a covered business?" answer does not travel across states.

Next step

If you sell to Florida residents and want to know whether the FDBR or any other state law reaches you, the free 2-minute Obligation Scan runs the Florida controller test and the other states' thresholds against your business and lists the duties that follow. The US state privacy laws hub shows where Florida fits among the enacted laws.