iQ Cookie State Law Series
Cookie & Privacy Law in Florida
Educational purposes only — not legal advice. This guide is intended to help you understand Florida’s data privacy laws as they relate to cookie consent and website compliance. Laws change, and your specific situation may vary. Always consult a qualified legal professional before making compliance decisions. iQ Cookie is a technology tool, not a law firm.
The short version
Florida is the outlier in this series so far. Where every other state so far applies to any mid-sized business hitting a consumer-count threshold, the Florida Digital Bill of Rights (FDBR) was built to target Big Tech specifically — think Google, Amazon, Apple, and Meta. Roughly 20–30 companies worldwide actually meet its bar. If your site is not a billion-dollar ad, smart-speaker, or app-store platform, the FDBR itself almost certainly does not apply to you.
But Florida is not a free pass. A separate law — the state’s minors’ social media statute — applies far more broadly and is already being actively enforced, regardless of your company’s size.
Who does it apply to?
The FDBR applies only to businesses meeting both a revenue floor and at least one "Big Tech" activity test:
More than $1 billion in global gross annual revenue, doing business in Florida or targeting Florida residents.
50%+ of revenue from online ad sales; operates a smart speaker/voice assistant; or runs an app store with 250,000+ apps.
Most iQ Cookie clients will not meet this threshold. The FDBR was deliberately written narrow. Don’t skip the checklist below, though — the state’s minors’ social media law applies regardless of your revenue.
Consumer rights (for covered entities)
Florida residents whose data is handled by a covered controller have these rights:
Businesses must respond within 45 days, extendable once by 45 more. Only the Florida Attorney General can enforce — there is no private right of action.
What makes Florida different
Built for roughly 20–30 companies worldwide. No other state privacy law in this series is this narrow. The $1 billion revenue floor plus a specific business-model test keeps it aimed squarely at platforms, not typical websites.
No GPC requirement. Unlike California, Colorado, Connecticut, and Delaware, Florida does not reference Global Privacy Control or any universal opt-out signal. Even covered entities are not obligated to honor it.
The real Florida risk is a separate law: the minors’ social media statute. Fla. Stat. § 501.1736 bans social media accounts for under-14s outright and requires parental consent for 14–15-year-olds — and it is not limited to billion-dollar companies. It has been in active enforcement since November 2025.
First FDBR enforcement action already filed. The Florida AG sued Roku in October 2025 over alleged collection and sale of children’s sensitive data without parental consent — showing the state will use the law it wrote, narrow as it is.
Dark patterns and age-estimation reuse are banned for children’s data. Fla. Stat. § 501.1735 prohibits manipulative design aimed at extracting kids’ data and restricts reusing age-estimation signals beyond their original purpose — this applies more broadly than the main FDBR thresholds.
Sensitive data & children
For covered entities, selling sensitive data requires prior consent. Sensitive categories include:
Regardless of FDBR coverage, Florida’s under-14 social media account ban and 14–15 parental consent requirement apply broadly — if your platform functions like social media and could reach Florida minors, treat this as a compliance requirement even if you are far below the FDBR’s $1 billion threshold.
What this means for your cookies
| Cookie / data type | Requirement | What to do |
|---|---|---|
| Any cookies (non-covered sites) | FDBR does not apply | If you are under the $1B revenue floor, the FDBR itself is not your concern — but check the minors’ social media law below. |
| Voice / facial recognition features | Opt-out required | Covered entities only: give a clear opt-out for biometric feature use. |
| Targeted advertising cookies | Opt-out required | Covered entities only: provide an opt-out for sale and targeted ads. |
| GPC / opt-out signals | Not required | No FDBR obligation, but honoring it keeps you consistent with your other state guides. |
| Accounts / tracking for under-14s | Prohibited | Applies to any social-media-style platform, regardless of FDBR revenue size. |
Enforcement
The Florida Attorney General has exclusive enforcement authority, with no private right of action. A 45-day cure period applies after written notice. The AG has already used the law: a October 2025 action against Roku alleged unlawful collection and sale of children’s sensitive data without parental consent — a useful signal that Florida will enforce the narrow set of companies it does cover, and enforce the broader minors’ social media law aggressively.
Your action checklist
Most sites will find step 1 is the whole answer — but do not skip step 2:
Check the FDBR revenue floor first. Under $1 billion in global gross annual revenue? The FDBR itself does not apply to you. Most iQ Cookie clients can stop here for this specific law.
Check the minors’ social media law regardless of size. If your platform functions like social media and could reach Florida users under 16, review account-age verification and parental consent requirements — this one is not revenue-gated.
If you are a covered FDBR entity: add opt-outs for targeted ads, data sales, profiling, and voice/facial recognition features.
Avoid dark patterns aimed at children’s data regardless of your FDBR status — this restriction is broader than the main law’s thresholds.
Watch for FDBR revenue growth. If your company is approaching $1 billion in global revenue and has an ad, smart-device, or app-store business line, start preparing now — this is one to revisit annually.
Review vendor contracts if you are a covered entity — processors handling Florida resident data need a written agreement specifying processing instructions and confidentiality.
iQ Cookie checks both the FDBR threshold and the minors’ social media rules, and deploys a lightweight US-built consent banner either way.
iQ Cookie State Law Series · Guide 7 of 25 · Next: Indiana →