Florida Biometric Privacy Law: Consent, Retention, and Penalties

Florida does not have a dedicated biometric privacy law. Protections for fingerprints, facial scans, voiceprints, and other biometric identifiers sit inside the Florida Digital Bill of Rights (FDBR), codified at Florida Statutes §§501.701–501.721, which took effect July 1, 2024. The law treats biometric data as “sensitive data” and gives consumers consent and opt-out rights, but it applies only to companies with more than $1 billion in annual global gross revenue, and only the Florida Department of Legal Affairs can enforce it.¹

What Counts as Biometric Data Under Florida Law

The FDBR classifies biometric data as sensitive data alongside information revealing racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship or immigration status, genetic data, precise geolocation, and personal data from children. Biometric data under the law means data processed to uniquely identify an individual. Sensitive data carries stricter rules than ordinary personal data: a covered company cannot process it without the consumer’s consent, and extra notice obligations apply if the company sells it.¹

Which Companies Are Actually Covered

This is the point most readers need to understand first, because it determines whether the law touches a given situation at all. A business is a “controller” subject to the FDBR only if it exceeds $1 billion in annual global gross revenue and also meets at least one of these criteria:

Derives at least 50 percent of its global gross revenue from selling online advertisements.
Operates a consumer smart speaker and voice command service connected to a cloud computing platform.
Runs an app store or digital distribution platform offering at least 250,000 different software applications.

That is the highest applicability threshold of any state privacy law in the country. Small and mid-sized Florida businesses that collect biometric data fall outside the FDBR entirely.¹

Several categories of large organizations are also carved out: state and local government agencies, financial institutions governed by the Gramm-Leach-Bliley Act, HIPAA-covered entities and their business associates, nonprofits, and postsecondary education institutions. Personal or household data processing is outside the law’s reach as well.¹

One boundary matters especially for workplace biometrics. The FDBR protects Florida residents acting in an individual or household capacity. It does not cover people acting in a commercial or employment context. If your employer scans your fingerprint for a time clock in Florida, the FDBR gives you no rights over that data.

Your Rights Over Biometric Data

If a controller is covered, Florida consumers can submit authenticated requests to exercise the following rights:

Confirm whether the controller is processing their personal data and access it.
Request deletion of personal data the controller collected.
Opt out of the sale of their personal data, including biometric data.
Opt out of processing for targeted advertising and profiling.
Opt out of the collection of personal data obtained through voice recognition or facial recognition features.

That last right is distinctive. Few other state privacy laws include a dedicated facial and voice recognition opt-out. If a covered company uses facial recognition inside an app or voice recognition through a smart device, a Florida consumer can refuse that specific collection.¹

Consent, Notices, and Sale of Biometric Data

A covered controller cannot process biometric data without the consumer’s affirmative consent. That is a stricter standard than the FDBR applies to ordinary personal data, which can be processed under several legal bases without opt-in consent.¹

Controllers must also maintain a reasonably accessible privacy notice, updated at least annually, that lists the categories of personal data processed, the purposes of processing, how to exercise consumer rights, categories of third parties receiving data, and opt-out methods.²

Florida does not ban selling biometric data. A controller that obtains consent and posts the required disclosure can legally sell it to third parties. When biometric data is sold, the company must prominently display this notice: “NOTICE: This website may sell your biometric personal data.” A separate notice is required for the sale of other sensitive data. A controller also cannot start collecting new categories of data or repurpose previously collected data without updating its privacy notice first.²

A consumer who originally consented can later direct the controller to stop selling their data. Continuing to sell it after that request is a violation that triggers the law’s tripled penalties.

How Long Companies Can Keep Biometric Data

Controllers and processors must adopt retention schedules that destroy personal data at whichever of these points comes first:

The original purpose for collecting the data has been satisfied.
The contract under which the data was collected ends.
Two years pass after the consumer’s last interaction with the controller or processor.

Narrow exceptions allow retention for providing a good or service the consumer requested, fixing bugs, or internal uses aligned with consumer expectations.¹

Penalties and How the Law Is Enforced

The Florida Department of Legal Affairs has exclusive enforcement authority over the FDBR. There is no private right of action. Individual consumers cannot sue a company, cannot recover damages in court, and cannot bring class-action lawsuits under this law. The only route is a complaint to the state.¹

When the Department pursues a violation, the civil penalties are:

Up to $50,000 per violation for standard violations.
Up to $150,000 per violation when the violation involves a known child, when a controller fails to delete or correct data after a valid consumer request, or when a controller keeps selling data after a consumer opts out.

Before enforcement, the Department generally provides a 45-day cure period, giving the business a chance to fix the problem. Violations are treated as unfair and deceptive trade practices, which opens additional remedies under Florida’s broader consumer protection framework.¹

How Florida Differs From Illinois’ BIPA

Many online summaries describing “Florida biometric privacy law” actually describe provisions from SB 1270, a 2019 bill closely modeled on Illinois’ Biometric Information Privacy Act. SB 1270 would have required written consent, banned profiting from biometric data, and created a private right of action with $1,000 and $5,000 liquidated damages. It died in committee without a hearing and never became law.³⁴

What Florida ended up with looks very different from Illinois:

Scope. BIPA applies to any private entity possessing biometric identifiers. The FDBR applies only to billion-dollar companies meeting additional tech-sector criteria.
Private lawsuits. BIPA lets individuals sue for $1,000 per negligent violation or $5,000 per intentional or reckless violation. The FDBR provides no private right of action.
Sale. BIPA flatly prohibits selling, leasing, or profiting from biometric data. The FDBR permits sale with prior consent.
Retention. BIPA uses a three-year inactivity window; the FDBR uses two years.
Enforcement. BIPA has produced billions in private class-action settlements. The FDBR depends entirely on whether the Department of Legal Affairs chooses to bring a case.

For a Florida consumer, the practical consequence is that your recourse is a regulatory complaint, not a lawsuit.

If the FDBR Doesn’t Apply

Most Florida businesses do not meet the $1 billion threshold, so the FDBR will not govern their handling of biometric data. That does not mean nothing applies. Florida’s general data breach notification law still covers any entity that maintains personal information about Florida residents. If biometric data is compromised in a breach, standard notification obligations are triggered regardless of whether the company is large enough to fall under the FDBR.

1
Florida Senate. Digital Bill of Rights
2
The Florida Legislature. Florida Code 501.711 – Privacy Notices
3
Florida Senate. SB 1270 – Biometric Information Privacy
4
Florida Senate. Senate Bill 1270 (2019)