Florida privacy laws give residents a constitutional right against government intrusion and a set of statutes that regulate data breaches, consumer data held by large tech companies, government records, and telemarketing calls. The main pieces are Article I, Section 23 of the Florida Constitution, the Florida Information Protection Act (FIPA), the Florida Digital Bill of Rights (FDBR), Chapter 119’s public records exemptions, and the Florida Telemarketing Act. Each covers a different situation, and together they layer on top of federal protections rather than replacing them.
The Constitutional Right to Be Let Alone
Florida is one of the few states whose constitution spells out a right to privacy. Article I, Section 23 gives every natural person the right to be let alone and free from governmental intrusion into their private life. It applies against the government, not against private companies or other individuals.
Courts read this right strictly. Before a government agency can invade someone’s private affairs, it must show a compelling interest and use the least intrusive method available. That standard has come up in cases involving medical decisions, bodily autonomy, and personal data held by agencies. The right has one built-in limit: it cannot be used to block the public’s access to public records and meetings.
What Happens When Your Data Is Breached
The Florida Information Protection Act, at Section 501.171 of the Florida Statutes, governs how businesses and government agencies handle personal information about Florida residents in electronic form. It reaches any entity that collects, stores, or uses that information, whether or not the entity is physically located in Florida.
Under FIPA, “personal information” means your name combined with at least one sensitive data element. The sensitive elements include Social Security numbers, driver’s license and passport numbers, military ID numbers, financial account numbers paired with an access code, medical history and health insurance information, biometric identifiers, geolocation data, and online account credentials such as a username with a password. Data that has been encrypted or otherwise rendered unusable does not qualify.1Online Sunshine. Florida Statutes 501.171 – Security of Confidential Personal Information
When a breach happens, the company or agency has to notify each affected individual no later than 30 days after determining a breach occurred. It can request a 15-day extension by filing a written justification with the Department of Legal Affairs within that first 30-day window, which pushes the outer deadline to 45 days.1Online Sunshine. Florida Statutes 501.171 – Security of Confidential Personal Information If 500 or more Floridians are affected, the entity must also notify the Department of Legal Affairs directly within the same 30-day window.2Florida Senate. Florida Code 501.171 – Security of Confidential Personal Information
Companies that ignore these obligations face civil penalties that grow the longer the violation continues, capped at $500,000 per breach.1Online Sunshine. Florida Statutes 501.171 – Security of Confidential Personal Information
Rights Under the Florida Digital Bill of Rights
The Florida Digital Bill of Rights took effect on July 1, 2024. It gives consumers direct rights over their personal data, but it applies to a very small group of companies.
A company falls under the FDBR only if it makes more than $1 billion in global gross annual revenue and meets at least one of these additional tests:
- It earns 50 percent or more of its global revenue from selling online advertisements.
- It operates a consumer smart speaker with a virtual assistant connected to cloud computing.
- It runs an app store or digital distribution platform offering at least 250,000 apps.
Subsidiaries and affiliates controlled by a qualifying company are also covered.3Florida Senate. Florida Statutes 501.702 – Definitions Small and mid-sized businesses are not subject to the law.
If you deal with a covered company, you can ask it to correct inaccurate personal data, delete your data, give you a copy, or stop selling it. Those rights extend to data gathered through facial and voice recognition. The company has 45 days to respond to a standard request, or 60 days for a complex one. Covered companies also cannot collect more than what is relevant and reasonably necessary for the purpose they are using the data.
Enforcement sits entirely with the Florida Department of Legal Affairs, part of the Attorney General’s office. There is no private right of action, so you cannot sue a company yourself under the FDBR; complaints go through the Attorney General.4Office of the Attorney General. Florida Digital Bill of Rights Annual Enforcement Report
Privacy in Government Records
Under Chapter 119, records held by state, county, and municipal agencies are presumed open. Anyone can request to inspect or copy them unless a specific statutory exemption applies.5Florida Senate. Florida Code 119.07 – Inspection and Copying of Records
Section 119.071 keeps several categories of personal information out of public view. Social Security numbers held by any agency are confidential and exempt from disclosure, whether the agency holds them for employment purposes or any other reason. Bank account numbers and debit, charge, and credit card numbers held by an agency are also exempt. Home addresses, phone numbers, dates of birth, and photographs of active and former sworn law enforcement officers are shielded as well, along with identifying information about their spouses and children.6Online Sunshine. Florida Statutes 119.071 – Exemptions
When a record contains both exempt and non-exempt information, the agency has to redact the exempt parts and release the rest. It cannot withhold the whole document because a portion is protected.5Florida Senate. Florida Code 119.07 – Inspection and Copying of Records
Limits on Telemarketing Calls
The Florida Telemarketing Act runs parallel to the federal Do Not Call list and adds state-level rules. A commercial seller cannot make more than three solicitation calls to the same person within a 24-hour period on the same subject, no matter which number the calls come from. Calls before 8:00 a.m. or after 9:00 p.m. at the recipient’s local time are prohibited.7Florida Senate. Florida Statutes 501.616 – Prohibited Acts
Telemarketers also cannot block their caller ID or display a fake number to hide who is calling. Doing so is a second-degree misdemeanor. If you tell a telemarketer to stop calling, the company has to honor that request.7Florida Senate. Florida Statutes 501.616 – Prohibited Acts
How Florida Law Stacks on Top of Federal Law
Federal statutes like HIPAA set a floor for privacy in specific areas, and Florida often adds more on top. Section 408.051, the Florida Electronic Health Records Exchange Act, requires that patient health information be physically stored within the continental United States, its territories, or Canada. HIPAA has no comparable geographic rule. Because Florida’s requirement is more protective, it applies in addition to HIPAA rather than being displaced by it.
The practical effect is that your data may be governed by more than one law at once. A Florida hospital handling your records has to meet HIPAA’s security standards and Florida’s storage location rule. Where a state protection is stronger than the federal one, the state protection controls.