Florida Digital Bill of Rights (FDBR)
A practical compliance guide for website owners. Learn what Florida's privacy law requires and how to implement it on your site.
Who Must Comply
Annual global gross revenue over $1 billion AND meets one of: derives 50%+ of revenue from online ad sales, operates a consumer smart speaker with voice assistant, operates an app store with 250K+ apps
What Your Website Must Do
| Requirement | Status |
|---|---|
| Cookie consent banner | Recommended |
| Do Not Sell link | Required |
| Do Not Share link | Required |
| Honor GPC browser signals | Recommended |
| Universal opt-out mechanism | Not required |
| Sensitive data opt-in consent | Required |
Checked against the FDBR on August 29, 2026. Read the source This is a summary, not legal advice.
Required Links & Notices
The FDBR requires the following links or notices to be visible on your website:
- 1Privacy Policy
- 2Opt-Out Mechanism
Enforcement & Penalties
Key Things to Know
The Florida Digital Bill of Rights (FDBR) has applied in Florida since July 1, 2024.
Who it covers: Annual global gross revenue over $1 billion AND meets one of: derives 50%+ of revenue from online ad sales, operates a consumer smart speaker with voice assistant, operates an app store with 250K+ apps.
Florida reaches far fewer businesses than the others: its thresholds are built around very large companies, so most sites that fall under Colorado or Connecticut fall outside Florida.
Do Not Sell and opt-out rights: residents may opt out of the sale of their personal data and opt out of targeted advertising. FDBR expects the choice to be reachable from your site under the heading “Opt-Out Mechanism”, and you may not degrade the service of someone who exercises it.
Global Privacy Control: FDBR does not oblige you to honour a browser opt-out signal. Honouring GPC anyway is the simpler engineering choice, because twelve other states do require it and the signal does not say which state the visitor is in.
Cookie banner: FDBR is an opt-out law, so it does not require the opt-in banner the GDPR does. What it does require is that the tracking you run for advertising can be switched off on request, which in practice means a preference control that actually blocks tags rather than a notice that only records a click. Sensitive data is the exception: that needs consent before you process it.
Enforcement: $50,000 per violation. Treble damages for violations involving children under 18. Enforced by the Florida Attorney General + Department of Legal Affairs.
How to Configure LegalBanner for FDBR
- 1
Create your site
Sign up for free and add your website domain in the dashboard.
- 2
Set consent mode to "Opt-out"
In Settings, select the consent mode that matches Florida's requirements.
- 3
Install the snippet
Add the one-line script tag to your website. The banner, opt-out links, and GPC support are automatic.
- 4
Generate your Privacy Policy
Use the built-in policy wizard to generate a FDBR-compliant privacy policy.
Set up FDBR compliance in 5 minutes
LegalBanner handles Florida privacy requirements automatically — cookie banner, opt-out links, and GPC support included.
Frequently Asked Questions
Does the Florida FDBR apply to my business?
The FDBR has a very high threshold: your business must have over $1 billion in annual global gross revenue AND meet additional criteria (50%+ revenue from ad sales, operate a smart speaker, or operate a large app store). Most businesses are exempt.
Does Florida require a cookie consent banner?
The FDBR does not require opt-in cookie consent for most businesses. If you meet the high revenue threshold, you must provide opt-out mechanisms for targeted advertising and sale of personal data.
What are the penalties for FDBR violations?
Up to $50,000 per violation, with treble damages (3x) for violations involving children under 18. These are among the highest state-level privacy penalties in the US.
Does Florida require honoring GPC signals?
The FDBR does not explicitly require honoring GPC signals. However, implementing GPC support is recommended as best practice.
What special protections exist for children under the FDBR?
The FDBR prohibits targeted advertising to children under 18 and requires enhanced consent for processing children's data. Penalties are tripled for violations involving minors.