Licensing company data in Florida: a law for the largest companies
Florida’s privacy act is the narrowest of the large states. It defines a covered controller by a billion dollars of global revenue plus a business-model test, so most Florida companies sit outside the full act. One section on the sale of sensitive data is worded differently, and the state’s breach law applies to everyone.
Where Florida stands
The text of section 501.715 is short and worth reading. The sensitive data it names includes health, biometric and precise location data, so a company with those fields in its records should read it before licensing.
| Question | Answer as of 2 November 2026 |
|---|---|
| Comprehensive privacy law | Yes, the Florida Digital Bill of Rights, effective 1 July 2024. |
| Who it covers | For-profit businesses with more than one billion dollars in global gross annual revenue that also meet one of three tests: half of revenue from online advertising, a smart speaker or voice command device, or an app store with at least 250,000 applications. |
| Sale of sensitive data | Section 501.715 requires consent before a sale of sensitive data and a notice that the site may sell it. Read the section to see exactly who it names, since commentators disagree on its reach. |
| Who enforces | The Attorney General. There is no private right of action. |
What this means for a typical Florida company
A contractor, a medical office or a logistics firm in Florida will not meet the revenue test. For the operating records of a company like that, the privacy act is not the limit. The limits come from federal law, from the contracts with customers and from the company’s own privacy promises.
That last point is the one that catches companies. A website that says it never shares customer information turns a license into a deceptive statement under the federal consumer protection law, whatever Florida’s act says. Check the company’s published promises against the license before signing.
The breach law
The Florida Information Protection Act, Florida Statutes 501.171, requires a covered entity to take reasonable measures to protect personal information and to notify affected individuals as soon as practicable and no later than 30 days after a breach is determined, with notice to the Department of Legal Affairs when 500 or more people in the state are affected. It covers a licensed archive in the same way as a live system, so a company that hands over old records must make sure the de-identification holds.
Read next
- United States rules. The federal laws behind every state.
- Other states. What each state adds.
- De-identification. How personal detail comes out.
- Liability. Who answers for what in a deal.
Questions about licensing company data in Florida: a law for the largest companies
Is a Florida company with 40 staff covered by the Digital Bill of Rights?
No. It would need more than a billion dollars in global revenue and a business-model test, which a company that size does not meet.
Does that mean anything goes?
No. Federal law, customer contracts, the company’s own privacy statements and other states’ laws for its out-of-state customers all still apply.
What does the sensitive data section require?
Consent before a sale of sensitive data and a stated notice. Whether a given company is named by it depends on the text, which is worth reading with counsel.
Didn't find your question? Ask us directly.