Does Florida's Digital Bill of Rights Apply to Most Businesses?

No. Florida's Digital Bill of Rights (FDBR) only applies to for-profit legal entities with more than $1 billion in global gross annual revenue that also meet at least one of three specific business-model tests — a combination that reaches a small group of large technology companies rather than typical advertisers or marketing businesses.

The Revenue Floor Comes First

The $1 billion figure is a global gross revenue measure, not a Florida-specific or profit-based number, and clearing it is only the first gate. One analysis estimates fewer than 6,000 businesses worldwide have revenue above that level at all, which immediately removes the overwhelming majority of advertisers, agencies, and even most large regional retailers from potential coverage.

Clearing $1 Billion Isn't Enough on Its Own

A business over the revenue floor still has to satisfy at least one of three additional business-model conditions before the FDBR applies to it as a "controller":

• Online advertising revenue: Deriving 50% or more of global gross annual revenue from the sale of online advertisements, including targeted advertising.
• Smart speaker or voice assistant operation: Operating a consumer smart speaker or voice-assistant service with an integrated virtual assistant.
• Large app store operation: Operating an app store or digital distribution platform offering more than 250,000 different software applications for consumers to download.

That structure is why legal commentary consistently describes the FDBR's practical reach as large technology platforms — think major ad networks, smart-speaker makers, and app-store operators — rather than the broad population of mid-size and small businesses that most other state privacy laws cover.

One Rule Applies Regardless of Size

The $1 billion and business-model tests govern the FDBR's main controller obligations, but Florida Statute § 501.715 separately requires that any business obtain a consumer's prior consent before selling that consumer's sensitive personal data — a rule that legal summaries describe as applying without the same size-based exemption. A business well under the $1 billion threshold still needs consent before selling sensitive data categories like health, biometric, or precise geolocation information.

Effective Date

The FDBR took effect July 1, 2024, and current guides reviewing the law into 2026 don't report a change to either the $1 billion threshold or the three business-model tests since then.

What This Means for a Typical Marketing Business

• Most advertisers are outside the FDBR's main scope: Unless your business is itself a major ad network, smart-speaker platform, or large app store, the FDBR's core notice-and-rights obligations most likely don't apply to you directly.
• The sensitive-data consent rule can still apply: Confirm whether your campaigns involve selling sensitive personal data, since that narrower rule isn't limited by company size.
• Don't assume Florida has no privacy law for you: Businesses targeting Florida consumers may still be covered by other Florida statutes or by a different state's privacy law if they also operate elsewhere.

Bottom Line

Unless your business clears $1 billion in global revenue and operates as a major ad network, smart-speaker platform, or large app store, the FDBR's main requirements almost certainly don't apply to you — but check Section 501.715's sensitive-data consent rule separately, since that one isn't limited by size.

Sources: Fla. Stat. §§ 501.702(9), 501.715 (Florida Digital Bill of Rights); TrueVault, "The Digital Bill of Rights: Florida's Unusual Privacy Law" (knowledge.truevault.com); Transcend, "Understanding the Florida Digital Bill of Rights" (transcend.io); Burr & Forman, "Florida's Digital Bill of Rights: A Summary of Key Points for Large Online Platforms" (burr.com).