FL H0009

Creates s. 501.173, F.S., establishing consumer data privacy rights for Florida residents, applying to controllers with at least two of: over $50 million in global annual gross revenue, buying/selling/sharing personal information of 50,000+ consumers for targeted advertising, or deriving 50%+ of revenue from selling/sharing personal information. Effective January 1, 2023.

Grants consumers the right to request disclosure of collected personal information (within 45 days, free of charge), request deletion or correction of personal data (within 90 days), and opt out of the sale or sharing of their personal information via a required "Do Not Sell or Share My Personal Information" link on controllers' homepages.

Prohibits selling or sharing personal information of consumers under 18 without affirmative authorization (from the minor if 13-17, or from a parent/guardian if 12 or younger), and requires controllers to respect opt-out decisions for at least 12 months before re-soliciting consent.

Provides a private right of action with statutory damages of $100–$750 per consumer per incident or actual damages (whichever is greater), with attorney fees available against entities with over $500 million in global revenue; authorizes the Department of Legal Affairs to enforce violations as unfair and deceptive trade practices with civil penalties that may be tripled for violations involving minors.

Preempts local governments from regulating the collection, processing, sharing, or sale of consumer personal information, and exempts data governed by HIPAA, the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, FERPA, and other specified federal frameworks.