FL S1864

Creates the "Florida Privacy Protection Act," granting Florida residents the right to opt out of the sale of their personal information, opt out of targeted advertising and profiling, and submit verified requests to access, delete, or correct personal information held by controllers

Applies to for-profit entities doing business in Florida that process personal information of 100,000+ consumers annually, or that process data of 25,000+ consumers while deriving 50% or more of global annual revenue from selling personal information

Prohibits the sale of personal information of consumers 16 or younger without affirmative authorization from the consumer (ages 13–16) or a parent/guardian (under 13), and requires controllers to display "Do Not Sell My Personal Information" and "Do Not Advertise To Me" links on their homepages

Enforcement is limited exclusively to the Department of Legal Affairs (Attorney General), with no private right of action; the department may grant a 45-day cure period for violations, and civil penalties may be tripled for violations involving consumers known to be 16 or younger

Exempts data governed by HIPAA, the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, FERPA, and several other federal laws; preempts all local government regulation of consumer data collection, processing, or sale; and establishes a Consumer Data Privacy Unit within the Department of Legal Affairs, with an effective date of December 31, 2022