Florida Site Laws Report: Laws, Updates, and Information That May Affect Your Website

Why Florida Site Laws Follow a Different Pattern

Florida passed a privacy law in 2023, but lawmakers aimed that law at technology giants. The Florida Digital Bill of Rights covers only controllers with more than $1 billion in revenue. That leaves most Florida businesses outside any comprehensive privacy statute. The state instead relies on targeted laws for minors, data security, marketing, and consumer fraud. Those targeted laws reach nearly every website, regardless of size.

The 2026 regular session ran from January 13 through March 13, 2026. Governor DeSantis made an AI Bill of Rights his top technology priority. The Senate passed that bill, but the House never took a vote. A special session in April 2026 produced the same result. So Florida site laws in 2026 are defined by enforcement of older statutes, not new ones.

House Bill 3: Enforceable Since November 25, 2025

House Bill 3, signed March 25, 2024, is the most important Florida site law for minors. The law is codified at Florida Statutes sections 501.1736 through 501.1738. The statute took effect January 1, 2025, but a federal judge blocked enforcement in June 2025. On November 25, 2025, the Eleventh Circuit stayed that injunction in a 2 to 1 decision. Attorney General James Uthmeier announced enforcement the same day, and the law remains in force today.

The social media provisions apply only to platforms that meet four tests. The service must let users upload content or view other users’ activity. At least 10 percent of daily users under 16 must average two or more hours daily. The platform must use algorithmic content selection. The platform must also use an addictive feature, such as infinite scrolling, autoplay, or push notifications.

Covered platforms may not allow accounts for children under 14 at all. Users aged 14 and 15 may hold accounts only with verified parental consent. Platforms must terminate existing accounts of users under 14 and delete their data on request. Knowing or reckless violations carry civil penalties of up to $50,000 per violation. The Eleventh Circuit heard oral argument in March 2026, and a final ruling is pending.

The same law added an age verification rule for adult content. Any commercial website publishing material harmful to minors must verify that users are 18 or older. The rule applies when more than 33.3 percent of the site’s content is harmful to minors. Verification may use anonymous methods or a government ID, and identifying data may not be retained. Most business, portfolio, and eCommerce sites fall well below that threshold.

The Florida Digital Bill of Rights

The Florida Digital Bill of Rights, Senate Bill 262, took effect July 1, 2024. A controller must have more than $1 billion in global gross annual revenue to be covered. The controller must also earn half of revenue from ads or run a smart speaker service. An app store with 250,000 apps also qualifies. In practice, a small business will never meet that test.

Two parts of the law reach beyond the billion dollar giants. Any business that sells sensitive data must post a notice stating that fact on its website. Any business that sells biometric data must post a similar notice. Sensitive data includes health, precise geolocation, and data about a known child. If you sell either category, the notice must be clear and conspicuous.

The Attorney General enforces the law, with penalties of up to $50,000 per violation. Penalties triple for violations involving children. Beyond these rules, Florida site laws do not require a privacy policy for most sites. However, federal rules, other states’ laws, and payment processors often require one anyway. A clear privacy policy remains the sensible default.

The Florida Information Protection Act: A 30 Day Clock

The Florida Information Protection Act, at Florida Statutes section 501.171, applies to any covered entity. A covered entity is any business that acquires, maintains, stores, or uses personal information. Personal information includes a name combined with a Social Security number or government ID number. The definition also includes account numbers with access codes, medical information, and health insurance information. A username or email address combined with a password also qualifies.

You must take reasonable measures to protect electronic personal information. After a breach, you must notify affected Florida residents within 30 days of discovery. You may delay notice only at the written request of law enforcement. Breaches affecting 500 or more Floridians also require Attorney General notice within 30 days. If 1,000 or more people are affected, you must also notify the consumer reporting agencies.

Substitute notice is allowed when direct notice would cost more than $250,000 or reach 500,000 people. The Attorney General enforces the statute under the Florida Deceptive and Unfair Trade Practices Act. Penalties reach $1,000 per day for the first 30 days of delay. Penalties climb to $50,000 for each subsequent 30 day period. The total penalty caps at $500,000 per breach.

Marketing Texts and the Florida Telephone Solicitation Act

Many owners overlook the Florida Telephone Solicitation Act among Florida site laws. The Act appears at Florida Statutes section 501.059 and governs automated texts and calls. You must obtain prior express written consent before sending marketing texts to Florida numbers. That consent must come from a clear disclosure, not a pre-checked box. Marketing texts are barred before 8 in the morning and after 8 at night.

Amendments effective May 25, 2023, narrowed the law to messages sent with automated dialing systems. The amendments also require a consumer to reply STOP before suing over unwanted texts. Even so, the statute carries a private right of action with $500 statutory damages per violation. Treble damages apply for willful conduct. If your checkout collects phone numbers for texts, review your consent language today.

The Deceptive and Unfair Trade Practices Act and Your Online Store

Florida polices advertising through the Deceptive and Unfair Trade Practices Act in chapter 501. The statute prohibits unfair methods of competition and unfair or deceptive acts in trade or commerce. Florida courts follow Federal Trade Commission interpretations. That makes federal advertising standards part of Florida site laws. Consumers may recover actual damages and attorney fees.

For your site, this is the law behind the everyday rules. Reference prices that were never charged create exposure. Timers that reset on every visit create exposure. Subscription trials that convert without clear disclosure create exposure. Staff written testimonials and hidden fees do the same.

Florida also has an automatic renewal statute at Florida Statutes section 501.165. That statute requires clear disclosure of automatic renewal terms for service contracts. Contracts with renewal terms of 12 months or longer require written notice before renewal. The Attorney General may seek civil penalties of up to $10,000 per violation. Treating every product page and pricing table as regulated advertising keeps you clear of complaints.

Florida Site Laws for eCommerce: Sales and Use Tax

Florida imposes a state sales tax of 6 percent, and counties add discretionary surtaxes. Combined rates reach 7.5 percent in some counties. Following the 2018 Wayfair decision, Florida passed Senate Bill 50 in 2021. That law took effect July 1, 2021, and requires remote sellers to register with the state. Registration is required once taxable remote sales into Florida exceed $100,000 in the previous calendar year.

Florida has no transaction count test, which helps sellers of low priced items. Marketplace facilitators such as Amazon, Etsy, and eBay must collect on facilitated sales. Those marketplace sales do not count toward your own $100,000 threshold. Florida uses destination sourcing, so you charge the rate for the customer’s county. The Department of Revenue publishes a county surtax rate table that your platform should use.

Digital goods delivered electronically are generally not taxable in Florida. Software delivered on physical media is taxable. Prewritten software delivered electronically is exempt, but customized services may be taxed differently. Shipping charges are taxable when the customer cannot avoid them. Check your product categories against Department guidance instead of trusting default platform settings.

The AI Bill of Rights That Did Not Pass

If AI headlines led you to Florida site laws, you heard about Senate Bill 482. Governor DeSantis proposed an AI Bill of Rights in December 2025. Senator Tom Leek filed the bill on December 22, 2025. The bill would have required parental consent for minors to hold companion chatbot accounts. The bill also required chatbot operators to remind users periodically about talking to a machine.

The Senate passed SB 482 by a vote of 35 to 2 on March 4, 2026. The House version, HB 1395, never received a committee hearing. The bill died in messages when the session ended on March 13, 2026. Governor DeSantis called a special session, and Senate Bill 2D revived the proposal. That bill died in a House subcommittee on April 29, 2026.

For your website, the practical lesson is stability with a warning label. Florida has no chatbot disclosure statute today. However, the Senate has now passed the idea twice with overwhelming margins. Expect a third attempt when the 2027 session opens in March 2027. Adding a clear AI disclosure to any chatbot now is cheap insurance.

Website Tracking Lawsuits Under the Security of Communications Act

One more risk deserves a place among Florida site laws. The Florida Security of Communications Act, in Florida Statutes chapter 934, requires all party consent. Plaintiffs have used that statute to sue over session replay tools, chat widgets, and tracking pixels. Courts have split on whether ordinary website analytics count as interception. The exposure is real, because the Act allows $1,000 statutory damages per violation.

You can lower that risk with simple steps. Disclose tracking tools in your privacy policy. Obtain consent before loading session replay or chat transcript tools. Avoid sharing chat transcripts with third party vendors without disclosure. A cookie banner that describes these tools helps document consent.

What You Should Do Now

You do not need a compliance department to satisfy Florida site laws. You do need a short list of concrete tasks. Each step below addresses a rule already in force. Each also positions you well if the AI Bill of Rights returns in 2027.

1. Confirm whether any part of your site meets the four part HB 3 platform test, and if so, block accounts for users under 14.
2. Map every place you store personal information, confirm encryption, and write a breach plan that reaches residents and the Attorney General within 30 days.
3. Review your text message consent language against the Florida Telephone Solicitation Act and honor STOP replies immediately.
4. Total your direct Florida sales against the $100,000 threshold and register with the Department of Revenue if you crossed the line.
5. Add a clear AI disclosure to any chatbot and disclose tracking tools in your privacy policy.

Once those tasks are done, you will be current on the Florida site laws covered here. Put two dates on your calendar. Watch for the Eleventh Circuit’s merits decision on HB 3. Then check the 2027 session, which convenes on March 2, 2027. Florida laws usually take effect July 1, which gives you a predictable window each summer.

Key Takeaways

• HB 3 has been enforceable since November 25, 2025, barring social media accounts for children under 14 and requiring parental consent at 14 and 15.
• The Florida Digital Bill of Rights applies only to companies with more than $1 billion in revenue, but sensitive data sale notices apply to everyone.
• Breach notices are due within 30 days, with Attorney General notice at 500 or more residents.
• Remote sellers collect Florida sales tax after $100,000 in sales, with no transaction count test.
• The AI Bill of Rights, SB 482, passed the Senate but died on March 13, 2026, and again on April 29, 2026.

Frequently Asked Questions About Florida Site Laws

Does Florida have a privacy law like California’s CCPA?

Not for most businesses. The Florida Digital Bill of Rights applies only to controllers above $1 billion in revenue. Smaller businesses must still post a notice if they sell sensitive or biometric data. The breach statute, marketing rules, and consumer fraud law apply to everyone.

Do Florida site laws apply to my business if I am located in another state?

Yes, in most cases. HB 3 reaches any covered platform with Florida users. The breach statute covers anyone holding Florida residents’ data. The Telephone Solicitation Act covers texts sent to Florida numbers. Sales tax rules apply once your Florida sales exceed $100,000.

Do Florida site laws require age verification on my website?

Only in two situations. Covered social media platforms must verify age to block users under 14. Sites with more than 33.3 percent harmful content must verify that users are 18. A typical business or eCommerce site meets neither test. Federal COPPA rules still apply if your site targets children under 13.

How quickly must I report a data breach in Florida?

You must notify affected residents within 30 days of discovering the breach. If 500 or more Floridians are affected, you must also notify the Attorney General. Breaches affecting 1,000 or more people also require notice to consumer reporting agencies.

Do Florida site laws require me to disclose AI chatbots on my website?

Not by statute. SB 482 would have required periodic disclosures, but the bill died on March 13, 2026. A special session attempt died on April 29, 2026. A clear disclosure is still a best practice. Disclosure also reduces risk under the Deceptive and Unfair Trade Practices Act.

Conclusion

Florida site laws in 2026 reward the owner who reads statutes instead of headlines. HB 3 has been enforceable since November 25, 2025, and reshapes platforms popular with young teens. The Digital Bill of Rights skips small businesses but still requires sensitive data sale notices. The Information Protection Act sets a firm 30 day breach clock. The Telephone Solicitation Act and the tracking lawsuits add risks that many owners never see coming.

The AI Bill of Rights failed twice in 2026, but a 2027 return seems likely. Finish the five tasks above to meet current requirements while staying ready for the next session.