CS/CS/SB 262 (Bradley) prohibits employees of a governmental entity from using their position or any state resources to communicate with a social media platform to request that it remove content or accounts. In addition, a governmental entity may not initiate or maintain any agreements with a social media platform for the purpose of content moderation. The prohibitions do not apply to routine account maintenance, attempts to remove accounts or content pertaining to the commission of a crime, or efforts to prevent imminent bodily harm, loss of life or property damage. These provisions take effect on July 1, 2023.

The bill creates a new statute (section 501.1735, Florida Statutes) to provide protection to children in online spaces. Specifically, the bill prohibits online platforms that provide online services, products, games or features that are likely to be predominantly accessed by children from processing or collecting the personal information of children in the various methods described in the bill. A violation of the statute is an unfair and deceptive practice actionable and enforceable by the Department of Legal Affairs (DLA).

The bill creates the “Florida Digital Bill of Rights” to allow the state’s consumers to control the digital flow of their personal information, including the right to: 

•Confirm and access their personal data; 

•Delete, correct or obtain a copy of that personal data; 

•Opt out of the processing of personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer; 

•Opt out of the collection of sensitive data; and 

•Opt out of the collection of personal data collected through the operation of a voice recognition feature.

The bill prohibits a device that has a voice or facial recognition feature, video or audio recording features, or other electronic, visual, thermal or olfactory features that collect data from such features from engaging in surveillance when the features are not in active use by a consumer or expressly authorized by the consumer. The bill’s privacy provisions generally apply to “controllers,” businesses that collect Florida consumers’ personal information, make more than $1 billion in gross revenues and meet one of the following thresholds: 

•Derives 50% or more of its global gross annual revenues from advertisements, including from providing targeted advertising or the sale of ads online; 

•Operates a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation; or

•Operates an app store or digital distribution platform that offers at least 250,000 different software applications for consumers to download and install.

The bill specifies several actions that controllers must take in regard to the processing and collection of personal data, including disclosure of the main parameters used in collecting data from an online search engine, assessment of processing activities involving personal data, providing a privacy notice to consumer, and other certain actions relating deidentified data maintained by a controller. The bill also prohibits certain businesses from selling sensitive personal data without receiving prior consent of the consumer, or if the sensitive data is of a known child, without an affirmative authorization for processing that child’s data. The bill requires that a person who engages in the sale of sensitive personal data post a notice on its website of such a potential sale. Finally, the bill provides exemptions for the use of certain data and expresses that restrictions on the collection or retention of data for a particular purpose is prohibited. 

Effective date: July 1, 2024, except as otherwise provided. (Taggart)