Florida Biometric Privacy Laws: Collection, Consent & Penalties (2026)

Florida regulates biometric data through the Florida Digital Bill of Rights (FDBR), which defines biometric data to cover fingerprints, voiceprints, and eye retinas or irises under Fla. Stat. 501.702(4) and classifies biometric data processed to uniquely identify an individual as sensitive data under Fla. Stat. 501.702(31)(b). The FDBR, effective July 1, 2024, grants consumers opt-out rights but limits its full protections to companies earning over $1 billion in global annual revenue.

Florida does not have a standalone biometric privacy law like Illinois (BIPA) or Texas (CUBI). Instead, biometric data protections are woven into the Florida Digital Bill of Rights (FDBR), which took effect on July 1, 2024, and the Florida Information Protection Act (FIPA), which covers breach notification.

The FDBR treats biometric data as a subset of sensitive personal data and grants consumers specific opt-out rights. However, the law's narrow applicability threshold means that most of these protections apply only against the largest technology companies operating in the state.

What Counts as Biometric Data Under Florida Law

Fla. Stat. 501.702(4) defines biometric data as "data generated by automatic measurements of an individual's biological characteristics." The statute specifically lists:

• Fingerprints
• Voiceprints
• Eye retinas or irises
• Other unique biological patterns or characteristics used to identify a specific individual

The definition is broad enough to capture newer biometric technologies, such as gait analysis or vein pattern recognition, as long as the data is generated through automatic measurement and used for identification.

What Biometric Data Does Not Include

The statute explicitly carves out three categories:

• Photographs (including digital photos)
• Video or audio recordings (the recording itself, as opposed to biometric identifiers extracted from recordings)
• Data collected under HIPAA (health information governed by federal health privacy rules)

This exclusion means a security camera recording of someone walking through a store is not biometric data. But if software analyzes that footage to extract a faceprint or gait signature, the extracted identifier falls under the biometric data definition.

The $1 Billion Controller Threshold

The FDBR's biometric protections are powerful on paper but narrow in practice. Under Fla. Stat. 501.702(9), a company qualifies as a "controller" subject to the full FDBR requirements only if it meets all of these conditions:

1. Conducts business in Florida or produces products/services consumed by Florida residents
2. Collects personal data about consumers
3. Earns more than $1 billion in global gross annual revenue
4. Meets at least one additional condition:
   • Derives 50% or more of global revenue from online advertising sales
   • Operates a consumer smart speaker with a voice-activated virtual assistant
   • Operates an app store or digital distribution platform offering at least 250,000 applications

This threshold is the highest of any state privacy law in the United States. By comparison, the California Consumer Privacy Act kicks in at $25 million in annual revenue.

In practice, only a handful of companies qualify: think Google, Amazon, Apple, and Meta. A Florida-based employer using fingerprint scanners for time tracking is not subject to the FDBR's opt-out requirements for that data, but not because of company size. Fla. Stat. 501.702(8) excludes anyone "acting in a commercial or employment context" from the definition of "consumer," so employee biometric data falls outside the FDBR's consumer-rights framework regardless of the employer's revenue.

The Broader Sale-of-Sensitive-Data Rule

This provision does not use the $1 billion threshold at all. Under Fla. Stat. 501.715, any person that meets the narrower test in Fla. Stat. 501.702(9)(a)1.-3. (organized for profit, conducts business in Florida, and collects personal data about consumers) may not sell sensitive personal data, which includes biometric data, without first obtaining the consumer's prior consent. That three-part test skips the $1 billion revenue requirement and the Big Tech criteria entirely, so it binds essentially any for-profit business operating in Florida that collects consumer data and chooses to sell biometric or other sensitive data, no matter how small the business is. For children under 13, federal COPPA rules apply. For minors aged 13 to 17, the controller must obtain the child's affirmative authorization.

This consent requirement for the sale of sensitive data reaches far more businesses than the core FDBR framework. By contrast, the biometric sale notice requirement in Fla. Stat. 501.711(3) still applies only to full $1 billion controllers, keeping that particular notice duty within the narrow controller class.

Consumer Rights for Biometric Data

Consumers whose data is processed by qualifying controllers have several rights specific to biometric information.

Opt-Out of Biometric Data Processing

Under Fla. Stat. 501.705(2)(f), consumers may opt out of the collection and processing of sensitive data, which includes biometric data.

Opt-Out of Voice and Facial Recognition

Fla. Stat. 501.705(2)(g) creates a separate, specific right to opt out of personal data collection through "the operation of a voice recognition or facial recognition feature." This provision targets smart devices, apps, and platforms that use facial or voice recognition to identify or authenticate users.

No Background Surveillance

Fla. Stat. 501.705(3) prohibits controllers from using voice recognition, facial recognition, video recording, audio recording, or similar sensing features "when such features are not in active use by the consumer," unless the consumer has expressly authorized it. This targets always-on microphones and cameras in smart home devices and similar products.

Opt-In vs. Opt-Out: How Florida Compares

Florida uses an opt-out model for most biometric data processing. Covered controllers can collect and process biometric data by default, and consumers must take affirmative action to stop it.

This differs significantly from Illinois' Biometric Information Privacy Act (BIPA), which requires opt-in written consent before any collection of biometric identifiers. Under BIPA, collection without prior consent is a violation from the start. Under the FDBR, collection without consent is generally permissible until a consumer exercises their opt-out right.

The one exception is the sale of biometric data. Selling biometric data requires prior consent under Fla. Stat. 501.715, making that specific activity opt-in.

Notice Requirements for Biometric Data

Controllers that sell biometric personal data must display a specific notice under Fla. Stat. 501.711(3):

"NOTICE: This website may sell your biometric personal data."

This notice must appear in the same location as the company's general privacy notice. Controllers must also disclose:

• The categories of personal data processed, including whether sensitive data is involved
• How consumers can exercise their opt-out rights
• Categories of third parties that receive personal data
• The purposes for processing

Privacy notices must be updated at least annually.

Data Protection Assessments

Under Fla. Stat. 501.713, controllers must conduct data protection assessments for activities that present a "heightened risk of harm to consumers." Processing sensitive data, including biometric data, triggers this requirement.

Each assessment must weigh the benefits of the processing activity against the potential risks to consumer rights, considering factors such as:

• Whether the data has been deidentified
• Consumer expectations regarding the processing
• The context and relationship between the controller and consumer
• Available safeguards to reduce risk

These assessments are not required to be filed with the state, but if the Attorney General requests one under its Fla. Stat. 501.72 investigatory authority, producing it does not waive attorney-client privilege or work-product protection over its contents.

Biometric Data and Breach Notification

Separately from the FDBR, the Florida Information Protection Act (Fla. Stat. 501.171) includes biometric data in its definition of personal information subject to breach notification requirements.

If a breach exposes an individual's biometric data (as defined in Fla. Stat. 501.702) along with their first name or first initial and last name, the entity must:

• Notify affected individuals within 30 days of discovering the breach, with a possible 15-day extension if the entity shows good cause in writing to the Department of Legal Affairs within the original 30-day window
• Notify the Florida Department of Legal Affairs within 30 days, but only if the breach affects 500 or more individuals in Florida; the statute does not provide an extension for this particular deadline
• Notify credit reporting agencies if the breach affects more than 1,000 individuals at a single time

FIPA's breach notification rules apply to all covered entities in Florida, not just $1 billion companies. Any business or government entity that maintains, stores, or uses Floridians' biometric data must notify affected individuals after a breach. Notice to the Department of Legal Affairs is required only when a breach affects 500 or more individuals in Florida; smaller breaches still trigger the individual-notice duty but not the department-notice duty.

Penalties for failing to meet notification deadlines under FIPA reach up to $500,000 per breach: $1,000 per day for the first 30 days, then $50,000 for each subsequent 30-day period, up to 180 days.

Enforcement: Attorney General Only

The FDBR is enforced exclusively by the Florida Department of Legal Affairs (the Attorney General's office) under Fla. Stat. 501.72.

There is no private right of action. Individual consumers cannot sue companies for biometric data violations under Florida law. This is one of the sharpest contrasts with Illinois' BIPA, where private lawsuits (including class actions) have produced hundreds of millions of dollars in settlements.

Penalty Structure

Cure Period

Controllers receive a 45-day cure period after written notice from the AG's office. If the violation is cured within that window, the department may choose not to pursue action. The one exception: violations involving children's data have no cure period.

Enforcement Activity to Date

The Florida AG's office issued its first annual enforcement report covering January through December 2025. During that period, the department received 1,496 consumer complaints, placed 811 under active review, issued 186 Notices of Alleged Violation to controllers, and initiated 60 inquiries to determine whether entities fell within the FDBR's scope.

The first major enforcement action came in October 2025, when the AG filed suit against Roku, Inc. for alleged violations involving children's data, including geolocation and voice recordings. Florida sought civil penalties of up to $150,000 per violation.

Employer Use of Biometric Data

Florida does not have a separate employer-specific biometric privacy law. Businesses that use fingerprint scanners for timekeeping, facial recognition for building access, or other biometric tools in the workplace are generally not subject to the FDBR's consumer-facing biometric requirements when it comes to their own employees. That is a definitional exclusion, not a size exclusion: Fla. Stat. 501.702(8) defines "consumer" as an individual acting only in an individual or household context and expressly excludes anyone "acting in a commercial or employment context." Because employee biometric data falls outside the FDBR's definition of consumer, employers owe no FDBR opt-out obligations toward their own workforce regardless of the employer's revenue or size.

However, employers should be aware of two considerations:

Breach notification still applies. If an employer stores employees' fingerprints or other biometric data and suffers a data breach, the FIPA notification requirements apply regardless of company size. Failure to notify within 30 days exposes the employer to penalties.

No BIPA-style lawsuit risk. Unlike in Illinois, where employees have filed thousands of class action lawsuits over biometric data collection in the workplace, Florida's lack of a private right of action means employees cannot bring similar claims. Enforcement runs through the AG's office only.

Pending Legislation: 2025-2026 Session

The Florida Legislature has not advanced a standalone biometric privacy act in recent sessions. A 2019 proposal, the Florida Biometric Information Privacy Act (SB 1270), modeled on Illinois' BIPA, did not pass. No comparable bill has been filed in the 2025 or 2026 legislative sessions.

The 2026 session did see SB 482, an Artificial Intelligence Bill of Rights, which passed the Senate 35-2 but died in the House. That bill addressed AI governance and chatbot consent but did not amend the FDBR's biometric provisions.

As of August 2026, there is no pending legislation that would lower the FDBR's $1 billion threshold, create a private right of action for biometric data violations, or establish a standalone biometric privacy statute in Florida.

How Florida Compares to Other States

This comparison matters for businesses operating across multiple states. A company that collects fingerprints in both Florida and Illinois faces vastly different compliance burdens and litigation risks in each jurisdiction.

This article provides general legal information about Florida biometric privacy laws and is not legal advice. Laws and enforcement practices change over time. Consult an attorney for advice specific to your situation.

More Florida Laws

• Florida Deepfake Laws
• Florida Employee Monitoring Laws
• Florida GPS Tracking Laws
• Florida Recording Laws