Florida's Department of Legal Affairs received 1,496 consumer complaints and inquiries under the Florida Digital Bill of Rights in 2025, according to the Attorney General's Annual Enforcement Report published February 1, 2026. The law itself is unusual: it carries a sweeping name but applies to only the largest technology companies operating in the state, and two years of enforcement data, current as of August 2026, now show a wide gap between complaint volume and any actual penalty collected. Below is what the state's own reports say about who the law covers, how many people are filing complaints, and what happens to those complaints once they arrive.
What is the Florida Digital Bill of Rights and who does it cover?
The Florida Digital Bill of Rights (FDBR) took effect on July 1, 2024, giving Florida residents rights to access, correct, delete, and port their personal data, plus the right to opt out of certain data sales and targeted advertising. What sets it apart from comprehensive privacy laws in California, Virginia, or Colorado is its narrow scope: a controller must clear more than $1 billion in global gross annual revenue, and then satisfy at least one further condition, deriving 50% or more of global gross revenue from online advertising, operating an app store with 250,000 or more applications, or operating a consumer smart speaker or voice-command service with an integrated virtual assistant.
A company earning $999 million globally is outside the law entirely, no matter how much Florida resident data it processes. Legal commentary on the statute consistently names Google, Meta, Amazon, and Apple as the companies most clearly inside that threshold, since the combination of billion-dollar-plus revenue and an ad, app-store, or voice-assistant business is rare outside a handful of platform companies. Florida lawmakers built the threshold this way on purpose, aiming the law at a small set of dominant platforms rather than the broad base of small and mid-sized businesses that comprehensive laws in other states typically reach.
Figure 1: Florida's revenue threshold is 40 times higher than California's. Source: Florida Statutes section 501.702; CCPA/CPRA statutory thresholds.
That gap matters for a site owner reading this: if your business does not clear $1 billion in global revenue, the FDBR simply does not reach you, even though its name suggests a broad consumer rights law like CCPA or GDPR. A privacy policy generator built for the current patchwork of state laws can flag which thresholds your business actually meets rather than assuming every new state law applies.
How many complaints has Florida received under the FDBR?
Complaint volume nearly doubled between the law's first reporting period and its second, though the two periods are not directly comparable in length. The Attorney General's office received 787 complaints and inquiries during the law's initial six months, from July 1 through December 31, 2024. The full 2025 calendar year brought 1,496 complaints and inquiries, according to the February 2026 report, a period twice as long as the first. Both figures come from the same annual reporting mechanism the statute requires, so the counting method is consistent even though the reporting windows differ in length.
Figure 2: Complaint volume by reporting period. The first period covers six months, the second covers a full year, so the totals are not a clean year-over-year growth rate. Source: Florida Attorney General Digital Bill of Rights Annual Enforcement Reports, 2025 and 2026.
Annualizing the first period (787 complaints across six months implies roughly 1,574 on a 12-month basis) suggests complaint volume was roughly flat to slightly down between the law's first full year of public awareness and its second, once the different period lengths are accounted for. That is a more modest trend than the raw headline numbers imply, and it fits a pattern common to new state privacy laws: an initial wave of curiosity-driven inquiries followed by a steadier baseline once consumers, and the businesses that must respond to them, understand what the law actually covers.
This mirrors the broader compliance landscape across the growing list of state privacy laws now in effect, where enforcement volume tends to concentrate around a law's first eighteen months.
What kinds of privacy requests do Floridians file most?
Right-to-know requests, confirming whether a company holds a consumer's data and gaining access to it, dominate. Of the 811 complaints placed under active review in 2025, 730 potentially involved an access request, compared to far smaller counts for correction, deletion, portability, and the law's various opt-out rights.
Figure 3: Access requests outnumber every other category combined. "Opt out" combines the report's three opt-out categories: processing (53), sensitive data (35), and biometric collection (15). Note the Attorney General's report flags that 130 complaints fell into two or more categories, so column totals exceed the 811 complaints placed under review. Source: Florida Attorney General Digital Bill of Rights Annual Enforcement Report (February 2026).
The imbalance is not unique to Florida. Consumers overwhelmingly reach for the simplest available right first, confirming what a company knows about them, before pursuing deletion or opt-out requests that require more specific knowledge of a law's mechanics. A site that publishes a clear, current privacy policy with an accessible request channel closes most of that gap before a complaint ever reaches the Attorney General's office.
How much of that complaint volume turns into an actual enforcement case?
Most complaints never become a formal action against a company. In 2025, the Attorney General's office closed 685 of the 1,496 complaints and inquiries as outside the Digital Bill of Rights' scope, more than the 811 it placed under active review. That scope filter is significant: a large share of consumer complaints target companies, or issues, the FDBR was never written to cover.
Figure 4: More than four in ten 2025 complaints fell outside the law's scope before any investigation began. Source: Florida Attorney General Digital Bill of Rights Annual Enforcement Report (February 2026).
Of the complaints that did proceed, the Department of Legal Affairs opened 60 initial inquiries into potential controllers in 2025 (up from 24 during the shorter 2024 period) and issued 186 formal Notices of Alleged Violation. Sixty-four of those notices, about 34%, were resolved without the state needing to file suit, typically because the controller cured the alleged violation inside the statutory window. Only one FDBR matter reached active litigation during 2025.
What penalties can the FDBR actually impose, and has Florida collected any?
The FDBR sets a base civil penalty of up to $50,000 per violation, enforceable by the Attorney General under section 501.72 of the Florida Statutes, with any violation of the act also treated as an unfair and deceptive trade practice. That penalty can be tripled to $150,000 per violation when the violation involves a known child or when the controller had actual knowledge it was violating the statute. A 45-day cure period is generally available before a formal penalty attaches, except when a violation involves a known child, where no cure period applies.
Figure 5: The cure-period test the FDBR applies before a penalty attaches. Source: Florida Statutes section 501.72; Holland & Knight and Gunster legal analysis of FDBR enforcement mechanics (2025-2026).
Despite that penalty framework, neither of the Attorney General's two annual reports records a single dollar issued or collected. The state's only FDBR lawsuit, filed October 13, 2025, against Roku, Inc. over alleged unauthorized collection and sale of children's viewing, voice, and geolocation data, ended in a negotiated resolution announced June 26, 2026. Roku agreed to invest an estimated $25 million in child-safety engineering improvements, with no finding of wrongdoing and no civil fine, according to the Attorney General's office and Bloomberg Law's coverage of the settlement. Two years into enforcement, cure-and-comply remains the practical outcome of an FDBR case far more often than a collected penalty.
How does the FDBR compare to other state privacy laws?
| Law | Applicability threshold | Revenue threshold | 2025 enforcement volume |
|---|---|---|---|
| Florida FDBR | Revenue plus one added condition (ad revenue, app store, or voice assistant) | Over $1 billion global | 1,496 complaints, 0 penalties collected |
| California CCPA/CPRA | Revenue or data-volume based | Over $25 million (or data-volume alternative) | Separate enforcement track, no comparable single figure published |
| Virginia CDPA | Data-volume based | None; 100,000+ consumers, or 25,000+ with 50%+ revenue from data sales | No revenue threshold to compare |
| Colorado CPA | Data-volume based | None; 100,000+ consumers, or 25,000+ deriving any revenue from data sales | No revenue threshold to compare |
Florida stands apart from every other comprehensive state privacy law by using revenue alone, at a threshold forty times higher than California's, as its primary gate, rather than the consumer-volume thresholds Virginia and Colorado use. That design choice is also why FDBR complaint volume, 1,496 in 2025, cannot be read as a proxy for how many businesses are actually covered; the law was built to reach a small number of very large platforms, not the broad base of mid-sized businesses that CCPA, CDPA, and CPA all sweep in.
See our timeline of state privacy law effective dates for how Florida's July 2024 start date fits into the wider 2026 landscape, and our breakdown of which state privacy laws apply to a given business for a threshold-by-threshold comparison.
Figure 6: Four years from signature to a first litigated, then settled, case. Source: Florida Attorney General Annual Enforcement Reports (2025, 2026); Bloomberg Law.
The Bottom Line
Florida's Digital Bill of Rights generated 1,496 consumer complaints in 2025 and a growing enforcement pipeline, 186 Notices of Alleged Violation and one lawsuit, but not a single dollar in collected penalties across a year and a half of enforcement. That gap is a direct result of the law's design: a $1 billion revenue floor keeps the FDBR narrowly focused on the largest technology platforms, a group small enough that the state has so far preferred negotiated cures and settlements over litigated fines. For most small and mid-sized site owners, the FDBR's headline penalties, up to $150,000 per violation, are not the relevant risk; the practical question is whether a broader law like CCPA, which applies at just $25 million in revenue, reaches the business instead. Businesses that do clear the FDBR's threshold should treat the Roku outcome as the template: a fast, well-documented cure response has kept every FDBR matter so far out of a collected penalty.
Frequently Asked Questions
How many complaints has Florida received under the Digital Bill of Rights? 1,496 consumer complaints and inquiries in 2025 alone, according to the Florida Attorney General's Digital Bill of Rights Annual Enforcement Report published February 1, 2026. That is on top of 787 complaints logged during the law's first six months in 2024.
Which companies does the Florida Digital Bill of Rights actually apply to? Only controllers with more than $1 billion in global gross annual revenue that also meet one added condition, such as deriving 50 percent or more of revenue from online advertising, operating an app store with at least 250,000 apps, or running a smart speaker service. Legal analysts commonly name Google, Meta, Amazon, and Apple as the companies most clearly in scope.
How much money has Florida collected in FDBR fines? Zero dollars. Both of the Attorney General's annual enforcement reports, covering July 2024 through December 2025, confirm no monetary penalties have been issued or collected, and the state's only FDBR lawsuit, against Roku, settled in June 2026 with no civil fine.
What penalties can the Florida Digital Bill of Rights impose? Up to $50,000 per violation, which can be tripled to $150,000 per violation if the violation involves a known child or the controller had actual knowledge it was violating the law, under section 501.72 of the Florida Statutes.
Where the Numbers Come From
- Florida Office of the Attorney General. (February 1, 2026). "Florida Digital Bill of Rights Annual Enforcement Report 2026." 1,496 complaints received, 811 under active review, 186 Notices of Alleged Violation issued, covering January 1 to December 31, 2025.
- Florida Office of the Attorney General. (February 1, 2025). "Florida Digital Bill of Rights Annual Enforcement Report 2025." 787 complaints received during the law's first six months, July 1 to December 31, 2024.
- Florida Statutes, Chapter 501, Part IX (Florida Digital Bill of Rights). Sections 501.702 (applicability thresholds) and 501.72 (enforcement and penalties), including the $50,000 base penalty and $150,000 tripled penalty for known-child or knowing violations.
- Bloomberg Law. (June 2026). "Roku Strikes Deal to End Florida's Privacy Suit on Minors' Data." Reports the $25 million child-safety engineering commitment and no civil fine in the Roku settlement.
- Holland & Knight. (October 2025). "Roku Alleged to Improperly Process Children's Data in First Florida Digital Bill of Rights Suit." Filing date and allegations for the October 13, 2025 complaint.
Note: All figures verified as of August 2026. FDBR complaint and enforcement data is refreshed at least twice a year as the Florida Attorney General's office publishes its next annual report.
