DeSantis Takes Swing at Big Tech in New Florida Privacy Law (1)

Florida became the latest state to enact a law giving consumers more control over how their data is collected and sold by tech giants like Amazon.com Inc. and Alphabet Inc.'s Google, with the signing of a measure Tuesday that goes beyond just regulating platforms’ privacy protections.

Gov. Ron DeSantis (R), who recently <-bsp-article-citation state="{"cms.site.owner":{"_ref":"00000166-e5a9-d785-a767-fffdcac50000","_type":"00000151-acf5-d1ce-a159-bff728d6001e"},"cms.content.publishDate":1686061766946,"cms.content.publishUser":{"_ref":"00000183-3255-db2a-a5c3-3a756fc20000","_type":"00000151-acf5-d1ce-a159-bff728d8001b"},"cms.content.updateDate":1686061766946,"cms.content.updateUser":{"_ref":"00000183-3255-db2a-a5c3-3a756fc20000","_type":"00000151-acf5-d1ce-a159-bff728d8001b"},"articleCitation":{"linkArticle":{"_ref":"00000188-4f16-d790-a1ff-ffd70ea20003","_type":"00000151-acf5-d1ce-a159-bff728d50010"},"_id":"00000188-911c-d5b0-affb-9d9ca99f0000","_type":"00000160-bca2-df03-a1ef-bcef37330000"},"_id":"00000188-911c-d5b0-affb-9d9ca99a0000","_type":"00000160-bca2-df03-a1ef-bcef37350000"}">announced a presidential bid, signed into law S.B. 262, legislation that adopts the “Digital Bill of Rights” his office proposed to state legislators in February.

The new law contains many of the same provisions that have become standard in comprehensive state privacy laws, giving consumers new rights over how their data is collected, stored, and shared. But Florida’s take on consumer data privacy also tackles issues that state Republicans have raised with tech platforms, like the alleged censorship of conservative views online.

The law requires search engines to disclose whether political ideology influences search results and it bans government-mandated content moderation on social media. Another provision establishes extra protections for children under age 18.

“If a multibillion-dollar company is conspiring to take your data and sell it or use it against you, it is your right to be able to protect that data,” DeSantis said in a press statement.

Florida is the ninth state to enact a comprehensive privacy law as more than a dozen others consider similar measures. Unlike others enacted this year however, this law only applies to the largest tech companies and exposes them to hefty fines. States have been stepping up while federal lawmakers show no sign of passing nationwide privacy legislation soon.

The bulk of the provisions will go into effect July 1, 2024. Its section focusing on social media moderation will apply this July 1.

Limited Applicability

Consumer advocacy group Consumer Reports called on DeSantis to strengthen the bill Tuesday, saying its limited applicability and other loopholes” would leave Florida consumers’ personal information unprotected in a variety of contexts.

“While we recognize that big tech companies are usually some of the worst privacy offenders, they are far from the only privacy offenders,” Matt Schwartz, a Consumer Reports policy analyst, said in a statement.

Ad-tech companies would still be able to use online cookies to track consumers, rendering the bill’s targeted advertising protections “largely meaningless,” Schwartz said.

Florida’s law only regulates companies that make more than $1 billion in gross annual revenue and derive more than half of their revenue from online ads. It also targets companies that operate smart speakers, like Amazon’s Alexa voice assistant, and those that run an app store containing at least 250,000 applications available for download.

By contrast, other state privacy laws enacted so far this year cover any company that manages the data of at least 100,000 consumers or makes more than half of its revenue from selling consumer data.

Hefty Fines

Companies that violate Florida’s new law will face penalties that can balloon far beyond the $7,500 maximum fine most other states’ comprehensive privacy laws have established.

Florida’s attorney general, who will have sole enforcement power under the law, can seek up to $50,000 in civil penalties per violation of certain data processing provisions in the law and may seek additional remedies under the state’s consumer protection law.

Civil penalties can be tripled, up to $150,000 per violation, if a business fails to meet a request to delete or correct data, continues to sell a consumer’s data after they opt out, or “willfully disregards” a minor’s age in its conduct, according to the law.

Businesses can avoid penalties if they remedy issues within 45 days after receiving notice from the attorney general of an alleged violation.

Data Rights

Florida’s law will give consumers the right to confirm whether a business is collecting data about them and to access that data, correct inaccuracies, and delete it.

They can opt out of their data being processed for the purpose of selling, targeted advertising, or profiling. The opt-out provisions also will extend to voice or facial recognition data and sensitive information like geolocation data.

Businesses will be required under the state’s law to take action in response to a consumer’s requests at least twice a year cost-free, but can charge the consumer a “reasonable fee” or decline the request if they determine it’s excessive or repetitive.

Other standard privacy law provisions coming into effect in Florida will require businesses to reasonably secure consumer data from disclosure and conduct assessments to determine the benefits and risks of data collection, along with how to mitigate them.

Other Provisions

The new legislation features unique requirements that no other state privacy law has included.

State and local government entities, for example, will be prohibited from asking a social media company to remove content or accounts from its platform over “unfair censorship” concerns.

Search engines like Google would have to prominently display information that explains how political ideology influences search algorithms. A study published by New York University found that popular social media platforms don’t unfairly censor conservative viewpoints.

Businesses also will be required to limit collection of data about children and avoid using design choices that influence a minor to provide personal information.