• by Wendy Davis  @wendyndavis, May 8, 2023

Florida lawmakers late last week passed a privacy bill that could give state residents a limited ability to wield control over their data.

If signed by Governor Ron DeSantis, Senate Bill 262 would allow consumers to learn what information about them had been collected by companies, and to have some data deleted.

But most provisions apply only to the companies with more than $1 billion in revenue and that either derive at least half of their global revenue from ad sales, or operate a smart speaker, or operate an app store with at least 250,000 different apps.

The bill, which was passed after a flurry of significant last-minute amendments, would require companies that target ads based on non-pseudonymous data to allow consumers to opt out.

Companies that target ads based on pseudonymous data -- such as information linked to cookies -- wouldn't be required to allow opt-outs, provided the pseudonymous data was stored separately from identifiable data.

The statute defines targeted advertising as displaying ads based on data collected over time from unaffiliated sites and apps, as well as from sites and apps that are affiliated with each other. Other states that define ad targeting typically exempt first-party data -- meaning information collected from affiliated sites and apps -- from restrictions.

Consumer Reports criticized the measure, arguing that it is too narrow.

“Due to its applicability to only the very largest tech companies and other significant loopholes, it would leave Florida consumers’ personal information unprotected in a wide variety of contexts,” the organization said Friday. “Notably, the bill’s consumer rights do not apply to pseudonymous information, such as most online cookies, rendering the right to opt-out of targeted advertising largely meaningless.”

The Florida bill also includes provisions comparable to California's Age Appropriate Design Code, which restricts data collection from minors while also requiring platforms to avoid using or processing minors' data in ways that could cause result in eating disorders, addictive behavior, bullying or other potential harms.

Passage of the Florida bill comes as state lawmakers are increasingly turning their attention to privacy as well as teens' social-media use.

This year alone, lawmakers in four other states passed online privacy bills -- Iowa, Indiana, Montana and Tennessee. The governors of Iowa and Indiana have already signed those bills into law. Five other states previously enacted online privacy laws -- California, Colorado, Connecticut, Utah and Virginia.

Also this year, lawmakers in two other states -- Utah and Arkansas -- passed statutes aimed at protecting teens from potential online harms.