• by Wendy Davis  @wendyndavis, June 6, 2023

Florida Governor Ron DeSantis on Tuesday signed a privacy bill that gives state residents limited ability to control their data, but doesn't appear to require companies to allow consumers to opt out of many forms of online ad targeting.

Senate Bill 262allows consumers to learn what information about them has been collected by the largest tech companies, and to have some data deleted. Most of the law's provisions apply only to companies with more than $1 billion in revenue, and that also glean at least half of their revenue from ads, or operate a smart speaker, or operate an app store with at least 250,000 different apps.

The law also requires large tech companies that target ads based on non-pseudonymous data to allow consumers to opt out. Companies that target ads based on pseudonymous data -- such as information linked to cookies -- are not required to allow opt-outs, provided the pseudonymous data is stored separately from identifiable data.

The measure defines targeted advertising as displaying ads based on data collected over time from unaffiliated sites and apps, as well as from sites and apps that are affiliated with each other. Other states that define ad targeting typically exempt first-party data -- meaning information collected from affiliated sites and apps -- from restrictions.

Consumer Reports, which previously criticized the bill, is urging lawmakers to revise the measure by applying its requirements to a broader range of companies.

“While we recognize that big tech companies are usually some of the worst privacy offenders, they are far from the only privacy offenders,” policy analyst Matt Schwartz stated Tuesday. “This law should apply to any entity that collects significant amounts of consumer data.”

The organization also noted that while the law technically gives consumers the right to opt out of ad targeting, that right is “largely meaningless” because it doesn't apply when ads are targeted based on data stored in pseudonymous cookies.

In addition to the privacy restrictions, the law also has provisions aimed at political content. One provision requires Google or other large search engines to disclose how whether they prioritize speech based on “political partiasanship or political ideology.”

Another provision prohibits government officials from asking social media companies to remove content or engage in other content moderation efforts.

Florida is now the fifth state this year to enact privacy legislation. Others are Iowa, Indiana, Montana and Tennessee. Texas lawmakers also recently passed a privacy bill, which is still awaiting the governor's approval.

Those states all allow residents to wield some control over their data, but only Indiana and Montana require companies to allow consumers to reject ad targeting based on pseudonymous data, such as information tied to cookies.

Five other states -- California, Colorado, Connecticut, Utah and Virginia -- previously passed privacy laws that allow residents to reject behavioral ad targeting, including targeting based on pseudonymous information.