Florida Children’s Privacy Laws (2026)

In force · Social media · effective 2025-01-01 · binds platforms, operators

Ages: Under 14 (barred entirely); 14-15 (allowed only with parental consent)

Requires: Covered social media platforms must prohibit account creation/maintenance by minors under 14 (terminate existing under-14 accounts), and may allow 14- and 15-year-olds only with a parent's or guardian's consent (the section prescribes no consent-verification method); terminations of under-14 accounts and of non-consenting 14-15 accounts follow a 90-day dispute window.

Litigation: CCIA & NetChoice v. Uthmeier (N.D. Fla. No. 4:24-cv-00438 / 11th Cir. No. 25-11881). PI granted June 3, 2025; 11th Circuit stayed the PI Nov 25, 2025 (2-1, design-feature rationale; Rosenbaum, J., dissenting), so the law remains enforceable pending appeal. Oral argument was held March 10, 2026. Post-argument, the panel ordered supplemental briefing on June 15, 2026 addressing associational standing, third-party standing, and whether the district court decided the as-applied challenge in its PI order; both sides filed supplemental briefs on June 29, 2026, followed by notices of supplemental authority into July 2026. No merits ruling has issued; the stay of the injunction remains in effect and the law continues to be enforceable. The Department of Legal Affairs is also enforcing the section in court. Office of the Attorney General v. Snap Inc. (filed April 2025 in Santa Rosa County, removed to N.D. Fla., No. 3:25-cv-00676): on Aug 13, 2025, while the PI was in force, the district court denied remand and denied the State's motion for a temporary injunction because it had already found HB 3 likely unconstitutional; the State's interlocutory appeal (11th Cir. No. 25-12814) was argued March 10, 2026 alongside No. 25-11881, the court carried with the case the question whether it has jurisdiction to review the remand denial, and no decision has issued. Office of the Attorney General v. TikTok Inc. et al. (e-filed June 15, 2026, Nineteenth Judicial Circuit, St. Lucie County) pleads in Count I that TikTok contracts with children under 14, and with 14- and 15-year-olds without parental consent, alongside FDUTPA and public-nuisance counts; no ruling identified.

Entry last reviewed 2026-10-01

SB 262 (2023), ch. 2023-201, s. 2; public-records subsection added by SB 1648 (2023), ch. 2023-262, s. 1; amended by SB 7026 (2026), ch. 2026-52, s. 10

In force · Design code · effective 2024-07-01 · binds platforms, operators

Ages: Children under 18 (consumers under 18; duties attach only to a service, product, game or feature likely to be predominantly accessed by children)

Requires: Binds an online platform (social media under s. 112.23(1), online games and gaming platforms) offering a service, product, game or feature likely to be predominantly accessed by children. It may not: process a child's personal information with actual knowledge, or willful disregard, that the processing may cause substantial harm or privacy risk to children (an open standard: any reasonably foreseeable substantial injury or offensive privacy intrusion, from self-harm and addictive use to bullying, sexual exploitation and predatory marketing); profile a child without appropriate safeguards and either necessity for the feature in use or a compelling reason it poses no such risk; collect, sell, share or retain more personal information than that feature needs, or use it for another purpose, without a compelling reason; collect, sell or share precise geolocation (a 1,750-foot radius) unless strictly necessary, only while necessary, and never without an obvious sign to the child; use dark patterns (including any the FTC calls one) to extract extra data, waive privacy protections or take harmful actions; or reuse or over-retain age-estimation data (any age estimate must be proportionate to the service's risks and data practice). The platform bears the burden of proving compliance. Nothing in the section mandates age verification, high-privacy defaults or an impact assessment. Enforced solely by the Department of Legal Affairs as an unfair and deceptive trade practice: a discretionary 45-day cure period, civil penalties of up to $50,000 per violation, which may be tripled where the platform has actual knowledge the Florida child is under 18, and no private right of action.

Timing: effective 2024-07-01 under section 27 of ch. 2023-201. Subsection (6)(e), added by the public-records act ch. 2023-262, says 'this section' shall stand repealed on October 2, 2028 under the Open Government Sunset Review Act, s. 119.15. That Act by its own terms reviews exemptions from public-records law, s. 119.15(3) says what lapses in the fifth year is 'the exemption', and the title of ch. 2023-262 describes the clause as 'providing for future legislative review and repeal of the exemptions', which supports reading the 2028 repeal as reaching only the subsection (6) investigation-records exemption; the enacted words 'this section' are broad enough to reach the whole section, including the duties in subsection (2), and no court or codifier has construed them, so whether the duties survive October 2028 is unresolved

Litigation: No challenge to 501.1735 identified in the NetChoice Litigation Center (whose Florida cases are NetChoice & CCIA v. Moody, over the 2021 social media deplatforming law SB 7072, and CCIA & NetChoice v. Uthmeier, over HB 3's account restrictions at 501.1736), on the Orrick Online Safety Law Center's Florida page (which lists the section with no litigation) or in the Florida Attorney General's news releases. The Department of Legal Affairs is enforcing the section: Office of the Attorney General, State of Florida, Department of Legal Affairs v. Roblox Corporation, filed 2025-12-11 in the Circuit Court of the Eighth Judicial Circuit, Baker County, pleads in Count V that Roblox, as an online gaming platform likely to be predominantly accessed by children, violated 501.1735(2)(a)-(d), and seeks the $50,000 per-violation penalty, which may be tripled for known under-18 users, alongside four other FDUTPA counts. The case was removed to the Middle District of Florida on 2026-01-12 (No. 3:26-cv-00057, Judge Pratt); Roblox's motion to dismiss was fully briefed on 2026-05-15 and is pending, a show-cause order was briefed in May 2026 with no ruling, and notices of supplemental authority were filed on 2026-07-31 and 2026-09-10, followed by three further filings on 2026-09-11 and 2026-09-14.

Entry last reviewed 2026-10-01

SB 262 (2023)

In force · Privacy law (minors) · effective 2024-07-01 · binds operators

Ages: Known children under 18 (COPPA-consent for under 13; affirmative authorization for 13-17)

Requires: Under Florida's comprehensive privacy law, the personal data of a 'known child' (a child the controller has actual knowledge of, or willfully disregards as, under 18) is sensitive data. A controller, which the Act limits to for-profit businesses (and entities that control or are controlled by one) with more than $1 billion in global annual revenue that also earn at least half of it from online ads, operate a voice-assistant smart speaker, or run an app store offering at least 250,000 apps, may not process a known child's data except with the affirmative authorization of a 13-to-17-year-old or, under 13, in accordance with COPPA. Section 501.715 separately bars any for-profit business that does business in Florida and collects consumers' personal data, whatever its size, from selling a known child's data on any other basis, and a business that sells sensitive data must provide the notice 'NOTICE: This website may sell your sensitive personal data.' Consent cannot be obtained via broad terms of use, passive actions, or dark patterns. Section 2 of the same act created Fla. Stat. 501.1735 (Protection of children in online spaces), the design-code duties on social media and gaming platforms likely to be predominantly accessed by children, which this tracker carries as a separate Design code entry for Florida.

Litigation: No challenge to the Act identified on the NetChoice or CCIA litigation pages, whose Florida cases concern HB 3 (501.1736) and the 2021 social media law SB 7072. The Department of Legal Affairs is enforcing the children's-data provisions in state court. Office of the Attorney General v. Roku, Inc. and Florida Roku, Inc. (e-filed 2025-10-13 in Collier County circuit court, Twentieth Judicial Circuit) pleaded that Roku processed known children's sensitive data without complying with COPPA (under 13) or obtaining affirmative authorization (13 to 17), in violation of 501.71(2)(d), and sold sensitive data in violation of 501.715; the Attorney General and Roku announced a negotiated resolution on 2026-06-26, with no finding of wrongdoing or civil fine and Roku committing to added parental controls. Office of the Attorney General v. Netflix, Inc. (e-filed 2026-09-09 in St. Johns County circuit court, Seventh Judicial Circuit) pleads in Count V that Netflix sold sensitive personal data, including data collected from known children, without the consent 501.715 requires, and seeks up to $50,000 per violation under 501.72, trebled for known children, alongside four FDUTPA counts; no ruling identified.

Entry last reviewed 2026-10-01