Florida enters the privacy enforcement arena: Why companies need to take note

BlogLine

Florida enters the privacy enforcement arena: Why companies need to take note

12/1/25

The Sunshine State has officially stepped into the privacy-enforcement arena. On October 13, 2025, Florida Attorney General James Uthmeier announced that the Office of Parental Rights filed a civil enforcement action against Roku, Inc. and its Florida subsidiary for alleged violations of the Florida Digital Bill of Rights (“FDBR”) and the Florida Deceptive and Unfair Trade Practices Act.

The FDBR, signed into law on June 6, 2023, and effective July 1, 2024, made Florida the tenth state to enact a consumer data privacy law. Unlike broader laws in other states, the FDBR is narrowly tailored in its application to tech giants: businesses with more than $1 billion in gross annual revenue that either (1) drive half of revenue from digital ad sales, (2) operate certain app stores or digital distribution platforms with at least 250,000 different software applications for consumers to download and install, or (3) offer smart home speakers. This extreme narrowness has largely kept the FDBR out of the conversation – until now.

According to the Complaint, Roku meets the first and third thresholds. Attorney General Uthmeier claims that Roku’s voice remote qualifies as a smart speaker connected to a cloud computing service that operates via voice activation.

The Complaint alleges three violations of the FDBR:

Roku allegedly collected and processed personal and sensitive data from “known children” without parental authorization, despite indicators of child-focused content;
Roku allegedly failed to disclose that its platform may sell personal sensitive data, including geolocation data;
Roku allegedly failed to take reasonable steps to prevent data shared with advertisers and data brokers from being linked back to individuals users.

Florida seeks civil penalties of up to $150,000 per violation involving children and up to $50,000 for each violation affecting an individual user in the state. Florida also seeks injunctive relief and measures requiring Roku to implement lawful parental controls and provide transparent disclosures. While the Complaint does not identify the number of violations, the potential penalties could reach tens of millions, if not hundreds of millions of dollars.

For companies that fall within the FDBR’s narrow scope, the law sets forth specific obligations. These include collecting personal data only to the extent reasonably necessary for the purposes disclosed, implementing appropriate administrative, technical, and physical safeguards, and obtaining consent before processing sensitive categories of data such as racial or ethnic origin, biometric or genetic information, and precise geolocation.

The Roku action marks a clear shift from Florida’s historically relaxed stance on privacy. Even with the FDBR’s narrow applicability, this shift signals that Florida intends to enforce its privacy laws assertively, putting major companies operating in the state on notice.

For more information, please contact Jacob Berlinger at jacob.berlinger@fmglaw.com, Zohar Peleg at zohar.peleg@fmglaw.com or your local FMG attorney.

Information conveyed herein should not be construed as legal advice or represent any specific or binding policy or procedure of any organization. Information provided is for educational purposes only. These materials are written in a general format and not intended to be advice applicable to any specific circumstance. Legal opinions may vary when based on subtle factual distinctions. All rights reserved. No part of this presentation may be reproduced, published or posted without the written permission of Freeman Mathis & Gary, LLP.

Save Print