A Florida data privacy law tougher than California’s—including rules that would let marketers retain consumer data only for one year and let people sue over even relatively small infractions—is moving fast through the legislature, according to the Association of National Advertisers.
“The chances of this passing are relatively high,” says ANA Group Executive VP-Government Relations Dan Jaffe. “And in our view certainly it would be very damaging.”
The bill, which enjoys strong backing from Republican Gov. Ron DeSantis and bipartisan support as it moves through legislative committees, would make Florida the second biggest state after California with a data privacy law, also joining Virginia and Nevada.
Even among that group, Florida’s law would be particularly hard for marketers because of a provision that requires them to delete data one year after their last interaction with a consumer, Jaffe says. That would be hard on theme parks like Disney World, cruise operators, hotels, resorts and other travel marketers that routinely rely on follow-up marketing with past guests, he says. And it comes at a time when many people haven’t traveled to Florida—or anywhere—or more than a year because of the pandemic.
Some consumer databases, like retailer loyalty programs where people shop regularly, might not be affected by the provision. But other databases, such as those of packaged-goods or automotive brands that might hear from their consumers far less often, could be decimated.
Also of concern to the ANA are provisions in the legislation that would let people sue individually for infractions of the law rather than leaving enforcement up to the attorney general, Jaffe says. “Some of the most technical failures could lead to fairly serious consequences,” he says. “There is a very aggressive trial bar in Florida. And so you have a bill with a great number of technical aspects, and you could be sued for virtually all of them.”
That may change in the final legislation. After Jaffe penned a column in the Talahassee Democrat and the Florida Chamber of Commerce pushed for changes, the bill’s Senate sponsor proposed removing the individual right to sue from the law. She also proposed a loophole for marketers that work with third-party service providers, limiting the effect of much of the bill to companies that sell personal information of more than 100,000 customers to third parties or get 50% or more of global revenue from selling or sharing consumer data.
But Jaffe says those provisions haven’t been incorporated into the Senate version yet or considered in the House, and it’s not clear they’d survive a final vote.
Jaffe says another big state adopting its own set of data privacy rules that national advertisers might have to abide by just adds to an increasingly complex patchwork of regulations. He renewed the ANA’s call for national privacy legislation that would supersede the state laws.
For their part, 10 advocacy groups backing the Florida law aren’t buying the need for changes favored by the ANA and other business groups. A private right to sue is the most important tool the legislature can give Floridians, the groups said in a letter earlier this week. Without it, they said, “there is a very real risk that companies will not comply with the law because they think it is unlikely that they would get caught or fined.”
