In March 2023, Florida lawmakers introduced new legislation in the state’s House of Representatives and Senate focused on data privacy and certain transparency issues. Despite some differences, the House and the Senate versions of the legislation propose broadly similar rules to protect consumer privacy as well as certain measures to limit the government’s role in social media content moderation and improve the transparency of search engine results for political content. The proposed law risks exacerbating the increasingly confusing patchwork of overlapping federal and state privacy laws and creating further uncertainties, while its potential to improve statewide privacy practices and consumer rights remain limited.
Unlike other major jurisdictions—such as the European Union, Canada, and China—the United States does not have a comprehensive national privacy law. Instead, overlapping federal and state statutes and agency rulemaking have created a fragmented patchwork of divergent privacy rules. As of April 2023, six states—California, Colorado, Connecticut, Iowa, Virginia, and Utah—have created state privacy statutes, while at least twenty other states have introduced bills that are currently active.
As more states like Florida seek to pass new state privacy laws, the U.S. digital single market risks suffering from increasing regulatory fragmentation. In the absence of a federal privacy law with preemption powers, such state-level laws could increase transaction costs, create new barriers to trade, and weaken awareness of consumer rights across state boundaries.
Despite such drawbacks, the Florida legislation’s potential to improve statewide privacy practices remains limited as it would only apply to a relatively small number of companies. Instead of applying generally to any entity dealing with the sensitive data of Florida residents, the proposed law would only apply to businesses with revenue of more than $1 billion that either 1) manufacture smart devices or 2) receive at least 50 percent of annual revenue from selling online- or targeted advertisements.
However, privacy rules are important not only for firms that produce smart devices or sell advertisements but for any entity processing or selling the sensitive personal data of a large number of consumers. Accordingly, states like Virginia and Connecticut have pursued a more general, risk-focused approach in designing data privacy legislation. In contrast, companies that process, use, or sell the sensitive data of Florida consumers but do not meet the narrow criteria for jurisdiction would remain beyond the scope of Florida’s proposed law. In other words, since Florida’s privacy legislation would only apply in limited circumstances, its potential to improve consumer rights and state-wide data practices across different sectors is limited.
While the stated purpose of the legislation is to protect consumer privacy, its true focus appears to lie elsewhere. For instance, the Florida bills include measures to bar government entities and employees from developing any agreements or working relationships with social media platforms for purposes of content moderation. While limiting government intervention in content moderation is a worthy goal, the extent to which such phenomena remain so commonplace as to merit legislation remains unclear. Also unclear is the extent to which such measures—even if they were needed—should be included in privacy law.
Similarly, unlike any other state privacy laws, the Florida legislation proposes transparency requirements for search engines for political content. Both versions of the proposed law stipulate that “[a] controller that operates a search engine shall provide a consumer with information of how the controller’s search engine algorithm prioritizes or deprioritizes political partisanship or political ideology in its search results.”
The choice of language—“how” a search engine prioritizes political content as opposed to “whether” it does so— presupposes that search engines prioritize content as a function of partisanship and/or ideology. As private entities, search engines should be free to prioritize or deprioritize “politically partisan” or “ideological” content, but empirical evidence does not appear to support assertions that they do. For example, a statistical study conducted by The Economist in June 2019 found no evidence of ideological bias in Google search results, concluding that its search engine algorithms rewarded reputable reporting over, or rather than, left- or right-leaning news sources.
Furthermore, to the extent that there is user-specific bias in search engine results, such biases often reflect a specific user’s search history, browsing patterns, and preferences, as well as partisan differences in search terms. In any case, search engine algorithms require significantly complex calculations that keep changing and cannot always be explained clearly without the quality and relevance of search results.
In summary, although Florida’s proposed privacy law has certain positive features, its shortcomings far outweigh potential benefits. Its overly broad proposals related to social media platforms and search engine algorithms go far beyond the scope of any other state-level privacy laws. Instead of passing poorly designed legislation at the state level, Florida lawmakers should consider focusing their efforts at the federal level, where the state could play an important role in advocating a pragmatic, principles-based privacy framework that could better balance the competing priorities of data privacy, technological innovation, and commercial needs.