Does Florida's privacy law apply to a small business using AI?

Florida's Digital Bill of Rights is unusual among state privacy statutes because its applicability test was drawn to catch a small number of very large platforms. A controller must conduct business in the state, exceed a billion dollars in global gross annual revenue, and additionally meet one of a short list of business-line tests — deriving at least half of global revenue from selling online advertisements, operating a smart speaker with an integrated virtual assistant, or running an application store above a stated size. A business that fails any limb of that is not a controller under the statute.

The practical consequence is that most compliance guidance a Florida operator encounters is describing somebody else's obligations. National summaries list Florida alongside states whose thresholds are an order of magnitude lower, which produces businesses building consent flows and data mapping exercises for a law they are outside, while the statutes they are inside go unread. Some sector-specific provisions of the Florida act reach further than the controller definition, which is worth checking, but the general consumer rights regime does not.

The rule that actually binds a Florida business using AI on calls is the state's recording consent requirement, which asks for the consent of all parties rather than one. That reaches any product that records — a transcription assistant, a call summariser, a quality tool, an AI receptionist logging the conversation — and the consent has to be obtained before the recording starts. This is the single most common way a Florida operator gets into difficulty with a tool bought on the assumption that a national default applies.

The second is the state's telephone solicitation statute, which imposes its own consent requirements on automated calls and text messages to Florida numbers, separately from and in addition to the federal rules. An automated follow-up sequence, a reactivation campaign, or an agent that texts a lead it has not spoken to is squarely inside it, and the enforcement route includes private claims. A business automating follow-up should treat Florida as a jurisdiction with its own rules rather than a state covered by the federal ones.

Sector rules complete the picture and are frequently the binding constraint. Health care, insurance, financial services, real estate and any licensed trade carry their own state requirements about communication, records and supervision, and those apply regardless of any privacy threshold. A Florida medical practice's constraints on AI use come from health privacy rules and its licensing board, not from the Digital Bill of Rights, and looking in the wrong place is how a practice concludes it has no obligations.

So the useful sequence for a Florida operator is short. Confirm you are outside the privacy statute, which takes minutes. Then handle recording consent, which is a product configuration and a script change. Then handle automated outreach consent, which is a record of who agreed to what. Then check your own licensing regime. That order matches where the exposure actually is, and it is close to the reverse of the order a general compliance checklist produces.