B2B website visitor identification in Florida

For most B2B companies, no — and this is the single most important fact about the FDBR. Its core controller obligations, such as consumer access and deletion rights and opt-out of sale, attach only to a for-profit entity that does business in Florida, earns more than $1 billion in global gross annual revenue, and additionally either earns at least half that revenue from online advertising, operates a smart speaker or voice-assistant service, or runs an app store with at least 250,000 apps. A mid-market SaaS vendor, professional services firm or manufacturer almost never meets that combined threshold, so it is not a controller under the FDBR's main provisions in the first place. Separate FDBR rules on government-directed moderation, sale of sensitive data and protections for minors apply more broadly and are worth checking independently. Whether a specific company clears the revenue-and-activity threshold is a factual and legal question that deserves review by counsel familiar with the statute, not a general assumption either way.

The two states reached a similar practical result through very different routes, and the difference matters for anyone comparing states. California's CCPA originally exempted business-to-business contact and employee data on a temporary basis, but that exemption expired on 1 January 2023, meaning business contact data about California residents is now fully within CCPA/CPRA's scope. Florida never had that kind of temporary carve-out to expire: the FDBR defines a 'consumer' as a Florida resident acting only in an individual or household context, and explicitly excludes a person acting in a commercial or employment context, from the statute's outset. So in Florida, purely B2B data has arguably always sat outside the consumer definition, while in California it has been back inside scope for years. Confirming exactly how each definition applies to a specific data flow is a job for counsel, not a general comparison like this one.

The revenue-and-activity threshold means the FDBR's core controller obligations almost certainly do not apply to a company that size, which is the case for the large majority of B2B sellers active in Florida. That said, the FDBR contains a few provisions — around government-directed content moderation, sale of sensitive personal data, and protections for known minors online — that are not limited to the billion-dollar tier and could theoretically reach a smaller company depending on what it does. It is also worth remembering that Florida buyers still operate under other laws, general consumer-protection rules, and their own contractual expectations regardless of whether the FDBR itself applies. Treating 'below the threshold' as the end of the analysis, rather than confirming it with counsel and checking the narrower provisions separately, is the kind of shortcut that tends to cause problems later.

Generally no, for two independent reasons that are worth keeping separate. First, lead.box resolves the visiting organisation — a company name, industry and size band derived from network-level signals — rather than identifying a named person, so there is no individual being profiled in the sense the FDBR's rights provisions are built around. Second, even where an individual's activity is involved, the FDBR's consumer definition excludes a Florida resident acting in a commercial or employment context, which describes most B2B website research. Both of these are separate from the question of whether your company even qualifies as an FDBR controller in the first place, given the statute's revenue-and-activity threshold. Documenting all three points distinctly, rather than treating them as one argument, tends to hold up better under a buyer's or counsel's scrutiny.

For the narrow set of companies that do qualify as controllers under the FDBR, the Florida Attorney General generally must provide notice of an alleged violation and allow 45 days for the company to cure it before pursuing enforcement action under FDUTPA. That grace period gives a qualifying company a real opportunity to fix a compliance gap — updating a disclosure, honoring a deletion request, adjusting an opt-out mechanism — before facing the statute's penalties, which can run up to $50,000 per violation and can be trebled in specified circumstances. Because the cure period only matters if a company is a controller under the FDBR to begin with, most B2B sellers will never need to rely on it, but it is a meaningful protection for the platforms the statute was actually written to reach. None of this changes what non-covered businesses should still document for their own buyers.

Enforcement authority sits with the Florida Attorney General and the Department of Legal Affairs, who bring actions under the state's existing Unfair and Deceptive Trade Practices Act rather than a separate standalone privacy enforcement mechanism. There is no general private right of action built into the FDBR allowing an individual Florida resident to sue a company directly over a statutory violation; enforcement is channelled through the Attorney General's office, following the 45-day cure period described above for qualifying controllers. This centralised, single-regulator structure is simpler than states that split authority between an attorney general and a dedicated privacy agency, but it does not change who is covered — the narrow revenue-and-activity threshold still determines whether the FDBR's main obligations apply to a given company at all.

A Florida vendor review typically asks the same questions a review anywhere else in the country asks, largely regardless of whether the FDBR itself applies to either party: what data is collected, whether any of it is sold or shared with third parties, where it is processed and stored, and whether a written data processing agreement is available for signature. lead.box can answer all four plainly — it identifies the visiting organisation rather than a named individual, does not sell or share personal information for advertising, processes data in ISO-certified EU data centres, and provides a data processing agreement along with a published sub-processor list. Having those answers ready, rather than pointing to the FDBR's narrow scope as if it closes the conversation, is what actually moves a Florida procurement process along.

No, and that distinction matters more here than in most states, precisely because the FDBR's applicability turns on a specific combination of revenue and business-activity facts that only your own legal team can confirm for your company. This page describes the statute's structure, its narrow controller threshold, its consumer definition and its enforcement mechanism as general background, and explains where company-level identification sits relative to those provisions, but it is not a substitute for a lawyer reviewing your specific revenue figures, business activities and data flows. Florida's threshold-based approach makes the scoping question genuinely more complex than a simple 'does this law apply to my industry' check, so getting counsel involved before relying on any conclusion here is the right next step, not an optional extra.