Florida Information Protection Act and FDBR: A Car Dealer’s Guide

The Florida Information Protection Act applies to every car dealership in Florida and gives it 30 days to notify customers after a data breach. The Florida Digital Bill of Rights, the state’s newer privacy law, almost never reaches a dealership.

Last updated: October 27, 2026

Say ransomware locks up a store in Tampa on a Monday morning. The DMS is down, the phones are half working, and the service drive is writing repair orders on paper. Somebody from the forensics firm calls on Thursday and says customer files were copied off the server before anything got encrypted. That call starts a clock. A short one.

Florida gives you 30 days from that point to tell every affected customer in writing. Now put that next to how long recovery takes. CDK Global’s 2023 State of Cybersecurity in the Dealership study put average downtime after a dealership cyberattack at 3.4 weeks. Do the math. The store is barely selling cars again and the notice deadline is about a week away.

That’s the Florida law dealers should be thinking about. Not the famous one. The boring one.

I’ve spent nearly 30 years working only with dealerships, and I hold a CISSP, so I read these statutes for a living whether I want to or not. Florida is a funny case. The state passed a big, well-publicized privacy law in 2023, and it barely touches a car dealer. The older law, the one nobody writes press releases about, applies to every store in the state and has one of the shortest breach deadlines in the country.

This is the Florida chapter of our guide to dealership privacy laws by state, which sorts each state by how its exemption is written. Florida needs two answers instead of one. Here they are.

Two Florida Laws, Very Different Reach

The Florida Information Protection Act, Section 501.171 of the Florida Statutes, is the state’s data security and breach notification law. It requires any business that holds Floridians’ personal information to protect it with reasonable measures, dispose of it properly, and notify customers and the state after a breach. It has no exemption for dealerships. None.

The Florida Digital Bill of Rights is a different animal. It’s the consumer privacy law, Sections 501.701 through 501.722, in force since July 1, 2024, and it’s the one with the consumer rights to see, correct, delete, and opt out of the sale of personal data that people usually mean when they say a state “has a privacy law.” The table lines them up against the federal rule every franchised store already lives under.

One of these is the headline. The other one is the work.

Why the Digital Bill of Rights Skips Your Store

Start with who counts as a “controller” under Section 501.702. The business has to make more than $1 billion in global gross annual revenue. Then it also has to do one of three things: earn half its revenue from online ads, run a smart speaker and voice assistant service, or run an app store with at least 250,000 apps. That’s a list written with about five companies in mind, and none of them sell pickups. Not one.

There’s a funny detail in the smart speaker test. The statute specifically carves out a voice assistant in a vehicle that’s operated by a motor vehicle manufacturer. So even the in-dash assistant in the car on your lot doesn’t pull the OEM in through that door.

Then there’s the backstop. Section 501.703(2)(b) says the whole part doesn’t apply to “a financial institution or data subject to Title V” of the Gramm-Leach-Bliley Act. The FTC’s dealer FAQ on the Safeguards Rule is clear that a dealer arranging financing, or leasing a vehicle for more than 90 days, is a financial institution, which is the same reasoning that puts those stores under the Safeguards Rule in the first place. That covers nearly every franchised store in Florida, light-duty and heavy truck. So a Florida dealer is out twice. Too small. Exempt anyway.

I’d stop there if it weren’t for one section that most summaries skip. Section 501.715 on selling sensitive data doesn’t use the billion-dollar test. It reaches any for-profit business that operates in Florida and collects personal data. That’s a much lower bar. Sensitive data includes precise geolocation and biometric data, and selling it takes the consumer’s prior consent plus a posted notice. A franchised store is still exempt as a financial institution. A sister company that never arranges financing isn’t, and that’s where I’d look. Carefully. Think of the collision center set up as its own LLC, or the management company that signed the CRM and marketing contracts.

The attorney general’s office enforces all of it, with civil penalties up to $50,000 per violation under Section 501.72, and nobody else can sue under it. For the store itself, the honest summary is short. It doesn’t apply. Move on.

The Florida Information Protection Act Has No Dealer Exemption

Now the part that matters. The Florida Information Protection Act applies to any “commercial entity” that acquires, maintains, stores, or uses personal information. Corporation, LLC, sole proprietorship. There’s no revenue floor, no customer count, and no carve-out for Gramm-Leach-Bliley financial institutions. If you hold a Floridian’s data, you’re a covered entity. Period.

And what counts as personal information is wider than most dealers assume. It’s a name plus any of these: a Social Security number, a driver license number, a financial account or card number with its access code, medical or health insurance information, biometric data, or any information about the person’s geolocation. A username or email with its password counts on its own, no name needed.

Walk your store with that list in hand. Slowly. Every test drive starts with a scanned driver license. Every deal jacket has a Social Security number in it. The fingerprint time clock in the service department is biometric data, and the GPS units on your loaner fleet are geolocation data tied to a named customer. None of that is exotic, and none of it was collected with a privacy law in mind, because it was collected to sell a car, pay a technician, or find a loaner that didn’t come back on time. It’s a normal Tuesday at a Florida dealership.

The law asks two things of you before anything goes wrong. Take “reasonable measures to protect and secure” that data. And when you no longer need a record, shred it, erase it, or otherwise make it unreadable. That second duty is the one I see ignored the most, usually in the form of a storage room full of old deal jackets that nobody owns.

Who owns that? Somebody should. Usually nobody does.

Florida’s 30-Day Breach Clock, Notice by Notice

The clock starts when you determine a breach happened, or when you have reason to believe one did. Not when the attack started. Not when the forensics report is finished. From there, Florida and the FTC want several different notices, and they don’t all go to the same place.

• Customers get written notice by mail or email within 30 days. You can get 15 more days, but only if you give the state a written reason within those first 30.
• Over 500 Floridians affected? The Department of Legal Affairs, which is the attorney general’s office, gets its own notice within 30 days, with a synopsis, the count, and a copy of the customer letter. They can ask for your forensic report and your policies later. Expect it.
• More than 1,000 people at once means the nationwide credit reporting agencies hear from you as well.
• Your vendors get 10 days. A DMS provider, CRM, or other company holding data for you is a “third-party agent,” and it has to tell you within 10 days of finding a breach. The catch: if the vendor botches the notice, the law counts that against you, not them.
• The FTC hears from you separately, under the Safeguards Rule, when 500 or more consumers’ unencrypted information is involved. Our guide to the Safeguards Rule breach notice walks through that federal report.

Back to the store in Tampa. Say the forensics firm comes back and the files that got copied were encrypted, and the attackers never got the key. Florida doesn’t count encrypted files as personal information, so there may be nothing to send customers at all. That’s the best day you’ll have in the whole incident. You buy it in advance.

If the files weren’t encrypted, there’s still a narrow out. The store can bring in law enforcement, investigate, and decide in good faith that nobody’s likely to suffer identity theft or financial harm, but it has to write that down, hold on to it for 5 years, and send it to Tallahassee inside the 30 days. I wouldn’t want to be the GM signing that one.

Somebody will also ask whether the FTC report takes care of Florida, since the statute gives credit for notice made under a federal regulator’s rules. My read is no. The FTC report goes to the FTC and nobody else, and the credit Florida gives is for notifying customers. Your attorney has the last word.

Miss the deadline and Florida can collect $1,000 a day for the first 30 days, then $50,000 per 30-day stretch, up to $500,000 per breach. No customer lawsuits under this act, though. The fine honestly isn’t what I’d worry about in Tampa that week. I’d worry about the controller pulling a customer list together for a mailing out of a DMS that’s still half down, while the forensics count of affected files keeps moving and the GM is on the phone with the OEM.

Thirty days goes quick in a week like that.

What I’d Put in Place Before Anything Happens

Our security team runs into this all the time. They put compliance meetings on dealers’ calendars, and a lot of dealers just don’t come, even when we’re the ones running their compliance program. I get it. Nobody opens a dealership because they love incident response plans. But a Florida breach is the moment you find out whether the plan was real or a binder on a shelf.

The FTC Safeguards Rule hasn’t gone away, and Florida’s law stacks right on top of it. The question I’d ask any Florida store is whether you’re checking boxes on a checklist or whether your systems are actively monitored and reported on. Not the same thing. One finds the breach on day one. The other finds it when a customer calls about a strange charge.

Get the dealer principal, the controller, and your Safeguards qualified individual at one table for an afternoon. Then work this list, and call your attorney when you’re done.

1. The incident response plan gets the Florida clocks written in, each with a person’s name beside it. Customers at 30 days. The state at 30 days once 500 Floridians are involved. Credit bureaus past 1,000. The FTC at 500.
2. Vendor contracts. Does every company holding your customer data owe you notice within 10 days? If the contract just says “promptly,” that’s a real problem, and the renewal is the time to fix it.
3. Driver license scans, the fingerprint clock, the loaner GPS. Who owns each?
4. Old deal jackets in a back room and retired servers in a closet are personal information until they’re shredded or wiped, so set a schedule and actually do it.
5. Mark which companies in the group never arrange financing, since those are the ones Section 501.715 can reach.
6. Ask your attorney for a customer notice template now. It’s a much calmer conversation when nothing is on fire.

Our dealership compliance services run the Safeguards side as a continuous program with ongoing monitoring and a vendor risk rating, which is usually where the 10-day vendor question gets answered. If your stores are in South Florida or on the Gulf Coast, our Miami-Fort Lauderdale dealership IT page and Tampa Bay dealership IT page cover the local side.

We support 2,000-plus dealerships, and we’ve already seen this exact problem play out more than once: the stores that got through a breach without scrambling were the ones that had already decided who calls the attorney, who pulls the customer list, and who signs the letter, long before anyone needed to. Deciding it during the incident doesn’t work. Nobody does compliance that way.

Questions Florida Dealers Bring Us

If you want to know how your stores would hold up against that 30-day clock, our complimentary IT and cybersecurity assessment is the place to start. We’ll look at where your customer data lives, who your vendors are, and how you’d find a breach in the first place, then tell you plainly what we’d fix first.

We take care of the IT so you can sell and service cars. Knowing your Florida clock before you need it is part of that job.