Florida — Federal AI Compliance Profile (FTC, EEOC, FCRA, COPPA + Insurance AI): AI Compliance Requirements

Florida's active real estate market (highest mortgage volume in the US) makes FHA AI compliance critical. AI property valuation models, mortgage underwriting AI, and rental screening AI that produce discriminatory outcomes violate the Fair Housing Act. Cite: DOJ/HUD Joint Statement on Algorithmic Discrimination (2023); CFPB Fair Housing enforcement in AI mortgage lending. Automated valuation models (AVMs) must be tested for racial disparate impact.

Florida employers using AI for hiring, scheduling (especially in hospitality, healthcare, and retail) must comply with federal employment discrimination laws. Florida's large service sector uses AI scheduling tools — these must not discriminate on protected characteristics. Florida has no state employment discrimination enhancement, so federal EEOC standards are the primary compliance obligation.

FCRA applies to AI-driven credit, background, and tenant screening in Florida's large rental market. CFPB Circular 2022-03: specific AI-derived adverse action reasons required. COPPA applies to AI platforms used by Florida minors (Florida also enacted HB 3 in 2024 restricting minors under 14 from social media — AI platforms serving minors must comply).

Florida SB 1180 (2025, eff. Oct. 1, 2025) makes it a felony to knowingly create, possess, solicit, control, or share an AI-generated or AI-altered sexual depiction of an identifiable minor, and a non-consensual sexual deepfake of an identifiable adult, closing the loophole that excluded computer-generated/altered imagery. Victims depicted in non-consensual sexual deepfakes have a private right of action for damages of at least $10,000. Binds individuals and any business or platform that creates or distributes such material in Florida. Counsel should confirm the exact felony degrees, the amended statute sections (e.g., Fla. Stat. §§ 827.071 / 836.13), and the civil-remedy provision against the enacted text.

FALSE-NEGATIVE GAP-FILL (Round 504, 2026-08-25): verified this cycle against the ENROLLED CHAPTER LAW TEXT itself (Ch. 2025-133, Laws of Florida — CS/CS/HB 1161, "Brooke's Law", approved by the Governor and filed with the Secretary of State June 10, 2025, effective upon becoming law), which amends Fla. Stat. § 836.13 and adds a new subsection (6). Operative duty, quoted from the enrolled text: "No later than December 31, 2025, a covered platform shall establish a process whereby an identifiable person or an authorized person acting on behalf of such person may" (1) notify the platform of an altered sexual depiction published on it without the identifiable person's consent and (2) "[s]ubmit a request for the covered platform to remove such altered sexual depiction." A conforming request must be in writing and include a physical or electronic signature; identification of, and information reasonably sufficient for the platform to locate, the depiction; a brief good-faith statement that the depiction is not consensual; and information sufficient to contact the requester. The platform must provide on the platform "a clear and conspicuous notice, which may be provided through a clear and conspicuous link to another web page or disclosure, of the notice and removal process" that "[i]s easy to read and in plain language" and describes the platform's responsibilities and how to submit a request. On a valid request the platform must, "as soon as possible, but not later than 48 hours after receiving such request," (a) "[r]emove the altered sexual depiction" and (b) "[m]ake reasonable efforts to identify and remove any known identical copies of such altered sexual depiction." Good-faith removal carries statutory immunity: a covered platform "shall not be liable for any claim based on the covered platform's good faith disabling of access to, or removal of," material claimed to be a nonconsensual altered sexual depiction, "regardless of whether the altered sexual depiction is ultimately determined to be unlawful." Practical build: a public intake form, a plain-language notice page, an authenticated-request workflow, a 48-hour clock with escalation, and hash/perceptual-match sweeps for identical copies.

FALSE-NEGATIVE GAP-FILL (Round 504, 2026-08-25): the Florida Digital Bill of Rights (FDBR, ch. 2023-201, Laws of Fla. / CS/CS/SB 262, approved June 6, 2023, effective July 1, 2024 "except as otherwise provided") was modelled NOWHERE in this registry before this cycle, despite carrying the state's only automated-decision-making duties. Verified this cycle by direct read of the statute text on flsenate.gov. (1) OPT-OUT: § 501.705 gives a consumer the right to opt out of processing for "[p]rofiling in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer," alongside opt-outs for targeted advertising and the sale of personal data, and for the collection of personal data collected through the operation of a voice recognition or facial recognition feature. "Profiling" is defined in § 501.702 as "any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements" — i.e. the FDBR reaches AI scoring, ranking, and eligibility models run without a human in the loop. (2) ASSESSMENT: § 501.713 requires a documented data protection assessment for enumerated activities, including profiling that presents a reasonably foreseeable risk of "[u]nfair or deceptive treatment of or unlawful disparate impact on consumers," of "[f]inancial, physical, or reputational injury," of intrusion on solitude/seclusion or private affairs, or of "[o]ther substantial injury to consumers," as well as for targeted advertising, sale of personal data, sensitive-data processing, and any activity presenting a heightened risk of consumer harm. The assessment must "weigh the direct or indirect benefits" of processing against "the potential risks to the rights of the consumer," accounting for deidentification safeguards, consumer expectations, the processing context, and the controller-consumer relationship; the Attorney General may demand it under § 501.72. Section 501.713 "applies only to processing activities generated on or after July 1, 2023" and is not retroactive. Practical build: an opt-out signal path that actually suppresses model input, a maintained register of profiling assessments, and disparate-impact testing evidence held ready for a Department of Legal Affairs request.

VERIFIED NEGATIVE, not an obligation. Florida has NOT adopted the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers and has issued no insurance-specific AI regulation or guidance of its own — it is grey in both categories of the NAIC implementation map (checked against both live copies of that map, statuses of August 6, 2026 and April 1, 2026, which carry identical reference lists). A Florida-authorised insurer therefore has NO state mandate to maintain a written AI Systems ("AIS") Program, and no Florida AI-specific model-documentation or filing duty. What actually binds insurer AI in Florida is the generic insurance code — unfair and deceptive trade practices, unfair discrimination, rate and form filing, and market conduct examination — plus federal law, and, for a controller over the $1bn revenue threshold, the Florida Digital Bill of Rights profiling and data-protection-assessment duties recorded elsewhere in this entry. PRACTICAL POSTURE: an insurer writing in Florida AND in any of the 25 adopting jurisdictions (or in California, Colorado, New York or Texas, which have their own insurance-specific instruments) will be held to an AIS Program by those regulators regardless, so the sound answer is one AI governance programme built to the NAIC standard rather than a Florida-specific carve-out — but that is a commercial choice, and Florida must not be described to a customer as imposing it. WATCH ITEM: HB 527 (2026 session) would create a statutory framework restricting AI in claims handling by workers' compensation carriers, insurers and HMOs; it is a BILL, not law, and must not be recorded as an obligation unless and until it is enacted.

Florida HB 919 (2024, eff. July 1, 2024 — election code, ch. 106, Fla. Stat.) requires that any political advertisement, electioneering communication, or other miscellaneous advertisement that uses generative AI to depict a real person performing an action that did not actually occur include a clear disclaimer: "Created in whole or in part with the use of generative artificial intelligence." Failure to include the disclaimer is a first-degree misdemeanor and carries civil penalties. Applies to candidates, committees, and any private actor placing covered political/electioneering communications in Florida. Counsel should confirm the precise Fla. Stat. section, the disclaimer-format requirements, and the penalty schedule against the enacted text.

FALSE-NEGATIVE GAP-FILL (Round 504, 2026-08-25): verified by direct statute read this cycle. Three FDBR provisions bite specifically on AI systems that ingest biometric or ambient signals. (1) Section 501.705 gives the consumer a right to opt out of "the collection of personal data collected through the operation of a voice recognition or facial recognition feature" — the practical Florida analogue to a biometric-AI consent rule, and a direct constraint on voice-assistant, call-analytics, and face-matching pipelines. (2) Section 501.705 also bars a controller from operating a device's recording or data-collection features "for the purpose of surveillance when such feature is not being used by the consumer" unless the consumer expressly authorizes it — this reaches always-on microphone/camera telemetry used to train or feed AI models. (3) Section 501.715 conditions the sale of sensitive data: it applies to "a person who meets the requirements of s. 501.702(9)(a)1.-3. for the definition of a controller," and such a person who engages in the sale of personal data that is sensitive data must obtain consumer consent (with the statutory authorization rules where the consumer is a minor) and must display the prescribed notice, quoted from the statute: "NOTICE: This website may sell your sensitive personal data." The section restricts rather than forbids the sale — but the consent and the verbatim notice are both preconditions. Practical build: a biometric-feature opt-out that is honoured at ingestion (not merely at display), a surveillance-mode audit for any always-listening/always-watching product, and the verbatim sensitive-data notice string if any sensitive-data sale occurs.

FALSE-NEGATIVE GAP-FILL (Round 504, 2026-08-25): Florida's right-of-publicity statute predates generative AI but is the operative Florida-law constraint on synthetic-likeness marketing, and no registry entry cited it before this cycle. Verified by direct statute read: "No person shall publish, print, display or otherwise publicly use for purposes of trade or for any commercial or advertising purpose the name, portrait, photograph, or other likeness of any natural person without the express written or oral consent" of that person (or the persons the statute designates where the individual is deceased or a minor). The statute is medium-agnostic — a synthesised face, a cloned voice used as a spokesperson, or an AI-composited endorsement is a "portrait, photograph, or other likeness" of the natural person it depicts, and the absence of a camera does not create an exemption. Statutory exceptions are narrow: bona fide news, public-affairs, or sports reporting of current legitimate public interest (where the name/likeness is not used for advertising), a resale/redistribution of a product for which the person already consented to the original use, and photographs of a person solely as a member of the public where the person is not identified. Practical build: a consent-provenance record for every real-person likeness or voice used in AI-generated marketing output, plus a synthetic-spokesperson review gate before publication.

Round 504 (2026-08-25) CORRECTION-BY-CONSTRUCTION: this entry's Cycle 9 comment claimed SB 484 was "[a]dded as a light additional note/requirement," but only the summary and maxPenalty text were touched — no requirement object existed, so the applicability engine surfaced nothing to a data-center operator. Requirement created here, with the chapter citation verified this cycle on flsenate.gov: CS/CS/SB 484 ("Data Centers") PASSED (Senate 37-0, House 92-16, Senate concurrence 31-6), was approved by the Governor May 7, 2026 as ch. 2026-65, Laws of Florida, and took effect July 1, 2026 — it is live law. Verified content: it preserves local-government authority over "comprehensive planning and land development regulations relating to large load customers" (so a data-center siting plan cannot assume state preemption of county/municipal land-use control); it requires public utilities to establish minimum tariff and service requirements for large load customers, so that a hyperscale AI facility's interconnection and infrastructure costs are allocated to that customer rather than shifted onto residential and small-business ratepayers; it bars water management districts and the Department of Environmental Protection from issuing consumptive-use water permits to large-scale data centers in specified circumstances (a real constraint on liquid-cooled AI build-outs); and it directs the Office of Program Policy Analysis and Government Accountability to contract for research on the construction and operation of large-scale data centers. Practical effect: an AI infrastructure duty on the CUSTOMER side of the meter, not an AI product-compliance duty — model your tariff exposure, your local permitting path, and your cooling-water assumptions before siting.

Florida introduces AI legislation nearly every session (January–March). The comprehensive AI-governance bills SB 692/HB 1459 (2024) and SB 1508 (2025) failed — monitor myfloridahouse.gov and flsenate.gov for renewed comprehensive efforts. Florida AG James Uthmeier (in office since Feb. 17, 2025; succeeded Ashley Moody, who was appointed to the U.S. Senate) actively enforces FDUTPA against deceptive AI chatbots, false AI performance claims, and misleading AI endorsements, and has opened a criminal investigation into OpenAI/ChatGPT. Monitor myfloridalegal.com for AI enforcement actions.