Regulon — FL-SB-482 · FL SB 482 (AI Bill of Rights)

WHAT THIS BILL REGULATES · 5 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Department of Legal Affairs (Attorney General) is the sole enforcer for violations of §§ 501.9984–501.9986 under the Florida Deceptive and Unfair Trade Practices Act. Sections 501.211 and 501.212 (private FDUTPA actions) are expressly excluded for §§ 501.9985 and 501.9986. For § 501.9984, the department enforces under FDUTPA for knowing or reckless violations, but a separate private right of action is available on behalf of minor account holders under § 501.9984(5). The department may grant a 45-calendar-day cure period after written notice; if cured, no enforcement action proceeds. The cure period does not apply where the platform willfully or knowingly disregarded the account holder's age. For § 540.08 (name/image/likeness), the individual or authorized person may bring a private action. The department has investigatory subpoena power under § 501.9987.

Private Right of Action

private right of action is available on behalf of minor account holders under § 501.

Penalties

For §§ 501.9984–501.9986 enforcement actions by the department: civil penalty up to $50,000 per violation, plus reasonable attorney fees and court costs. Under § 501.9984(5) private right of action on behalf of minor account holders: up to $10,000 in damages plus court costs and reasonable attorney fees. Punitive damages available under § 501.9984(3) where a companion chatbot platform's failure to comply is part of a consistent pattern of knowing or reckless conduct. For § 540.08 (unauthorized AI likeness): injunctive relief, actual damages including reasonable royalty, and punitive or exemplary damages. Additional civil penalty up to $1,000 per violation for unauthorized use of a servicemember's likeness. Investigatory subpoena non-compliance under § 501.9987: civil penalty up to $5,000 per week in violation, plus reasonable attorney fees and costs.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Fla. Stat. § 287.138

Government AI procurement: foreign country of concern restrictions

Government

(1)(a) "Artificial intelligence" means a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments.

(3)(a) 1 Beginning July 1, 2026, a governmental entity may not extend or renew a contract with an entity listed in paragraph (7)(a), paragraph (7)(b), or paragraph (7)(c).

(3)(b) 2 Beginning July 1, 2026, a governmental entity may not accept a bid on, a proposal for, or a reply to, or enter into a contract with, an entity to provide artificial intelligence technology, software, or products, including as a portion or an option to the products or services provided under the contract, unless the entity provides the governmental entity with an affidavit signed by an officer or a representative of the entity under penalty of perjury attesting that the entity does not meet any of the criteria in paragraph (7)(a), paragraph (7)(b), or paragraph (7)(c).

(7) 1 A governmental entity may not knowingly enter into a contract with an entity for artificial intelligence technology, software, or products, including as a portion or an option to the products or services provided under the contract, if: (a) The entity is owned by the government of a foreign country of concern; (b) A government of a foreign country of concern has a controlling interest in the entity; or (c) The entity is organized under the laws of or has its principal place of business in a foreign country of concern.

Section 287.138 is amended to define artificial intelligence and to prohibit governmental entities from contracting with entities owned by, controlled by, or organized under the laws of a foreign country of concern for AI technology, software, or products. Beginning July 1, 2026, governmental entities may not extend, renew, or enter into such contracts. Prospective vendors must provide a sworn affidavit attesting they do not meet the foreign-country-of-concern criteria.

Compliance actions 2 items

Government entities must not enter into, extend, or renew contracts for AI technology, software, or products with entities that are owned by, have a controlling interest held by, or are organized under the laws of or have their principal place of business in a foreign country of concern.

PS-01.4

Government entities must require AI technology vendors to provide a sworn affidavit, signed under penalty of perjury, attesting that the vendor is not owned by, controlled by, or organized under the laws of a foreign country of concern before accepting bids, proposals, or entering contracts for AI technology, software, or products.

PS-01.4

Fla. Stat. § 501.9982

Rights relating to the use of artificial intelligence

(1)(a)–(l) Residents are entitled to certain rights with respect to the use of artificial intelligence, including, but not limited to: (a) The right to use artificial intelligence to improve their own lives and the lives of family members, fellow residents, and the world at large in accordance with the law. (b) The right to supervise, access, limit, and control their minor children's use of artificial intelligence. (c) The right to know whether they are communicating with a human being or an artificial intelligence system, program, or chatbot. (d) The right to know whether artificial intelligence technology companies are collecting personal information or biometric data, and the right to expect artificial intelligence technology companies to protect and deidentify that information or data in accordance with the law. (e) The right to pursue civil remedies authorized by law against persons who use artificial intelligence to appropriate the name, image, or likeness of others for commercial purposes without their consent. (f) The right to be protected by law from criminal acts, such as fraud, exploitation, identity theft, stalking, and cyberbullying, regardless of whether artificial intelligence is used in the commission of those acts. (g) The right to be protected by law from criminal acts relating to the alteration of existing images to create sexual or lewd or lascivious images or child pornography, regardless of whether artificial intelligence is used in the commission of those acts. (h) The right to know whether political advertisements, electioneering communications, or similar advertisements were created in whole or in part with the use of artificial intelligence. (i) The right to pursue civil remedies authorized by law against others who use artificial intelligence to slander, libel, or defame them. (j) The right to prevent a companion chatbot from engaging with a user as a character that is protected by federal copyright law without the express written consent of the copyright owner. (k) The right to prevent a companion chatbot from engaging with a user as a character that is a living individual without the express written consent of that individual. (l) The right to prevent generative artificial intelligence from using a character that is protected by federal copyright law without the express written consent of the copyright owner.

(2) Residents may exercise the rights described in this section in accordance with existing law. This section may not be construed as creating new or independent rights or entitlements.

Section 501.9982 enumerates a set of rights Florida residents hold regarding AI, including the right to know when communicating with AI, the right to supervise minor children's AI use, and the right to pursue civil remedies for unauthorized commercial use of name or likeness via AI. However, subsection (2) expressly provides that these rights may only be exercised in accordance with existing law and that the section does not create new or independent rights or entitlements. This is a legislative statement of policy rather than an operative enforcement provision.

Fla. Stat. § 501.9983

Definitions

(1)–(16) As used in this part, the term: (1) "Account holder" means an individual who opens an account or creates a profile or is identified by the companion chatbot platform by a unique identifier while he or she is using or accessing the platform, if the platform knows or has reason to believe the individual is a resident of this state. (2) "Artificial intelligence" means a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments. (3) "Artificial intelligence technology company" means a business or organization that produces, develops, creates, designs, or manufactures artificial intelligence technology or products, collects data for use in artificial intelligence products, or implements artificial intelligence technology. (4) "Bot" means an automated online software application in which all or substantially all of the actions or posts of the account are not the result of a natural person. (5) "Companion chatbot" means an artificial intelligence system with a natural language interface that provides adaptive, human-like responses to user inputs and is capable of meeting a user's social needs by retaining information on prior interactions or user sessions and user preferences to personalize the interaction and facilitate ongoing engagement, asking unprompted or unsolicited emotion-based questions that go beyond a direct response to a user prompt, and sustaining an ongoing dialogue personalized to the user. The term does not include: (a) A chatbot used only for customer service; a business's internal operational purposes, productivity and analysis; or uses related to source information, internal research, or technical assistance; (b) A chatbot that is a feature of a video game or theme park and is limited to replies related to the video game or theme park experience and does not discuss topics related to mental health, self-harm, or material harmful to minors or maintain a dialogue on other topics unrelated to the video game or theme park; (c) A stand-alone consumer electronic device that functions as a speaker and voice command interface, acts as a voice activated virtual assistant, and does not sustain a relationship across multiple interactions or generate outputs likely to elicit emotional responses in the user; or (d) An artificial intelligence instructional tool, as defined in s. 1006.1495. (6) "Companion chatbot platform" means a platform that allows a user to engage with companion chatbots. (7) "Deidentified data" means data that cannot reasonably be linked to an identified or identifiable individual or a device linked to that individual. (8) "Department" means the Department of Legal Affairs. (9) "Material harmful to minors" has the same meaning as in s. 501.1737(1). (10) "Minor" means any person 17 years of age or younger. (11) "Operator" means a person who owns, operates, or otherwise makes available a bot to individuals in this state. (12) "Pop-up" means a visible notification on the computer, tablet, or smartphone screen of a user which may be resolved if the user interacts with or responds to the notification. (13) "Resident" means an individual who has resided in this state for more than 6 months during the preceding 12-month period. (14) "Theme park" has the same meaning as the term theme park or entertainment complex as defined in s. 509.013. (15) "User" means an individual who resides or is domiciled in this state and who accesses an Internet website, online or cloud-computing service, online application, or mobile application. (16) "Video game" means a game played on an electronic amusement device that uses a computer, microprocessor, or similar electronic circuitry and its own monitor, or is designed to be used with a television set or a computer monitor, to interact with the user of the device.

Section 501.9983 provides the defined terms used throughout Part IX of Chapter 501. Key definitions include companion chatbot (with express carve-outs for customer service bots, video game and theme park chatbots, stand-alone voice assistants, and AI instructional tools), companion chatbot platform, bot, operator, artificial intelligence technology company, and deidentified data. The minor threshold is set at 17 years of age or younger.

Fla. Stat. § 501.9984

Companion chatbot use for minors

Deployer

(1) 3 A companion chatbot platform shall prohibit a minor from becoming or being an account holder unless the minor's parent or guardian provides consent. If a companion chatbot platform allows a minor to become or be an account holder, the parties have entered into a contract.

(1)(a) 4 If the minor's parent or guardian provides consent for the minor to become an account holder or maintain an existing account, the companion chatbot platform must allow the consenting parent or guardian of the minor account holder to: 1. Receive copies of all past or present interactions between the account holder and the companion chatbot; 2. Limit the amount of time that the account holder may interact with the companion chatbot each day; 3. Limit the days of the week and the times during the day when the account holder may interact with the companion chatbot; 4. Disable any of the interactions between the account holder and third-party account holders on the companion chatbot platform; and 5. Receive timely notifications if the account holder expresses to the companion chatbot a desire or an intent to engage in harm to self or others.

(1)(b) 5 A companion chatbot platform shall do all of the following: 1. Terminate any account or identifier belonging to an account holder who is a minor if the companion chatbot platform treats or categorizes the account or identifier as belonging to a minor for purposes of targeting content or advertising and if the minor's parent or guardian has not provided consent for the minor pursuant to subsection (1). The companion chatbot platform shall provide 90 days for the account holder to dispute the termination. Termination must be effective upon the expiration of the 90 days if the account holder fails to effectively dispute the termination. 2. Allow an account holder who is a minor to request to terminate the account or identifier. Termination must be effective within 5 business days after the request. 3. Allow the consenting parent or guardian of an account holder who is a minor to request that the minor's account or identifier be terminated. Termination must be effective within 10 business days after the request. 4. Permanently delete all personal information held by the companion chatbot platform relating to the terminated minor account or identifier, unless state or federal law requires the platform to maintain the information.

(2)(a) 6 Disclose to the account holder that he or she is interacting with artificial intelligence.

(2)(b) 7 Provide by default a clear and conspicuous notification to the account holder, at the beginning of companion chatbot interactions and at least once every hour during continuing interactions, reminding the minor to take a break and that the companion chatbot is artificially generated and not human.

(2)(c) 8 Institute reasonable measures to prevent the companion chatbot from producing or sharing materials harmful to minors or encouraging the account holder to engage in any of the conduct described or depicted in materials harmful to minors.

(3) A knowing or reckless violation of this section is deemed a deceptive or unfair trade practice or act actionable under part II of this chapter solely by the department against a companion chatbot platform. If the department has reason to believe that a companion chatbot platform is in violation of this section, the department, as the enforcing authority, may bring an action against such platform for a deceptive or unfair trade practice or act. In addition to other remedies under part II of this chapter, the department may collect a civil penalty of up to $50,000 per violation and reasonable attorney fees and court costs. If the companion chatbot platform's failure to comply with this section is part of a consistent pattern of knowing or reckless conduct, punitive damages may be assessed against the companion chatbot platform.

(4)(a)–(c) After the department has notified a companion chatbot platform in writing of an alleged violation, the department may grant the companion chatbot platform 45 calendar days to cure the alleged violation and may issue a letter of guidance stating that the companion chatbot platform will not be offered another 45-calendar-day cure period for any future violations of this section. The department may consider the number and frequency of violations, the substantial likelihood of injury to the public, and the safety of persons or property in determining whether to grant the companion chatbot platform 45 calendar days to cure and issue the letter of guidance. 1. The 45-calendar-day cure period does not apply to an alleged violation where the companion chatbot platform willfully or knowingly disregarded the account holder's age. 2. For an alleged violation of paragraph (2)(c), the companion chatbot platform may provide for the department's consideration information that shows that the reasonable measures taken by the platform include controls aligned with the latest versions of the National Institute of Standards and Technology AI Risk Management Framework, ISO 42001. Such information may include structured interaction logs, status of parental access controls, harm-signal detection and response procedures enacted, and verified deletion events. (b) If the alleged violation is cured to the satisfaction of the department, and proof of such cure is provided to the department, the department may not bring an action for the alleged violation but may issue a letter of guidance stating that the companion chatbot platform will not be offered a 45-calendar-day cure period for any future violations of this section. (c) If the companion chatbot platform fails to cure the alleged violation within 45 calendar days, the department may bring an action against such companion chatbot platform for the alleged violation.

(5)(a)–(c) A companion chatbot platform that knowingly or recklessly violates this section is liable to a minor account holder for up to $10,000 in damages plus court costs and reasonable attorney fees as ordered by the court. (b) A civil action for a claim under this subsection must be brought within 1 year after the date the complainant knew, or reasonably should have known, of the alleged violation. (c) An action brought under this subsection may be brought only on behalf of a minor account holder.

(6)–(8) For purposes of bringing an action under this section, a companion chatbot platform that allows a minor to become or be an account holder on the platform is considered to be both engaged in substantial and not isolated activities within this state and operating, conducting, engaging in, or carrying on a business, and doing business in this state, and is therefore subject to the jurisdiction of the courts of this state. (7) This section does not preclude any other available remedy at law or equity. (8) The department may adopt rules to implement this section.

Section 501.9984 is the bill's core minor-protection provision for companion chatbot platforms. It imposes a parental consent gate for minor account holders, mandates robust parental control features (interaction transcripts, time limits, day-of-week restrictions, third-party interaction controls, and harm-to-self notifications), requires unconditional AI identity disclosure and hourly take-a-break reminders for minor users, and requires reasonable measures to prevent harmful content. Knowing or reckless violations are actionable as FDUTPA violations by the Department of Legal Affairs, with civil penalties up to $50,000 per violation and potential punitive damages for consistent patterns of knowing or reckless conduct. A separate private right of action permits claims on behalf of minor account holders for up to $10,000 in damages. A 45-day cure period is available at the department's discretion, with a NIST AI RMF / ISO 42001 safe harbor for the harmful-content prevention obligation.

Compliance actions 6 items

Companion chatbot platforms must prohibit a minor from becoming or being an account holder unless the minor's parent or guardian provides consent.

MN-01.2

Companion chatbot platforms must provide the consenting parent or guardian of a minor account holder with the following tools: (1) the ability to receive copies of all past or present interactions between the minor and the companion chatbot; (2) the ability to limit the amount of time the minor may interact with the chatbot each day; (3) the ability to limit the days of the week and times during the day when the minor may interact; (4) the ability to disable interactions between the minor and third-party account holders on the platform; and (5) timely notifications if the minor expresses a desire or intent to engage in harm to self or others.

MN-01.3

Companion chatbot platforms must: (1) terminate any minor account or identifier that the platform treats or categorizes as belonging to a minor for content-targeting or advertising purposes if the minor's parent or guardian has not consented, providing 90 days for the account holder to dispute termination; (2) allow a minor account holder to request termination of the account or identifier, effective within 5 business days; (3) allow the consenting parent or guardian to request termination of the minor's account or identifier, effective within 10 business days; and (4) permanently delete all personal information relating to a terminated minor account or identifier, unless retention is required by state or federal law.

MN-01.9

Companion chatbot platforms must disclose to every minor account holder that the account holder is interacting with artificial intelligence.

T-01.1

Companion chatbot platforms must provide by default a clear and conspicuous notification to the minor account holder at the beginning of each companion chatbot interaction and at least once every hour during continuing interactions, reminding the minor to take a break and that the companion chatbot is artificially generated and not human.

T-01.1

Companion chatbot platforms must institute reasonable measures to prevent the companion chatbot from producing or sharing materials harmful to minors or encouraging the minor account holder to engage in any of the conduct described or depicted in materials harmful to minors. The platform may demonstrate compliance by showing controls aligned with the latest versions of the NIST AI Risk Management Framework and ISO 42001, including structured interaction logs, parental access control status, harm-signal detection and response procedures, and verified deletion events.

MN-01.6

Fla. Stat. § 501.9985

Consumer protections regarding bots

Deployer

(1) 9 At the beginning of an interaction between a user and a bot, and at least once every hour during the interaction, an operator shall display a pop-up message or other prominent notification notifying the user or, if the interaction is not through a device with a screen, otherwise inform the user, that he or she is not engaging in dialogue with a human counterpart. This section does not apply to a bot that is used solely by employees within a business for its internal operational purposes.

(2) A violation of this section is deemed a deceptive or unfair trade practice or act actionable under part II of this chapter solely by the department on behalf of a user of a bot. If the department has reason to believe that an operator is in violation of this section, the department, as the enforcing authority, may bring an action against the operator for a deceptive or unfair trade practice or act. For the purpose of bringing an action pursuant to this section, ss. 501.211 and 501.212 do not apply. In addition to any other remedy under part II of this chapter, the department may collect a civil penalty of up to $50,000 per violation and reasonable attorney fees and court costs.

(3)(a)–(d) After the department has notified an operator in writing of an alleged violation, the department may grant the operator 45 calendar days to cure the alleged violation and may issue a letter of guidance stating that the companion chatbot platform will not be offered another 45-calendar-day cure period for any future violations. The department may consider the number and frequency of violations, the substantial likelihood of injury to the public, and the safety of persons or property in determining whether to grant an operator 45 calendar days to cure and issue the letter of guidance. (b) For an alleged violation of this section, the operator may provide for the department's consideration information that demonstrates that the operator provides persistent and conspicuous identity indicators and accessible disclosures which are in conformity with the latest versions of the National Institute of Standards and Technology AI Risk Management Framework, ISO 42001. (c) If the alleged violation is cured to the satisfaction of the department and proof of such cure is provided to the department, the department may not bring an action for the alleged violation but may issue a letter of guidance that indicates that the operator will not be offered a 45-calendar-day cure period for any future violations. (d) If the operator fails to cure the alleged violation within the 45-calendar-day cure period, the department may bring an action against such operator for the alleged violation.

(4)–(5) For purposes of bringing an action pursuant to this section, an operator that owns, operates, or otherwise makes available a bot to individuals in this state is considered to be both engaged in substantial and not isolated activities within this state and operating, conducting, engaging in, or carrying on a business, and doing business in this state, and is therefore subject to the jurisdiction of the courts of this state. (5) The department may adopt rules to implement this section.

Section 501.9985 imposes a general AI identity disclosure obligation on bot operators — broader than the companion chatbot provisions in § 501.9984. At the beginning of any user interaction and at least once every hour during the interaction, operators must display a pop-up message, prominent notification, or otherwise inform the user that they are not engaging with a human. The provision carves out bots used solely by employees for internal business operations. Violations are enforceable exclusively by the Department of Legal Affairs under FDUTPA, with a $50,000 civil penalty per violation and a 45-day cure period. The private FDUTPA action provisions (§§ 501.211, 501.212) are expressly excluded. A NIST AI RMF / ISO 42001 conformity showing is available as an evidentiary safe harbor.

Compliance actions 1 item

Bot operators must display a pop-up message or other prominent notification at the beginning of every user interaction, and at least once every hour during the interaction, informing the user that they are not engaging in dialogue with a human counterpart. For interactions not conducted through a device with a screen, the operator must otherwise inform the user. This obligation does not apply to bots used solely by employees within a business for internal operational purposes. The operator may demonstrate compliance by showing that it provides persistent and conspicuous identity indicators and accessible disclosures conforming to the NIST AI RMF and ISO 42001.

T-01.1

Fla. Stat. § 501.9986

Consumer protections regarding deidentified data

Developer

(1) 10 An artificial intelligence technology company may not sell or disclose personal information of users unless the information is deidentified data. This subsection does not prohibit the sale or disclosure of information specifically authorized by federal law.

(2)(a)–(d) 11 An artificial intelligence technology company in possession of deidentified data shall do all of the following: (a) Take reasonable measures to ensure that the data cannot be associated with a user. (b) Maintain and use the data in deidentified form. An artificial intelligence technology company may not attempt to reidentify the data, except that the artificial intelligence technology company may attempt to reidentify the data solely for the purpose of determining whether its deidentification processes satisfy the requirements of this section. (c) Contractually obligate a recipient of the deidentified data to comply with this section. (d) Implement business processes to prevent the inadvertent release of deidentified data.

(3) A violation of this section is deemed a deceptive or unfair trade practice or act actionable under part II of this chapter solely by the department. If the department has reason to believe that an artificial intelligence technology company is in violation of this section, the department, as the enforcing authority, may bring an action against the artificial intelligence technology company for a deceptive or unfair trade practice or act. For the purpose of bringing an action pursuant to this section, ss. 501.211 and 501.212 do not apply. In addition to any other remedy under part II of this chapter, the department may collect a civil penalty of up to $50,000 per violation and reasonable attorney fees and court costs.

(4)(a)–(d) After the department has notified an artificial intelligence technology company in writing of an alleged violation, the department may grant the artificial intelligence technology company 45 calendar days to cure the alleged violation and may issue a letter of guidance stating that the artificial intelligence technology company will not be offered another 45-calendar-day cure period for any future violations. The department may consider the number and frequency of violations, the substantial likelihood of injury to the public, and the safety of persons or property in determining whether to grant the artificial intelligence technology company 45 calendar days to cure and issue the letter of guidance. (b) For an alleged violation of this section, the artificial intelligence technology company may provide for the department's consideration information that shows that the artificial intelligence technology company maintains a risk management program that: 1. Validates the company's information security and privacy controls against a recognized framework aligned with the latest versions of the National Institute of Standards and Technology AI Risk Management Framework, ISO 42001; and 2. Includes assessed controls for deidentification, contractual flow-down, non-reidentification, inadvertent release prevention, monitoring, and auditing sufficient to demonstrate that the company is taking reasonable measures to meet the requirements of this section. (c) If the alleged violation is cured to the satisfaction of the department and proof of such cure is provided to the department, the department may not bring an action for the alleged violation but may issue a letter of guidance that indicates that the artificial intelligence technology company will not be offered another 45-calendar-day cure period for any future violations. (d) If the artificial intelligence technology company fails to cure the alleged violation within the 45-calendar-day cure period, the department may bring an action against such artificial intelligence technology company for the alleged violation.

(5)–(6) For purposes of bringing an action pursuant to this section, an artificial intelligence technology company that produces, develops, creates, designs, or manufactures artificial intelligence technology or products, collects data for use in artificial intelligence products, or implements artificial intelligence technology in this state is considered to be both engaged in substantial and not isolated activities within this state and operating, conducting, engaging in, or carrying on a business, and doing business in this state, and is therefore subject to the jurisdiction of the courts of this state. (6) The department may adopt rules to implement this section.

Section 501.9986 prohibits AI technology companies from selling or disclosing user personal information unless the information is deidentified data, with a carve-out for disclosures specifically authorized by federal law. Companies in possession of deidentified data must take reasonable measures to prevent re-association with users, maintain data in deidentified form, contractually require recipients to comply with the same requirements, and implement business processes to prevent inadvertent release. A NIST AI RMF / ISO 42001 aligned risk management program serves as an evidentiary safe harbor. Enforcement is exclusively by the Department of Legal Affairs under FDUTPA, with the private action provisions expressly excluded.

Compliance actions 2 items

AI technology companies must not sell or disclose personal information of users unless the information is deidentified data. Disclosures specifically authorized by federal law are not prohibited.

D-01.4

AI technology companies in possession of deidentified data must: (1) take reasonable measures to ensure the data cannot be associated with a user; (2) maintain and use the data in deidentified form and not attempt to reidentify it, except solely to test the adequacy of their deidentification processes; (3) contractually obligate any recipient of deidentified data to comply with these same requirements; and (4) implement business processes to prevent inadvertent release of deidentified data. Companies may demonstrate compliance by maintaining a risk management program validated against a recognized framework aligned with the NIST AI RMF and ISO 42001, including controls for deidentification, contractual flow-down, non-reidentification, inadvertent release prevention, monitoring, and auditing.

D-01.4

Fla. Stat. § 501.9987

Investigations

(1)–(6) If, by its own inquiry or as a result of complaints, the department has reason to believe that a person has engaged in, or is engaging in, a practice or an act that violates this part, the department may administer oaths and affirmations, subpoena witnesses or matter, and collect evidence. Within 5 days, excluding weekends and legal holidays, after service of a subpoena, or at any time before the return date specified in the subpoena, whichever time period is longer, the party served may file in the circuit court in the county in which it resides or in which it transacts business and serve upon the enforcing authority a petition for an order modifying or setting aside the subpoena. The petitioner may raise any objection or privilege that would be available upon service of a subpoena in a civil action. The subpoena must inform the party served of the party's rights under this subsection. (2) If the matter that the department seeks to obtain by subpoena is located outside this state, the person subpoenaed may make the matter available to the department or its representative at the place where it is located. The department may designate representatives, including officials of the state in which the matter is located, to inspect the matter on its behalf and may respond to similar requests from officials of other states. (3) Upon the failure of a person, without lawful excuse, to obey a subpoena and upon reasonable notice to all persons affected, the department may apply to the circuit court for an order compelling compliance. (4) The department may request that a person who refuses to comply with a subpoena on the grounds that the testimony or matter may be self-incriminating be ordered by the court to provide the testimony or matter. Except in a prosecution for perjury, a person who complies with a court order to provide testimony or matter after asserting a valid privilege against self-incrimination may not have the testimony or matter so provided, or evidence derived from the testimony or matter, received against the person in any criminal investigation or proceeding. (5) A person upon whom a subpoena is served pursuant to this part must comply with its terms unless otherwise provided by order of the court. A person who fails to appear, with the intent to avoid, evade, or prevent compliance in whole or in part with an investigation under this part, or who removes from any place, conceals, withholds, mutilates, alters, or destroys, or by any other means falsifies any documentary material in the possession, custody, or control of a person subject to a subpoena, or who knowingly conceals relevant information with the intent to avoid, evade, or prevent compliance, is liable for a civil penalty of not more than $5,000 per week in violation, reasonable attorney fees, and costs. (6) The department may adopt rules to implement this section.

Section 501.9987 grants the Department of Legal Affairs investigatory authority for the entire Artificial Intelligence Bill of Rights (Part IX). The department may administer oaths, subpoena witnesses and materials, and collect evidence. Subpoena recipients may petition a circuit court to modify or set aside the subpoena within 5 days. Out-of-state subpoena procedures and self-incrimination protections are provided. Non-compliance with a subpoena carries a civil penalty of up to $5,000 per week plus attorney fees and costs.

Fla. Stat. § 540.08

Unauthorized publication of name, image, or likeness (AI extension)

DeployerDeveloperPublisher

(2) 12 A person may not publish, print, display, or otherwise publicly use for trade or for any commercial or advertising purpose the name, portrait, photograph, image, or other likeness of an individual created through generative artificial intelligence without the express written or oral consent to such use given by any of the following: (a) The individual. (b) Any other person authorized in writing by the individual to license the commercial use of the individual's name, image, or likeness. (c) If the individual is deceased: 1. A person authorized in writing to license the commercial use of the individual's name, image, or likeness; or 2. If a person is not authorized, any one individual from a class composed of the deceased individual's surviving spouse and surviving children. A legal parent or guardian may give consent on behalf of a minor surviving child.

(4) If the consent required in subsection (2) or subsection (3) is not obtained, the individual whose name, portrait, photograph, image, or other likeness is used, or a person authorized by the individual in writing to license the commercial use of the individual's name, image, or likeness, or, if the individual whose likeness is used is deceased, a person having the right to give consent, as provided in subsection (2) or subsection (3), may bring an action to enjoin the unauthorized publication, printing, display, or other public use, and recover damages for any loss or injury resulting from the unauthorized publication, including an amount that would have been a reasonable royalty, and punitive or exemplary damages.

(5) If a person uses the name, portrait, photograph, image, or other likeness of a servicemember without obtaining the consent required in subsection (2) or subsection (3) and the use is not subject to an exception listed in this section, a court may impose a civil penalty of up to $1,000 per violation in addition to the civil remedies contained in subsection (4). Each commercial transaction constitutes a violation under this section.

(6)(a)–(d) This section does not apply to any of the following: (a) The publication, printing, display, or use of the name, portrait, photograph, image, or other likeness of an individual in a newspaper, magazine, book, news broadcast or telecast, radio broadcast, or other news medium or publication if used as part of a bona fide news report or presentation having a current and legitimate public interest and if the name, image, or likeness is not used for advertising purposes. (b) The publication, printing, display, or use of the name, portrait, photograph, image, or other likeness of an individual created through generative artificial intelligence in a newspaper, magazine, book, news broadcast or telecast, radio broadcast, or other news medium or publication if the generative artificial intelligence is used as part of a bona fide news report or presentation and that report or presentation contains a clear acknowledgement of speculation regarding the authenticity of the materials which are the subject of the report or presentation. (c) The use of an individual's name, portrait, photograph, image, or other likeness in connection with the resale or other distribution of literary, musical, or artistic productions or other articles of merchandise or property with the individual's consent on or in connection with the initial sale or distribution of the productions, articles, or merchandise. (d) A photograph of an individual solely as a member of the public if the individual is not named or otherwise identified in or in connection with the use of the photograph.

(7) An action may not be brought under this section by reason of a publication, printing, display, or other public use of the name, portrait, photograph, image, or other likeness of an individual occurring more than 40 years after the death of the individual.

Section 540.08 is amended to extend Florida's existing right of publicity to cover AI-generated likenesses. A new subsection (2) prohibits the commercial use of an individual's name, portrait, photograph, image, or other likeness created through generative artificial intelligence without express consent from the individual, an authorized person, or — if the individual is deceased — an authorized person or a surviving spouse or surviving child. The existing general prohibition is re-numbered as subsection (3) and updated to include 'image.' A new news-media exception for AI-generated content requires a clear acknowledgement of speculation regarding the authenticity of the materials. Servicemember protections carry a $1,000 per-violation penalty. The 40-year post-mortem limitation period is retained.

Compliance actions 1 item

No person may publish, print, display, or otherwise publicly use for trade or for any commercial or advertising purpose the name, portrait, photograph, image, or other likeness of an individual created through generative artificial intelligence without the express written or oral consent of the individual, an authorized representative, or — if the individual is deceased — an authorized person or any one of the deceased individual's surviving spouse or surviving children. A legal parent or guardian may give consent on behalf of a minor surviving child. Post-mortem rights expire 40 years after the individual's death.

CP-02.4

Fla. Stat. § 1006.1495

AI instructional tools: parental notice, opt-out, and account access

DeployerGovernment

(1)(a)–(f) DEFINITIONS.—As used in this section, the term: (a) "Artificial intelligence instructional tool" means a software application or service that uses artificial intelligence, including machine learning, which is made available to a student by an educational entity for educational purposes, including instruction, tutoring, practice, feedback, or completing educator-directed assignments, and that is not designed, marketed, or configured to: 1. Meet a student's social needs; 2. Simulate friendship, companionship, or an emotional relationship with a student; or 3. Employ relationship-building or anthropomorphic design features for the purpose of encouraging a student to continue interacting with the system. (b) "Educational entity" means a school district, a public school, or a private school. The term includes a VPK provider meaning a private prekindergarten provider or a public school prekindergarten provider, as those terms are defined in s. 1002.51, which delivers the Voluntary Prekindergarten Education Program under part V of chapter 1002. (c) "Operator" means a person who operates an artificial intelligence instructional tool and collects, receives, maintains, or uses student information or student-generated content through the tool. (d) "Parent" includes a parent, guardian, or other person with legal authority to make educational decisions for a student. (e) "Private school" has the same meaning as in s. 1002.01(3). (f) "Public school" means a component described in s. 1000.04(2), (4), (5), or (6).

(2) 13 RESTRICTION.—An educational entity may not provide students with access to an artificial intelligence instructional tool before grade 6 unless such use is: (a) Directed and supervised by school personnel; (b) For translation or similar support necessary for a student identified as an English language learner; or (c) For accommodations, assistive technology, or similar support necessary for a student with a documented disability.

(3)(a)–(d) 14 EDUCATIONAL USE; PARENTAL NOTICE.—Before a student is provided access credentials for an artificial intelligence instructional tool, the educational entity must provide the parent of a minor student with notice that: (a) Identifies the tool and its educational purpose; (b) Describes, in general terms, the manner in which the tool will be used by students; (c) Explains how the parent may exercise the opt-out process under subsection (4); and (d) Explains how the parent may access the student's account or request access to information and account activity under subsection (5), including the method for submitting a written request.

(4)(a)–(c) 15 PARENTAL OPT-OUT.— (a) A parent of a minor student must be provided the opportunity to opt out of the student's use of an artificial intelligence instructional tool. (b) The opt-out process must align with the educational entity's existing policies for parental notice, consent, objection, or opt out for instructional materials, digital tools, or online accounts, as applicable. (c) If a parent opts out of a student's use of an artificial intelligence instructional tool and the student is enrolled in a public school, the school district or public school must provide an alternative instructional activity that allows the student to meet a comparative educational requirement without penalty.

(5)(a)–(d) 16 PARENT ACCOUNT ACCESS; COMPLIANCE OPTIONS.— (a) At the time an operator provides a student's access credentials or otherwise provides or enables student access to an educational entity for an artificial intelligence instructional tool, the operator shall simultaneously provide to the educational entity a means to authorize the parent of a minor student to access information and account activity maintained within the artificial intelligence instructional tool. (b) The operator may satisfy paragraph (a) by: 1. Providing the parent of a minor student credentials or another method for read-only access to the student's account; or 2. Upon written request from the parent of a minor student, providing access to the information and account activity maintained within the tool, in accordance with applicable state and federal law, within 30 days after receipt of the request. The educational entity shall inform the parent of the right to make such a request and the method for submitting the request. (c) If an educational entity satisfies subparagraph (b)1., the educational entity must provide the credentials or other access method at the time the educational entity provides the student with access credentials or otherwise enables student access. (d) This subsection does not require an operator or educational entity to create or retain a transcript or record of student interactions beyond information otherwise maintained in the ordinary course of providing access to the tool.

(6) CONSTRUCTION.—This section does not alter: (a) A parent's rights under state or federal law to access student education records; or (b) An educational entity's obligations under applicable state and federal student privacy laws.

Section 1006.1495 creates a new framework governing AI instructional tools in Florida schools. It restricts student access before grade 6 (with exceptions for supervised use, ELL translation, and disability accommodations), requires parental notice before a student receives access credentials, grants parents opt-out rights with a required alternative activity for public school students, and mandates that operators provide educational entities with a means for parental account access. The section is expressly limited to educational-purpose AI tools that are not designed to simulate friendship, companionship, or emotional relationships — a carve-out that excludes companion chatbots. Private schools must also comply per § 1002.42(21).

Compliance actions 4 items

Educational entities must not provide students with access to AI instructional tools before grade 6 unless the use is (1) directed and supervised by school personnel, (2) for translation or similar support necessary for a student identified as an English language learner, or (3) for accommodations, assistive technology, or similar support necessary for a student with a documented disability.

MN-01.11

Educational entities must provide the parent of a minor student with notice before the student receives access credentials for an AI instructional tool. The notice must: (1) identify the tool and its educational purpose; (2) describe in general terms how the tool will be used by students; (3) explain how the parent may exercise the opt-out process; and (4) explain how the parent may access the student's account or request access to information and account activity, including the method for submitting a written request.

T-01.1

Educational entities must provide the parent of a minor student with the opportunity to opt out of the student's use of an AI instructional tool. The opt-out process must align with the educational entity's existing policies for parental notice, consent, objection, or opt-out for instructional materials, digital tools, or online accounts. If a parent of a public school student opts out, the school district or public school must provide an alternative instructional activity that allows the student to meet a comparative educational requirement without penalty.

D-01.3

Operators of AI instructional tools must, at the time they provide student access credentials or enable student access, simultaneously provide the educational entity with a means to authorize the parent of a minor student to access information and account activity maintained within the tool. The operator may satisfy this requirement by either: (1) providing the parent with credentials or another method for read-only access to the student's account, or (2) upon written request from the parent, providing access to the information and account activity within 30 days after receipt of the request. If the educational entity satisfies the read-only credential option, it must provide the credentials at the time the student receives access. The operator is not required to create or retain a transcript or record of student interactions beyond information otherwise maintained in the ordinary course of providing the tool.

MN-01.3

Public Sector Procurement restrictions · government use

2 items

PS-01.4

Beginning Jul 1, 2026 Government entities must not enter into, extend, or renew contracts for AI technology, software, or products with entities that are owned by, have a controlling interest held by, or are organized under the laws of or have their principal place of business in a foreign country of concern.

PS-01.4

Beginning Jul 1, 2026 Government entities must require AI technology vendors to provide a sworn affidavit, signed under penalty of perjury, attesting that the vendor is not owned by, controlled by, or organized under the laws of a foreign country of concern before accepting bids, proposals, or entering contracts for AI technology, software, or products.

Minor Safety Parental consent · controls · termination workflows

6 items

MN-01.2

Companion chatbot platforms must prohibit a minor from becoming or being an account holder unless the minor's parent or guardian provides consent.

MN-01.3

MN-01.9

MN-01.6

MN-01.11

MN-01.3

Transparency AI identity disclosure · periodic reminders

4 items

T-01.1

Companion chatbot platforms must disclose to every minor account holder that the account holder is interacting with artificial intelligence.

T-01.1

Data Controls Data sale restrictions · deidentification

3 items

D-01.4

AI technology companies must not sell or disclose personal information of users unless the information is deidentified data. Disclosures specifically authorized by federal law are not prohibited.

D-01.4

D-01.3

Deceptive Conduct AI-generated likeness · consent requirements

1 item

CP-02.4

Passage Likelihood

Failed

Status Failed

Final action Died in Messages

Legislative History

2025-12-22 Filed

2026-01-07 Referred to Commerce and Tourism; Appropriations

2026-01-13 Introduced

2026-01-16 On Committee agenda-- Commerce and Tourism, 01/21/26, 8:30 am, 110 Senate Building

2026-01-21 Favorable by Commerce and Tourism; YEAS 10 NAYS 0

2026-01-21 Now in Appropriations

2026-02-13 On Committee agenda-- Appropriations, 02/18/26, 1:30 pm, 412 Knott Building

2026-02-18 CS by- Appropriations; YEAS 18 NAYS 0

2026-02-20 Pending reference review -under Rule 4.7(2) - (Committee Substitute)

2026-02-20 Placed on Calendar, on 2nd reading

2026-02-23 Placed on Special Order Calendar, 02/25/26

2026-02-24 CS by Appropriations read 1st time

2026-02-25 Retained on Special Order Calendar

2026-02-26 Retained on Special Order Calendar

2026-03-04 Read 2nd time

2026-03-04 Amendment(s) adopted (274134, 623028)

2026-03-04 Read 3rd time

2026-03-04 CS passed as amended; YEAS 35 NAYS 2

2026-03-05 In Messages

2026-03-13 Died in Messages

Sources

Full Text ↗

Entry Last Reviewed

2026-05-04

AI generated