Florida Digital Bill of Rights (FDBR)
Florida FDBR: Sensitive Data, Children, Voice/Facial Recognition Opt-Out

Florida Digital Bill of Rights (FDBR) FDBR-SensitiveData-Children-VoiceFacial: Sensitive Data, Children's Privacy and Voice/Facial Recognition (Fla. Stat. 501.711, 501.1735)

Florida Statutes 501.711 sensitive data + 501.1735 Protection of Children Online. SENSITIVE DATA: includes race + ethnicity + religion + mental/physical health diagnosis + sex life + sexual orientation + citizenship status + genetic data + biometric data used for unique identification + precise geolocation + children data (under 18). PROCESSING REQUIRES (a) AFFIRMATIVE OPT-IN CONSENT from the consumer + clear notice + ability to withdraw; OR (b) for children under 18 + parental consent per the federal COPPA 16 CFR Part 312 + the more-protective Florida age threshold; OR (c) the controller is allowed to process under another statutory exception (e.g. HIPAA + healthcare delivery + court order). VOICE + FACIAL RECOGNITION DATA: an OPT-OUT right separate from sensitive-data opt-in - the consumer may opt out of collection of voice or facial recognition data (501.705(1)(e)); applies to smart speakers + voice assistants + facial-recognition-capable cameras + AI systems. PROTECTION OF CHILDREN ONLINE (501.1735): (a) AGE VERIFICATION for content harmful to minors + adult content; (b) PARENTAL CONTROL TOOLS provided by online platforms; (c) PROHIBITION ON TARGETED ADVERTISING to known minors; (d) PROCESSING-LIMITATION for personal data of minors; coordinated with COPPA + the federal Kids Online Safety Act (KOSA, pending) + the Florida House Bill 3 (2024) social-media minor restriction (parts struck down by federal court 2024-2025). FLORIDA HOUSE BILL 3 (2024 social-media-minor restriction): teens 14-15 require parental consent for social-media accounts + under 14 prohibited + struck down in part by federal court on First Amendment grounds (Florida appealing; status uncertain as of early 2026).

What else in your programme already covers this

This control maps to 225 controls across 119 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 6 controls

Armenia Law on Protection of Personal Data (2015) · 4 controls

APPI · 3 controls

  • APPI-A23 Security Control Measures
  • APPI-A24 Supervision of Employees
  • APPI-A33 Request for Disclosure of Retained Personal Data

Australian Privacy Principles (APPs) · 3 controls

  • APP-1 APP 1 - Open and transparent management of personal information
  • APP-3 APP 3 - Collection of solicited personal information
  • APP-5 APP 5 - Notification of the collection of personal information

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 3 controls

  • AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement)
  • AT-DSG-13 Section 36 - Scope of law enforcement processing
  • AT-DSG-14 Section 38 - Lawfulness of law enforcement processing

Azerbaijan Law on Personal Data (2010) · 3 controls

Bahrain PDPL · 3 controls

Barbados Data Protection Act 2019 · 3 controls

  • BB-DPA-14 Section 15 - Right to Data Portability
  • BB-DPA-16 Section 22 - General Principle for Transfers
  • BB-DPA-21 Sections 61-69 - Data Privacy Officer

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 3 controls

Family Educational Rights and Privacy Act (FERPA) · 3 controls

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 3 controls

ISO/IEC 27400:2022 · 3 controls

ISO/IEC 29100:2024 · 3 controls

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework · 3 controls

ISO/IEC 29134:2023 · 3 controls

Illinois Biometric Information Privacy Act (BIPA) · 3 controls

NIST SP 800-53 Rev 5 · 3 controls

Russia Federal Law on Personal Data (152-FZ) · 3 controls

  • RUSPD-1 Scope, Definitions, Principles under 152-FZ
  • RUSPD-2 Lawful Basis, Consent, Notice
  • RUSPD-4 Special Categories, Biometric Data

UK Open Banking Standard · 3 controls

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-20 Multi-factor authentication (Essential)
  • ASD37-23 Protect authentication credentials (Excellent)

ISO 13485 · 2 controls

  • 6.4 Logging and Monitoring
  • ISO13485-12 Unique user identification and authentication

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 2 controls

  • 6.4 Logging and Monitoring
  • 6.5 Preparing and Distributing Audit Report

ISO 19011 · 2 controls

  • 6.4 Logging and Monitoring
  • 6.5 Preparing and Distributing Audit Report

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 2 controls

ISO/IEC 27014:2020 · 2 controls

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 2 controls

Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018) · 2 controls

MARS-E · 2 controls

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
  • NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 2 controls

  • 3.7 Establish and Maintain a Data Classification Scheme
  • 3.7.1 Key-management policies and procedures are implemented to include generation of strong cryptographic keys used to protect stored account data

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 2 controls

  • NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification
  • NISTSP82-4 OT Access Control, Identity, Authentication, and Remote Access

OWASP Top 10 for LLM Applications 2025 · 2 controls

  • OWASPLLM-1 Prompt Injection and System Prompt Leakage (LLM01 + LLM07)
  • OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02)

OWASP Top 10:2025 · 2 controls

  • OWASPTOP10-2 A02:2025 Cryptographic Failures and Secret Management
  • OWASPTOP10-7 A07:2025 Identification and Authentication Failures

Privacy Act 1988 (Australia) · 2 controls

  • AUPRV-4 APP 10-11 Quality, Security of Personal Information
  • AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response

US Children's Online Privacy Protection Act (COPPA) and COPPA 2.0 Proposed Updates · 2 controls

  • USCOPPA-3 Data Minimisation, Retention, Erasure (Eraser Button)
  • USCOPPA-6 FTC Enforcement and State Cooperation

USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement) · 2 controls

Vietnam Law on Cybersecurity (No. 24/2018/QH14) · 2 controls

AML/CTF Act 2006 (Australia) · 1 control

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014) · 1 control

Azure Security Benchmark · 1 control

  • DS-2 Ensure software supply chain security

BSI IT-Grundschutz · 1 control

  • BSI-03 Multi-factor authentication requirements

Bank Secrecy Act / Anti-Money Laundering (BSA/AML) · 1 control

COSO Internal Control - Integrated Framework (2013) · 1 control

  • CA-10 Selects and Develops Control Activities

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 1 control

  • DSO-3 Data Access Management

Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) · 1 control

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

FedRAMP High · 1 control

  • AC-3 Access Enforcement

FedRAMP Moderate · 1 control

  • AC-3 Access Enforcement

FedRAMP Rev 5 · 1 control

  • FedRAMP-PII-Privacy FedRAMP PII processing + privacy controls (NIST 800-53 Rev 5 PT family + Privacy Act)

GLI-33 - Gaming Laboratories International Event Wagering Systems · 1 control

Ghana Cybersecurity Act · 1 control

Global Cross-Border Privacy Rules (Global CBPR) Forum · 1 control

  • CBPR-9-APEC-Privacy-Principles Global CBPR Forum: 9 APEC Privacy Principles (Notice + Collection + Uses + Choice + Integrity + Security + Access + Accountability + Preventing Harm)

HL7 FHIR Security Framework · 1 control

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems · 1 control

ISMAP (Japan) · 1 control

ISO 27017 · 1 control

ISO 27018 · 1 control

ISO 27043 · 1 control

ISO 27799 · 1 control

  • ISO27799-12 Unique user identification and authentication

ISO/IEC 38500:2024 - Governance of IT · 1 control

ISO/SAE 21434 · 1 control

India Account Aggregator Framework (RBI) · 1 control

India DPDP Act · 1 control

Law No. 172-13 on the Protection of Personal Data · 1 control

Ley Orgánica de Protección de Datos Personales (LOPDP) · 1 control

MARS-E - Minimum Acceptable Risk Standards for Exchanges · 1 control

MDS2 (Medical Device) · 1 control

MITRE ATT&CK · 1 control

MITRE D3FEND · 1 control

MTCS (Singapore) · 1 control

NAIC Insurance Data Security Model Law (MDL-668) · 1 control

  • NAIC-1 NAIC Model Law Adoption, Scope, and Licensee Definitions

NIS2 Directive Implementing Acts · 1 control

  • NIS2I-6 Access Control, Asset Management, and Physical Security

NIST Privacy Framework · 1 control

  • NISTPF-5 Protect-P Access Control (PR.AC-P)

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) · 1 control

  • NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material

NIST SP 800-123 · 1 control

  • NISTSP123-3 Authentication, Access Control, and Account Management

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

NIST SP 800-137 · 1 control

  • NISTSP137-6 Malware, Identity Access, and Network Boundary Monitoring

NIST SP 800-144 · 1 control

  • NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation

NIST SP 800-145 · 1 control

  • NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition

NIST SP 800-146 · 1 control

NIST SP 800-190 · 1 control

NIST SP 800-53 Rev 5 LOW · 1 control

  • AC-3 Access Enforcement

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • AC-3 Access Enforcement

NIST SP 800-53 Revision 5.1 HIGH · 1 control

  • AC-3 Access Enforcement

NIST SP 800-61 · 1 control

NIST SP 800-63-4 · 1 control

  • NISTSP63R4-3 Authentication: Authenticator Types, MFA, Phishing-Resistance, and Syncable Authenticators

NIST SP 800-66 · 1 control

  • NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication

NIST SP 800-88 · 1 control

  • NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework

NIST SP 800-92 · 1 control

  • NISTSP92-4 Log Management: Time Synchronisation, Parsing, Storage, Integrity, Access Control

O-RAN WG11 Security Specification · 1 control

  • ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul

OWASP API Security Top 10 - 2023 · 1 control

  • OWASPAPI-2 Broken Authentication and Token Management

OWASP ASVS · 1 control

  • OWASPASVS-2 Authentication and Credential Storage (V2 + V2.4)

OWASP DevSecOps Maturity Model (DSOMM) · 1 control

  • DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing

OWASP MASVS · 1 control

OWASP SAMM · 1 control

  • OWASPSAMM-2 Design: Threat Assessment, Security Requirements, Security Architecture

Oman National Cybersecurity Framework · 1 control

  • OMANCS-3 Identity and Access Management, Authentication, Privileged Access

OpenSSF Scorecard · 1 control

  • OSSFSC-3 Build, CI/CD Security, Workflow Permissions, Dangerous Patterns

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments · 1 control

  • PASONE-4 Technical Security: CDE Configuration, BIM Tools, Encryption, Aggregation, Mobile Working

PTES · 1 control

Pakistan Personal Data Protection Bill 2023 · 1 control

  • PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training

Regional Comprehensive Economic Partnership (RCEP) - E-Commerce Chapter · 1 control

  • RCEPEC-1 Online Personal Information Protection (12.13)

Regulation on the European Health Data Space (EHDS) · 1 control

SIG (Shared Assessments) · 1 control

SLSA · 1 control

  • SUPCHAIN-1 Build Integrity - Source, Build, Provenance

SSAE 18 - Attestation Standards (SOC Reporting) · 1 control

  • SSAE18-CC6.2 CC6.2 - New User Registration and Authorization

SWIFT CSCF · 1 control

Secure by Design: A Guide for Manufacturers (CISA) · 1 control

  • CISABD-1 Take Ownership of Customer Security Outcomes

Sigstore - Software Artifact Signing and Verification · 1 control

  • SIGSTORE-2 Transparency Log (Rekor) and Verification

South Korea ISMS-P · 1 control

South Korea PIPA · 1 control

TEFCA - Trusted Exchange Framework and Common Agreement · 1 control

  • TEFCAREC-1 Common Agreement Conformance and Onboarding

TSA Pipeline Cybersecurity Directives · 1 control

  • TSAPIPE-2 OT/IT Network Segmentation and Access Control

UNICEF Policy Guidance on AI for Children (2021) · 1 control

  • UNICEFAI-4 Transparency, Explanation, Adult Capacity

US Consumer Product Safety Commission (CPSC) - Connected Product Safety · 1 control

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements · 1 control

  • USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR)

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 1 control

  • CYB-2 Account Security Measures

Vermont Artificial Intelligence and Consumer Data Act (AICDA) · 1 control

W3C Verifiable Credentials (VC) Data Model 2.0 · 1 control

  • W3CVCDM-4 Accessibility, Internationalization, Security

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 225 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Florida Digital Bill of Rights (FDBR) controls