Privacy notices.

(1) A controller shall provide consumers with a reasonably accessible and clear privacy notice, updated at least annually, that includes all of the following information:

(a) The categories of personal data processed by the controller, including, if applicable, any sensitive data processed by the controller.

(b) The purpose of processing personal data.

(c) How consumers may exercise their rights under s. 501.705(2), including the process by which a consumer may appeal a controller’s decision with regard to the consumer’s request.

(d) If applicable, the categories of personal data that the controller shares with third parties.

(e) If applicable, the categories of third parties with whom the controller shares personal data.

(f) A description of the methods specified in s. 501.709 by which consumers can submit requests to exercise their consumer rights under this part.

(2) If a controller engages in the sale of personal data that is sensitive data, the controller must provide the following notice: “NOTICE: This website may sell your sensitive personal data.” The notice must be posted in accordance with subsection (1).

(3) If a controller engages in the sale of personal data that is biometric data, the controller must provide the following notice: “NOTICE: This website may sell your biometric personal data.” The notice must be posted in accordance with subsection (1).

(4) If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller must clearly and conspicuously disclose that process and the manner in which a consumer may exercise the right to opt out of that process.

(5) A controller may not collect additional categories of personal information or use personal information collected for additional purposes without providing the consumer with notice consistent with this section.