Right of Privacy Matters

Florida recognized the “right to be let alone” as an independent cause of action in 1944 — before most states, and decades before the technologies that now test it existed. Today the right of privacy is asserted against hidden cameras and GPS trackers, hacked email and cloud accounts, session-replay scripts and tracking pixels, biometric time clocks, and AI systems that collect, infer, and redistribute personal information at scale. For most Florida businesses and employers, the exposure is not regulatory: the state’s data-privacy statutes are deliberately narrow and enforced by the Attorney General. The exposure is common-law tort liability, with emotional-distress and punitive damages available and no physical injury required, layered with a handful of statutes — the Security of Communications Act, FDUTPA, the Telephone Solicitation Act — that carry statutory damages and fee-shifting.

Our Miami intellectual property attorneys litigate privacy and publicity claims in Florida’s state and federal courts and counsel businesses, employers, marketers, and platforms on monitoring, data, and content practices that keep them on the right side of those claims. This summary sets out the structure of Florida’s right of privacy, the two common-law torts that do the work, the remedies and limitations periods that shape every case, a side-by-side comparison with the right of publicity and Florida’s consumer-protection statutes, and the practical controls that reduce exposure.

Origins and Structure of Florida’s Right of Privacy

Cason v. Baskin, the Prosser taxonomy, and the three features that define the cause of action

Florida was an early adopter. In Cason v. Baskin, 20 So. 2d 243 (Fla. 1944) — the celebrated suit by Zelma Cason against Marjorie Kinnan Rawlings over Cason’s portrayal in Cross Creek — the Florida Supreme Court adopted Warren and Brandeis’s conception of “the right to be let alone” as an independent common-law right, describing the interest as the right of a private person to be free from public gaze. Cason remains the doctrinal foundation. On remand the plaintiff recovered only nominal damages, an early signal of the practical difficulty of proving privacy harm that persists today.

Florida then adopted William Prosser’s four-branch framework, first articulated in Loft v. Fuller, 408 So. 2d 619 (Fla. 4th DCA 1981), and confirmed by the Florida Supreme Court in Allstate Insurance Co. v. Ginsberg, 863 So. 2d 156 (Fla. 2003): appropriation of a person’s name or likeness for the defendant’s benefit; intrusion, physically or electronically, into a person’s private quarters; public disclosure of private facts a reasonable person would find objectionable; and publication placing a person in a false light. The four branches have not fared equally.

Three structural features that define the Florida cause of action

• It reaches private actors. This is the essential contrast with Article I, § 23 of the Florida Constitution, which restrains government only. If the defendant is a business, employer, media outlet, platform, data broker, or individual, the common-law tort — not the constitution — is the operative theory.
• It is a personal right. Only the person whose privacy was invaded may sue. The claim is generally non-assignable, does not survive the plaintiff’s death, and cannot be asserted by family members on a decedent’s behalf. Corporations and other artificial entities have no privacy rights under these torts, though they may have trade secret, confidentiality, and unfair-competition claims.
• It is an intentional tort. This matters enormously for damages. Florida’s impact rule — which bars recovery for emotional distress absent physical impact or manifestation — restricts negligence-based claims but does not bar emotional-distress damages for intentional torts (Southern Baptist Hospital of Florida, Inc. v. Welker, 908 So. 2d 317 (Fla. 2005)). Pleading intent rather than negligence is often the difference between a viable case and a dismissed one.

Intrusion Upon Seclusion

Restatement § 652B as Florida applies it — and the “private quarters” gloss that decides most cases

Florida courts expressly adopt Restatement (Second) of Torts § 652B: “One who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.” See Allstate Ins. Co. v. Ginsberg, 863 So. 2d 156 (Fla. 2003); Oppenheim v. I.C. System, Inc., 695 F. Supp. 2d 1303 (M.D. Fla. 2010), aff’d, 627 F.3d 833 (11th Cir. 2010); Stasiak v. Kingswood Co-Op, Inc., 2012 WL 527537 (M.D. Fla. 2012); Benn v. Florida East Coast Railway Co., 1999 WL 816811 (S.D. Fla. 1999). Three features of the Restatement commentary do most of the work in Florida briefing. No publicity is required — the tort is complete at the moment of intrusion, and a defendant who reads an employee’s private email and tells no one has still committed it. The intrusion need not be physical — it may be “by the use of the defendant’s senses, with or without mechanical aids,” or by investigation into private concerns such as opening mail, examining a bank account, or accessing private records — language broad enough to reach electronic and AI-driven collection with no traditional trespass. And there is a public-place limitation: no liability for examining a public record, or for observing or photographing a person on a public street, because the person is not then in seclusion.

Intrusion in the age of AI

Because the intentional act of collection is the defining element, intrusion upon seclusion is the privacy theory most readily applied to AI systems that gather or store sensitive information — biometric identifiers, precise geolocation, health and financial data, the contents of private communications. Florida’s Digital Bill of Rights regulates that kind of data, but it reaches only billion-dollar controllers meeting additional criteria and gives consumers no private right of action; the common-law tort, by contrast, is a private claim that reaches any business engaging in the intrusive conduct. The Security of Communications Act supplies a statutory companion where the collection intercepts an electronic communication in which the person had a reasonable expectation of privacy, and FDUTPA supplies another where the collection contradicts a published privacy policy. The claim attaches to the capture — the image, the recording, the location, the data — not to what an AI system later does with it; the downstream use is the province of the disclosure and publicity claims discussed next.

Public Disclosure of Private Facts

Restatement § 652D — where truth is no defense, and the First Amendment is

Liability attaches where “one gives publicity to a matter concerning the private life of another, if the matter publicized is of a kind that would be highly offensive to a reasonable person and is not of legitimate concern to the public” (Restatement (Second) of Torts § 652D). The plaintiff must prove publicity; that the facts were private — not already public, in public records, or previously disclosed by the plaintiff; that the disclosure would be highly offensive and objectionable to a reasonable person of ordinary sensibilities; that the matter is not of legitimate public concern; and causation and damages. Truth is not a defense — the facts are assumed true, which is the point of the tort and also what makes it the most constitutionally fragile privacy claim.

The publicity element

Publicity is the most demanding element. It requires communication to the public at large, or to so many persons that the matter is substantially certain to become public knowledge — a materially higher bar than defamation’s “publication,” which is satisfied by disclosure to a single third party. In Hargrave v. GE Aviation Systems, LLC, No. 8:08-cv-1966 (M.D. Fla. July 29, 2009), transmission of private medical information to a limited number of people for a specific purpose was not publicity. In Leach v. District Board of Trustees of Palm Beach State College, 244 F. Supp. 3d 1334 (S.D. Fla. 2017), the court rejected the argument that twenty students who learned private information could easily spread it on social media; the plaintiff needed facts showing actual dissemination, or circumstances making it substantially certain. Under that standard, a business sharing personal data with a third-party server, or an AI platform storing it, will rarely satisfy the publicity element on those facts alone.

The First Amendment ceiling

Truthful information lawfully obtained about a matter of public significance is presumptively protected. Cox Broadcasting Corp. v. Cohn, 420 U.S. 469 (1975); Florida Star v. B.J.F., 491 U.S. 524 (1989) (a Florida case invalidating liability for publishing a rape victim’s name lawfully obtained from a police report); Bartnicki v. Vopper, 532 U.S. 514 (2001). Newsworthiness is construed broadly and frequently decided by the court as a matter of law — Cape Publications, Inc. v. Bridges, 423 So. 2d 426 (Fla. 5th DCA 1982), held a photograph of a hostage victim clutching a towel newsworthy. The claim works where medical or psychiatric conditions, HIV status, sexual orientation or history, substance-abuse treatment, financial ruin, criminal victimization, intimate images, or genetic information are broadcast widely about a person of no legitimate public interest and with no news value.

The AI-altered content gap

For AI-altered images, Florida statutes explicitly cover only sexual deepfakes (§ 836.13 and Brooke’s Law) and, arguably, synthetic likenesses used commercially (§ 540.08). The disclosure tort struggles with the rest, because the plaintiff often has no reasonable expectation of privacy in the original image, leaving the synthetic alteration outside the tort’s language. That leaves a real gap for non-sexual, non-commercial AI-fabricated content shared simply to embarrass or harass — a gap the 2026 Legislature attempted to close in SB 482 and will likely revisit in 2027.

Remedies, Damages & Limitations Periods

What a privacy plaintiff can recover — and how quickly the claim must be brought

Non-economic damages are typically the principal component: mental anguish, emotional distress, humiliation, embarrassment, injury to reputation, loss of dignity, sleeplessness, and loss of a sense of security, all recoverable without proof of physical injury or pecuniary loss because the privacy torts are intentional. Florida juries and courts are nonetheless skeptical of unsupported emotional-distress claims; persuasive cases pair the plaintiff’s testimony with corroboration from family and coworkers, treating professionals’ records, and evidence of concrete life disruption. Economic damages — lost wages or business, treatment costs, credit monitoring and identity restoration, security systems, relocation, takedown and reputation-repair costs, and the cost of investigating the intrusion — are recoverable on proof of causation. Nominal damages are available where the right was invaded but loss is unproven, and can support a punitive award. In appropriation cases, disgorgement of the defendant’s profits and the reasonable royalty expressly authorized by § 540.08(2) are often the most reliably provable measures.

Punitive damages — §§ 768.72 and 768.73

Punitive damages may not be pleaded in the initial complaint; the plaintiff must proffer evidence and obtain leave of court, and no discovery into the defendant’s financial worth is permitted until leave is granted. The standard is clear and convincing evidence of intentional misconduct or gross negligence. Against a business, § 768.72(3) requires that the employer actively and knowingly participated in an employee’s or agent’s conduct, that managing agents knowingly condoned or ratified it, or that the employer’s own gross negligence contributed to the loss — which means a business’s response to a reported privacy violation can convert an employee’s misconduct into corporate punitive exposure.

Injunctions, fees, and criminal restitution

Courts readily enjoin intrusion — halting surveillance, recording, or access, and ordering destruction or return of recordings and data — and Florida’s stalking injunction under § 784.0485 is a fast, low-cost tool enforceable by criminal contempt. Injunctions against publication, by contrast, face the near-insurmountable presumption against prior restraints; post-publication damages are usually the only remedy against a publisher, although § 540.10 expressly preserves injunctive relief against future advertising. Florida follows the American rule on attorney’s fees: recovery requires a statute or contract, and the privacy torts themselves supply none. Fees are available under § 934.10 (wiretap), § 934.50 (drones), § 784.049 (sexual cyberharassment), § 836.13 (altered sexual depictions), § 501.2105 (FDUTPA, prevailing party — which cuts both ways), § 501.059 (Telephone Solicitation Act), and § 768.79 (proposal for settlement, available to either side), while § 768.295 (anti-SLAPP) mandates fees to a prevailing defendant in suits over speech on a public issue — a serious plaintiff-side risk in any publication-based claim. Many invasions are independently criminal, and conviction supports mandatory restitution under § 775.089: illegal interception (§ 934.03), video voyeurism (§ 810.145), sexual cyberharassment (§ 784.049), altered sexual depictions (§ 836.13), identity theft (§ 817.568), computer offenses (§ 815.06), and cyberstalking (§ 784.048).

For publication-based claims, the single publication rule means the claim accrues on first publication, not on each subsequent view; republication in a materially different form restarts the clock, and the single-action rule prevents stacking multiple tort theories to multiply recovery for one publication.

Publicity, Privacy & Consumer Protection Compared

Three overlapping bodies of law, one set of facts — which claim fits, and what it pays

The same conduct — a photograph used without permission, a recording made without consent, personal data collected and monetized — can implicate the right of publicity, the right of privacy, and Florida’s consumer-protection statutes at once. They differ in who may sue, what must be proved, what can be recovered, and how long the claim survives. The matrix and table below compare them; the right of publicity is treated in full in our Right of Publicity Matters summary.

The right of publicity — elements, remedies, the federal litigation record in Florida, and the generative-AI gap — is treated in full in our Right of Publicity Matters summary; how these rights fit into an athlete’s or public figure’s brand is covered in our Name, Image & Likeness Matters summary.

Key Considerations for Florida Businesses & Employers

Where the real exposure lies — and the controls that reduce it

Understand your actual regulatory position

Florida’s statutory privacy regime is deliberately narrow, which produces a counterintuitive result. The Florida Digital Bill of Rights (§§ 501.701–501.722, effective July 1, 2024) applies principally to controllers with more than $1 billion in global annual revenue that also derive half their revenue from targeted advertising, operate a large app store, or operate a smart speaker or voice assistant; enforcement is exclusively by the Attorney General, there is no private right of action, and penalties reach $50,000 per violation, trebled in specified circumstances. The Attorney General brought the first FDBR enforcement action in October 2025 against a streaming-device maker over children’s data, and in February 2026 stood up a dedicated unit investigating foreign-owned companies’ collection of Floridians’ sensitive data. Two FDBR provisions apply to every for-profit business regardless of revenue and are widely overlooked: the prohibition on processing sensitive data — race, religion, health, sexual orientation, immigration status, genetic or biometric data processed for identification, and precise geolocation — without consent, and the children’s online protections of § 501.1735. The Florida Information Protection Act (§ 501.171) applies to essentially every business holding Floridians’ personal information: reasonable security, 30-day breach notification to individuals and to the Department of Legal Affairs for breaches affecting 500 or more Floridians, and proper disposal, with Attorney General penalties to $500,000 and no private right of action — but a violation establishes the standard of care in negligence litigation. The practical takeaway: for most Florida businesses the real exposure is common-law tort liability, FDUTPA with its prevailing-party fee shift, and breach-of-contract claims on the business’s own privacy policy.

Employee monitoring and workplace privacy

• Adopt a written, acknowledged monitoring policy. Distributed at hire and periodically re-acknowledged, stating precisely what is monitored, on what devices, when, and why. Clear notice eliminates the reasonable expectation of privacy — the single most effective defense to a § 652B claim, because it defeats the second element.
• Monitor proportionately. No more than the legitimate business purpose requires; scope creep converts defensible monitoring into a “highly offensive” intrusion. Prohibit monitoring in restrooms, changing areas, and medical or lactation rooms without exception, and never record audio without all-party consent — video and audio are governed differently, and Chapter 934 exposure is strict and statutory.
• Handle personal devices and monitoring output carefully. BYOD policies must obtain explicit, informed, written consent and segregate business from personal data. Restrict access to monitoring outputs on a need-to-know basis; unnecessary internal circulation creates a disclosure claim on top of the intrusion claim.
• Train supervisors. Ginsberg limits intrusion liability for offensive conduct, but § 768.72(3) means a supervisor’s misconduct plus corporate ratification equals corporate punitive exposure.

Customer and consumer data practices

• Your privacy policy is an enforceable contract and a FDUTPA representation. The most common business-side privacy liability in Florida is not a regulatory penalty; it is a breach-of-contract or FDUTPA claim for doing something the policy said you would not do. Audit actual practice against the published policy at least annually.
• Website tracking technologies are a wiretap risk. Session replay, pixels, chat tools, and analytics scripts have generated substantial litigation under wiretap theories, and Florida’s all-party-consent rule under Chapter 934 makes it a live one: in W.W. v. Orlando Health (M.D. Fla. Mar. 2025) the court refused to dismiss claims that a hospital’s website trackers intercepted the contents of patient communications, and the case settled in February 2026. Obtain consent through a functioning banner and do not fire trackers before consent.
• Treat biometrics as sensitive data. Florida has no BIPA-style per-violation private right of action, but biometric data requires consent under the FDBR regardless of revenue, is personal information under FIPA, and biometric collection without consent is a strong intrusion-upon-seclusion fact pattern.
• Minimize, retain, and manage vendors. Data you do not hold cannot be breached, subpoenaed, or misused; written retention schedules with actual deletion are the highest-leverage control available. Contract with vendors for security standards, breach-notification timelines shorter than your own 30-day FIPA obligation, audit rights, use restrictions, deletion on termination, and indemnification. Pre-build the incident-response plan — FIPA’s 30-day clock runs from determination of a breach, and late notification is itself the violation.
• Marketing and telephony. The Florida Telephone Solicitation Act (§ 501.059) requires prior express written consent for autodialed calls and texts, at $500 per violation and $1,500 if willful; the 2023 amendments narrowed the statute and added a 15-day pre-suit notice and cure period for text claims, but exposure remains.

Marketing, likeness, and content

Obtain written releases for every identifiable person appearing in advertising, promotional material, packaging, social content, testimonials, and case studies; § 540.08 permits oral consent, but written releases are the only defensible practice. Employees and customers are not consenting by being photographed on premises, a hashtag is not consent to repost a customer’s photo to a commercial feed, and continued use of a departed employee’s name or image is a classic § 540.08 claim. Scope every release for media, territory, duration, modification rights, and — critically — AI training and synthetic-modification rights. Testimonials and endorsements raise § 540.08 and FTC Endorsement Guides exposure simultaneously.

Full Capability

Our Privacy & Publicity Services Include