Florida Referral Agent Privacy Policy Requirements 2026

A Florida referral agent privacy policy can look simple until you map where every lead, form entry, tracking tag, and follow-up email goes. Even a small referral website may collect personal details that deserve clear handling.

If you keep your license active but only send clients to working agents, your site still creates legal and trust obligations. The right policy depends on your business structure, brokerage relationship, website features, data collected, and outside services.

Start by identifying what your website does before borrowing language from another business.

Start With Who Controls the Website Data

A referral agent's website may be a personal brand page, a brokerage-hosted profile, or a separate business site. That difference affects who decides why and how consumer data is used.

A Referral-Only Real Estate Agent who routes every inquiry through the sponsoring brokerage may have different responsibilities than an agent who also saves leads in a personal CRM and runs retargeting ads.

Your personal website may make you a data decision-maker

You likely control data if you choose the form fields, receive submissions, export leads, select a CRM, or decide who gets marketing emails. You may also control data when you install a Meta Pixel, Google Analytics, a call-tracking number, a chat tool, or an appointment scheduler.

Write down each point where data enters or leaves the site. Include names, emails, phone numbers, property addresses, referral notes, IP addresses, cookie identifiers, and source information such as UTM parameters.

A brokerage may control part of the process

If your website is built and managed by your brokerage, the brokerage may control the form, database, privacy notice, and referral-routing process. However, you should not assume its policy covers tools you independently add to your own pages.

Ask the broker or compliance contact who owns the data, which privacy notice applies, how long leads are retained, and what you may download or keep after leaving the brokerage. Review the Direct Connect Brokerage privacy policy if you use that brokerage's website or services.

Florida Referral Agent Privacy Policy Requirements: Mandatory or Prudent?

Florida does not impose one universal website privacy-policy rule on every individual licensee. Still, several laws can apply based on scale, data practices, and the services connected to your site.

The safer approach is to separate hard legal duties from sensible website practices.

The Florida Digital Bill of Rights has high thresholds

Florida's Digital Bill of Rights applies to certain larger data controllers. Under section 501.702, coverage generally turns on processing data for at least 100,000 consumers, excluding payment-only data, or processing data for at least 25,000 consumers while receiving more than half of gross revenue from selling personal data.

Most individual referral-agent sites will not meet those thresholds. A small site should not claim that the law automatically requires it to offer every statutory right.

However, a brokerage, franchise, marketing platform, or lead-generation company connected to your site could meet the threshold. Covered controllers must provide the privacy notice required by section 501.711, update it at least annually, and explain applicable consumer-rights procedures.

A privacy policy is still a smart baseline

A plain-language privacy policy is prudent whenever a site collects inquiries. It helps people understand what happens after they press "submit," and it keeps your public statements aligned with your actual practices.

Do not copy promises you cannot keep. For example, a policy should not say you "never share data" if you send leads to active agents, store contacts in a CRM, or use analytics vendors. Florida referral agent privacy work should describe reality, not a generic template.

What a Referral Website Privacy Policy Should Say

A useful policy gives visitors direct answers without turning into a dense legal document. It should match the website as it operates today.

Your attorney or compliance professional can tailor the wording to your entity, broker agreement, lead flow, and out-of-state audience.

Describe the information you actually collect

Name the categories of data rather than relying on broad phrases like "information you provide." A referral site may collect contact details, location, property address, price range, home-buying or selling timeline, communications, referral source, device data, and online activity.

Also disclose data collected automatically. Cookies, analytics tools, ad pixels, embedded maps, chat widgets, and appointment platforms may collect IP addresses, browser details, device identifiers, and page activity.

Avoid requesting information that you don't need. A basic referral form rarely needs Social Security numbers, banking details, driver's license images, or detailed financial records.

Explain why data is used and shared

State the purpose in familiar terms. You might use contact information to respond to an inquiry, identify an appropriate active agent, document a referral, send requested updates, prevent fraud, or meet recordkeeping obligations.

Then explain who receives the information. Categories may include your sponsoring brokerage, referred real estate agents, CRM provider, email platform, website host, analytics provider, legal advisers, insurers, or government agencies when law requires disclosure.

If you refer a consumer to an agent in another state, say that you may share the inquiry with that licensed professional. Don't hide the central purpose of a referral website.

Give visitors a workable contact path

Include the business or brokerage name, a mailing address or reliable contact method, and an email address for privacy requests. If a statute or another applicable privacy law gives visitors access, correction, deletion, or opt-out rights, explain how they can make a request.

A Florida referral agent privacy policy should also state the policy's effective date and describe how visitors will learn about material updates. Covered Digital Bill of Rights controllers generally must respond to consumer requests within 45 days, with one possible 15-day extension when reasonably necessary.

Account for Your CRM, Forms, and Vendors

Your vendors shape your privacy obligations because they handle the data collected through your site. A privacy policy alone does not control what a vendor does with a lead.

List every service connected to the website. Common examples include WordPress form plugins, Google Analytics, Meta Pixel, Mailchimp, HubSpot, Follow Up Boss, Calendly, Google Workspace, cloud-storage accounts, call tracking, and live-chat software.

Check each account's settings. Turn off unnecessary data sharing, remove old users, require multi-factor authentication, and limit access to people who need it for referral work. If a virtual assistant can view your CRM, that access should be deliberate and documented.

Vendor contracts matter as well. Review terms for data ownership, security commitments, breach notification, subcontractors, deletion options, and whether the provider uses contact data for its own advertising or product development.

A policy may link to or name third-party tools, but it should not imply that you control those companies' privacy practices. Your attorney can help determine whether a data-processing agreement is appropriate.

Licensing Disclosures Belong Beside Privacy Notices

Privacy compliance does not replace Florida real estate advertising and brokerage rules. A website that promotes referral services is still advertising, even if you never list homes, host open houses, or show property.

Florida's real estate licensing law in Chapter 475 prohibits fraudulent, false, deceptive, or misleading advertising. Your broker should approve public-facing pages before they go live.

State your role without overstating it

Identify yourself accurately as a sales associate, broker associate, or broker, as applicable. Include the sponsoring brokerage name where Florida rules and your brokerage policy require it.

A referral-only agent should not imply that they are the broker of record, a mortgage lender, title company, attorney, or the agent who will personally represent every visitor. If another professional will handle the transaction, explain that the visitor may be referred to an active licensee.

Agents who need an active license to receive referral compensation can review Florida license activation options before promoting referral services online.

Keep transaction disclosures separate

A website privacy policy explains data handling. It does not create, replace, or waive a brokerage relationship disclosure.

Florida's brokerage relationship disclosure statute governs disclosures to prospective buyers and sellers in defined circumstances. The timing and required form depend on the services provided and relationship involved.

Do not bury agency information inside a privacy policy. Confirm with your broker and a qualified Florida real estate attorney when disclosures are due for your referral process.

Prepare for a Data Breach Before One Happens

Florida Statute 501.171 requires covered entities to take reasonable measures to protect electronic personal information. That obligation matters even for a small operation with a single lead form and a cloud-based CRM.

A stolen password, exposed spreadsheet, hacked email inbox, or unsecured form integration can create a reportable event.

Build the response process now

Keep an internal list of every system that holds leads and the person who can access each one. Document how to disable accounts, reset passwords, preserve evidence, contact vendors, and notify your brokerage.

Florida's security-of-confidential-information law generally requires notice to affected individuals without unreasonable delay and no later than 30 days after a covered entity determines a breach or has reason to believe one occurred.

Put breach terms in vendor agreements

A third-party agent that maintains your data has duties too. Florida law requires a third-party agent to notify the covered entity within 10 days after determining a breach.

Your contracts should require quick notice, cooperation, and enough detail to assess the incident. For larger events, Florida law can require notice to the Department of Legal Affairs and consumer reporting agencies. Get legal guidance immediately after any suspected breach, because deadlines move quickly.

Email, Cookies, Texting, and Children's Data

A contact form is only the first step. Follow-up systems create additional duties and risks.

If you send commercial email, the federal CAN-SPAM Act requires truthful header information, non-deceptive subject lines, a physical postal address, a clear opt-out method, and prompt suppression of unsubscribes. The FTC's CAN-SPAM compliance guide states that opt-out requests must be honored within 10 business days.

Treat cookies and ad pixels as disclosures

A cookie banner is not automatically required for every Florida referral site. Still, it is often a sound choice when you use targeted advertising, analytics, or visitors may come from states with broader privacy laws.

Explain whether advertising tools track site visitors, build audiences, or measure campaign performance. If your business falls under the Florida Digital Bill of Rights and engages in targeted advertising or sells personal data as defined by the statute, confirm the required opt-out controls with counsel.

Text messages and automated calls bring separate federal and state rules. Obtain legal review before using automated marketing texts, particularly when a form collects a mobile number.

Keep child-directed features off a real estate site

Most referral websites are not directed to children. Yet COPPA applies if a site targets children under 13 or knowingly collects their personal information.

The FTC explains that covered operators generally need verifiable parental consent before collecting personal information from children under 13. Use a simple age-neutral site and avoid child-focused lead offers unless counsel approves the setup.

Accessibility Reduces Friction and Legal Risk

A visitor should be able to understand your privacy choices and submit a referral request without using a mouse. Accessibility also helps older adults, people with visual impairments, and visitors using mobile assistive technology.

The Department of Justice offers ADA web accessibility guidance for businesses open to the public. It does not create a one-size-fits-all private-business website checklist, so do not describe WCAG 2.1 AA as an automatic statutory rule for every agent site.

Still, WCAG 2.1 AA is a practical target. Use meaningful image alt text, readable contrast, keyboard-accessible menus, clear labels, visible error messages, and captions for video. Test referral forms with a keyboard and screen reader before publishing them.

A Practical 2026 Website Checklist

Before publishing or revising your website, confirm these items with your brokerage and compliance adviser:

• Identify every form, CRM, tracking tag, calendar tool, chat widget, and email platform connected to the site.
• Publish a clear privacy policy that matches the data you collect, use, retain, and share.
• Name the sponsoring brokerage and describe your license status accurately in advertising.
• Review whether the Florida Digital Bill of Rights applies to your business or affiliated platform.
• Add an accessible privacy-policy link in the footer and near lead forms.
• Use strong unique passwords, multi-factor authentication, limited user access, and secure backups.
• Create a written breach-response plan with vendor contact information.
• Configure commercial email with a working unsubscribe process and physical mailing address.
• Ask a Florida attorney or qualified real estate compliance professional to review your final website copy and workflow.

Final Thoughts

A useful privacy policy tells people what happens to their information after they contact you. It should match your forms, referral process, vendors, and brokerage relationship.

The strongest Florida referral agent privacy plan is accurate, easy to find, and reviewed when your tools or services change. Clear disclosures protect the visitor and help protect the license you worked to keep active.

Frequently Asked Questions

Does every Florida referral agent need a privacy policy?

Florida law does not impose the Digital Bill of Rights privacy-notice duties on every small referral-agent website. Its coverage depends on statutory thresholds and data practices. Still, a privacy policy is wise whenever your site gathers leads or uses tracking tools because visitors deserve to know how their details will be used and shared.

Can I use my brokerage's privacy policy on my own website?

You may be able to if the brokerage controls the site, forms, database, and follow-up process. However, a brokerage policy may not cover your independently owned CRM, personal email list, social-media pixel, calendar app, or separate business entity. Get written direction from your broker before relying on it.

Do I need to disclose that I only make referrals?

You should describe your role accurately and avoid suggesting that you will personally provide full-service representation if you will refer the visitor elsewhere. Your brokerage and Florida compliance adviser can confirm the wording, placement, and any required advertising disclosures for your specific website.