State Privacy Laws

A Colorado-based streaming service wants to process customers' precise geolocation and inferred sexual orientation to refine recommendations. Under the Colorado Privacy Act, what must the controller do before this processing?

• AObtain the consumer's consent before processing, because precise geolocation and data revealing sexual orientation are sensitive data.check_circle Correct
• BProvide a clear notice and allow the consumer to opt out of the processing at any point after it begins.
• CConduct a data protection assessment and rely on legitimate interests, which substitutes for consent when processing sensitive data.
• DRegister the processing activity with the Colorado Attorney General and wait for written approval before launch.

Why A is correct: Correct: the CPA prohibits processing sensitive data without first obtaining consent, and both precise geolocation and data revealing sexual orientation fall within the Act's definition of sensitive data.

Why B is wrong: Tempting because opt-out applies to targeted advertising, sale, and certain profiling, but wrong: sensitive data under the CPA requires affirmative opt-in consent, not a notice-and-opt-out approach.

Why C is wrong: Tempting because the CPA does require assessments for high-risk processing, but wrong: an assessment does not replace the consent requirement that sensitive data triggers, and the CPA has no legitimate-interests exception to that consent.

Why D is wrong: Tempting because the CPA gives the Attorney General rulemaking and enforcement authority, but wrong: there is no pre-clearance or registration-and-approval step for processing sensitive data under the Act.

A federal sectoral privacy law sets a baseline duty for safeguarding certain records but says nothing about whether states may add stronger protections. A state then requires shorter breach-notice timelines and broader consumer rights than the federal baseline for the same records. How is the relationship between the two laws best characterised?

• AThe federal law acts as a floor, so the state may impose stronger protections that operate alongside the federal baseline.check_circle Correct
• BThe federal law acts as a ceiling, so the stronger state timelines are void because they exceed what Congress set as the maximum permissible protection.
• CThe laws conflict irreconcilably, so the state law is automatically struck down under ordinary conflict preemption analysis.
• DConcurrent jurisdiction is impossible here, so a covered entity must choose which single regime to follow for the records.

Why A is correct: When a federal statute sets a minimum standard and does not preempt more protective state law, states may build above the floor and the two regimes coexist.

Why B is wrong: This misreads the structure; a sectoral baseline that is silent on stronger state rules functions as a floor, not a ceiling, so exceeding it is generally allowed.

Why C is wrong: This is tempting, but offering more protection than a federal minimum does not make compliance with both impossible, so there is no true conflict to trigger conflict preemption.

Why D is wrong: Privacy law routinely involves concurrent federal and state regulation, and an entity must satisfy the stricter requirement rather than electing one regime, so this is incorrect.

A national lender complies with the federal Fair Credit Reporting Act when it furnishes consumer credit data. A state then enacts a statute imposing additional furnisher accuracy duties in an area the FCRA expressly addresses. Which principle best explains why the state requirement is most vulnerable to challenge?

• AExpress preemption applies because the FCRA contains specific provisions barring state requirements in the particular areas Congress chose to occupy.check_circle Correct
• BThe Supremacy Clause renders all state privacy statutes void whenever a federal privacy statute exists on the same general subject.
• CField preemption applies because consumer reporting is an inherently national activity that Congress has reserved entirely to federal regulators.
• DThe dormant Commerce Clause applies because the state law burdens an out-of-state lender that operates across multiple jurisdictions.

Why A is correct: The FCRA includes express preemption clauses covering defined subject areas such as furnisher duties, so a state rule in one of those covered areas is most vulnerable as expressly preempted.

Why B is wrong: This overstates the doctrine; the Supremacy Clause invalidates conflicting or expressly preempted state law, not every state statute that touches a subject Congress has also addressed.

Why C is wrong: This is tempting because credit reporting is interstate, but the FCRA preempts only enumerated areas and leaves room for state law elsewhere, so the field is not wholly occupied.

Why D is wrong: The dormant Commerce Clause addresses discrimination against interstate commerce, not a direct conflict with a federal statute's express preemption terms, so it is the wrong frame here.