CIPP-US - State Privacy Laws (23% of the exam) - Section 5.1

Explain the interplay between federal preemption and state authority over data privacy, and identify the circumstances in which state law provides broader protection.

Explain how the Supremacy Clause and express preemption in statutes such as HIPAA and COPPA displace conflicting state law, while concurrent jurisdiction lets states enforce where federal law sets a floor not a ceiling. Identify when a state law survives preemption by offering greater protection, and recognise that many US sector laws permit such state floors.

Federal preemptionState floorSupremacy ClauseConcurrent jurisdiction

Practice question for this objective

Free sampleState Privacy Lawsmedium

An online retailer is sued by a state attorney general under that state's comprehensive consumer privacy law. The retailer argues that because Congress has not enacted any comprehensive federal consumer privacy statute, the field belongs exclusively to the federal government and the state regulator has no authority to act. Counsel must advise how to characterise the state attorney general's authority here. Which assessment is correct?

AThe state attorney general lacks authority, because the Supremacy Clause reserves all data-privacy regulation to Congress whether or not Congress has acted.
BThe state attorney general may enforce the state law, because absent a conflicting or field-preempting federal statute, states retain concurrent authority to regulate data privacy. Correct
CThe state attorney general lacks authority, because federal inaction on comprehensive privacy creates a dormant field that bars states from legislating until Congress acts.
DThe state attorney general may act only if the Federal Trade Commission first declines the matter, because the FTC holds primary jurisdiction over all consumer privacy disputes.

Apply concurrent jurisdiction: with no field-preempting federal privacy statute, states retain police-power authority to enact and enforce their own privacy laws. Federal preemption displaces state law only through a valid federal statute that conflicts with or occupies the field; absent any comprehensive federal privacy law, states keep their police-power authority, so a state attorney general exercises concurrent jurisdiction and may enforce the state comprehensive law.

Why A is wrong: Tempting because the Supremacy Clause governs conflicts, but it gives federal law priority only when valid federal law exists; it does not reserve a subject to Congress in the absence of any federal statute, so the state retains authority.

Why B is correct: Correct: states hold inherent police-power authority and, with no comprehensive federal statute to preempt them, that authority is concurrent rather than displaced, so the attorney general may enforce the state comprehensive law against the retailer.

Why C is wrong: Tempting because dormant doctrines exist for interstate commerce, but there is no general dormant-field bar that suspends state privacy laws while Congress stays silent, so the state regulator is not blocked from enforcing its statute.

Why D is wrong: Tempting because the FTC is the leading federal privacy enforcer, but its Section 5 authority does not give it primary jurisdiction that gates state enforcement, so the attorney general need not wait for the FTC to decline.

See more CIPP-US practice questions, answers explained.

Exam traps in State Privacy Laws

Answers that look right on this material and are not. Each one is a distractor from a different question in the CIPP-US bank for this domain.

Only the state where the retailer is headquartered may enforce its law, because corporate domicile fixes exclusive regulatory authority over data practices.
Why it is wrong: This is tempting given a single corporate home, but state privacy laws generally reach processing of their own residents regardless of where the business is domiciled, so domicile is not exclusive.
A sunset clause, which terminates the federal statute on a fixed future date unless Congress renews it, thereby returning the subject entirely to state control.
Why it is wrong: Tempting because both clauses shape a statute's reach, but a sunset clause fixes an expiry date for the law itself; it does not define how the statute coexists with stronger state protection.
Preserve the stronger state laws as a floor, because federal privacy statutes by default allow states to keep more protective rules.
Why it is wrong: This reflects the common floor pattern, but the bill is drafted to bar differing state requirements, so the default floor assumption does not hold against express preemptive language.

Examworthy is not affiliated with or endorsed by IAPP. Original, blueprint-aligned practice material only.