Explain the interplay between federal preemption and state authority over data privacy, and identify the circumstances in which state law provides broader protection.

An online retailer is sued by a state attorney general under that state's comprehensive consumer privacy law. The retailer argues that because Congress has not enacted any comprehensive federal consumer privacy statute, the field belongs exclusively to the federal government and the state regulator has no authority to act. Counsel must advise how to characterise the state attorney general's authority here. Which assessment is correct?

• AThe state attorney general lacks authority, because the Supremacy Clause reserves all data-privacy regulation to Congress whether or not Congress has acted.
• BThe state attorney general may enforce the state law, because absent a conflicting or field-preempting federal statute, states retain concurrent authority to regulate data privacy.check_circle Correct
• CThe state attorney general lacks authority, because federal inaction on comprehensive privacy creates a dormant field that bars states from legislating until Congress acts.
• DThe state attorney general may act only if the Federal Trade Commission first declines the matter, because the FTC holds primary jurisdiction over all consumer privacy disputes.

Why A is wrong: Tempting because the Supremacy Clause governs conflicts, but it gives federal law priority only when valid federal law exists; it does not reserve a subject to Congress in the absence of any federal statute, so the state retains authority.

Why B is correct: Correct: states hold inherent police-power authority and, with no comprehensive federal statute to preempt them, that authority is concurrent rather than displaced, so the attorney general may enforce the state comprehensive law against the retailer.

Why C is wrong: Tempting because dormant doctrines exist for interstate commerce, but there is no general dormant-field bar that suspends state privacy laws while Congress stays silent, so the state regulator is not blocked from enforcing its statute.

Why D is wrong: Tempting because the FTC is the leading federal privacy enforcer, but its Section 5 authority does not give it primary jurisdiction that gates state enforcement, so the attorney general need not wait for the FTC to decline.