Sensitive data and consent under state laws

5 minutes 5 Questions

Opt-in consent for sensitive categories, data protection assessments, and the treatment of precise geolocation and biometric data.

Test mode:
Start practice test

CIPP/US - Sensitive data and consent under state laws Example Questions

Test your knowledge of Sensitive data and consent under state laws

Question 1

A privacy officer is drafting the sensitive-data provisions of a compliance program that must satisfy several comprehensive state consumer privacy statutes at once. The officer wants to build a single internal standard for handling categories such as precise geolocation, health conditions, and racial or ethnic origin, so one workflow can serve every applicable state. Which design choice best positions the program to hold up across these statutes?

Correct Answer: Require affirmative opt-in consent before any sensitive category is processed, matching the strictest common standard

Requiring affirmative opt-in consent before processing any sensitive category adopts the strictest common standard, so a single workflow satisfies every state whether it demands consent or merely an opt-out.

The post-collection opt-out link fails states that mandate opt-in for sensitive data. Documented legitimate interest is a European concept, not the consent-based framework U.S. state statutes use for sensitive data. Applying consent only to geolocation ignores that health and ethnicity are also statutorily defined sensitive categories requiring the same protection.

Key concept: harmonizing multistate compliance by defaulting to the most protective requirement for sensitive personal data.

Question 2

A data analytics company aggregates official voter registration records from multiple state government databases to build demographic profiles. These government records include information revealing consumers' racial or ethnic origins. The company plans to sell these profiles to advocacy groups. Under most comprehensive state consumer privacy statutes, how is the racial and ethnic information treated in this specific context?

Correct Answer: It qualifies as publicly available information and is exempt from the affirmative opt-in consent requirements for processing sensitive data.

The correct answer is right because under most comprehensive state privacy laws, data lawfully made available from federal, state, or local government records is defined as publicly available information and excluded from personal data definitions, exempting it from sensitive data processing rules.

The answer requiring explicit permission is incorrect because public records are exempt from sensitive data opt-in consent mandates. The answer classifying it as inferred information is wrong because the data is explicitly stated in government records rather than deduced. The answer requiring a privacy impact assessment is incorrect because exempt public records do not trigger assessment obligations.

Key concept tested: Publicly available information exemptions under US state privacy statutes.

Question 3

A privacy analyst is auditing two comprehensive state consumer privacy statutes to advise a multistate business on handling precise geolocation and biometric identifiers. One statute requires affirmative opt-in consent before such categories may be processed, while the other permits processing until the consumer opts out. Which analytical conclusion best distinguishes how these frameworks govern this category of information?

Correct Answer: Some statutes gate this category behind prior opt-in consent, while others fold it into a broader opt-out right the consumer must invoke

The correct answer accurately captures the divergence: one framework requires affirmative opt-in consent before processing sensitive data like precise geolocation and biometrics, while the other treats such data under a broader opt-out right the consumer must exercise.

The option claiming both require opt-in wrongly assumes uniformity, defeating the premise of two distinct frameworks. The option saying neither gates the category is false because both statutes address sensitive data and no sector rule categorically overrides state consumer statutes here. The option claiming both use opt-out ignores the stated opt-in requirement in one statute.

Key concept: divergent state treatment of sensitive data through opt-in consent versus opt-out mechanisms.

More Sensitive data and consent under state laws questions
27 questions (total)
Start 27 question test

Other State Privacy Laws concepts

Applicability thresholds and exemptions in state privacy lawsCalifornia CCPA as amended by the CPRACalifornia Consumer Privacy Act (CCPA) and CPRAConsumer rights common to the state comprehensive lawsFederal vs. State Authority and PreemptionKey Differences Among State Breach Notification LawsNYDFS Part 500 cybersecurity regulationOther Comprehensive State Privacy LawsRecent State Privacy Legislative DevelopmentsState attorney general enforcement and cure periodsState biometric privacy lawsState consumer health data lawsState Data Breach Notification Law ElementsState Security Procedures and Cookie RegulationsState SSN and Data Destruction LawsUniversal opt-out mechanismsVirginia Consumer Data Protection Act (VCDPA)
All State Privacy Laws questions · CIPP/US practice test