State Privacy Laws

Federal vs. state authority, comprehensive state privacy statutes, and data breach notification laws.

5 minutes 5 Questions

State Privacy Laws in the United States represent a critical layer of privacy regulation that operates alongside federal laws to protect individuals' personal information. Unlike many countries that have a single comprehensive national privacy law, the U.S. employs a sectoral approach, and states h…

Concepts covered
State SSN and Data Destruction LawsCalifornia Consumer Privacy Act (CCPA) and CPRAOther Comprehensive State Privacy LawsState Data Breach Notification Law ElementsKey Differences Among State Breach Notification LawsRecent State Privacy Legislative DevelopmentsCalifornia CCPA as amended by the CPRAConsumer rights common to the state comprehensive lawsApplicability thresholds and exemptions in state privacy lawsUniversal opt-out mechanismsSensitive data and consent under state lawsState biometric privacy lawsState consumer health data lawsNYDFS Part 500 cybersecurity regulationState attorney general enforcement and cure periodsFederal vs. State Authority and PreemptionState Security Procedures and Cookie RegulationsVirginia Consumer Data Protection Act (VCDPA)
Test mode:
Start practice test

CIPP/US - State Privacy Laws Example Questions

Test your knowledge of State Privacy Laws

Question 1

A California consumer contacts a company and asks to know what specific pieces of personal information the company has collected about them. The company verifies the consumer's identity. What should the company do next?

Correct Answer: Provide the consumer with the specific pieces of personal information collected about them

Under the California Consumer Privacy Act (CCPA), when a consumer exercises their right to know and specifically requests the specific pieces of personal information collected about them, the business must provide exactly that: the actual data points collected, not just categories or general descriptions.

Providing only a summary of categories would be an incomplete response to a specific pieces request, as the CCPA distinguishes between a right to know categories and a right to know specific pieces. Sending a general privacy policy does not fulfill the individualized nature of the request. There is no requirement to obtain approval from the California Privacy Protection Agency before responding.

Key concept tested: CCPA right to know specific pieces of personal information.

Question 2

How does the CPRA's creation of the California Privacy Protection Agency (CPPA) differ from the original CCPA's enforcement structure?

Correct Answer: The CPRA established a dedicated enforcement agency, whereas the CCPA relied solely on the California Attorney General for enforcement

The CPRA created the California Privacy Protection Agency (CPPA) as the first dedicated state privacy enforcement agency in the United States, whereas under the original CCPA, enforcement authority rested exclusively with the California Attorney General's office.

The option stating the CPRA transferred all enforcement powers is wrong because the Attorney General retains concurrent enforcement authority alongside the CPPA. The option describing the CPPA as merely an advisory body is incorrect because the CPPA has full administrative enforcement powers, including rulemaking and investigation authority. The option limiting the CPPA to data breach cases is wrong because the CPPA has broad jurisdiction over all CPRA provisions, not just breaches.

Key concept tested: CPRA's institutional enforcement framework and the role of the CPPA.

Question 3

What is the primary role of a "universal opt-out mechanism" as recognized in recent state privacy laws like Colorado and Connecticut?

Correct Answer: It allows consumers to signal opt-out preferences for data sales and targeted advertising through a single browser or device setting

A universal opt-out mechanism, as recognized in state privacy laws like Colorado and Connecticut, enables consumers to communicate their opt-out preferences specifically for the sale of personal data and targeted advertising through a single browser-level or device-level signal such as Global Privacy Control (GPC), rather than having to submit individual requests to each business.

The option referencing all data processing including essential services is wrong because universal opt-out mechanisms are limited in scope to sales and targeted advertising, not essential processing. The option about deletion requests conflates opt-out signals with data deletion, which are distinct rights. The option about sensitive data consent is wrong because these mechanisms address opt-out preferences, not affirmative consent for sensitive data.

Key concept tested: scope and function of universal opt-out mechanisms under emerging state privacy laws.

More State Privacy Laws questions
483 questions (total)
Practice 100 questions
One session at a time, always new questions