US Privacy Landscape and Legal Foundations
What this domain tests
The US privacy landscape is fragmented: no single federal comprehensive privacy statute governs all personal data. The exam checks whether you can identify the legal source that applies-constitutional, common-law, federal statute, FTC enforcement, or state law-and the enforcement body.
Core rules and concepts
- FTC Act Section 5 prohibits unfair or deceptive acts or practices. Deception requires a material representation likely to mislead; unfairness requires substantial injury not reasonably avoidable and not outweighed by benefits.
- Common-law privacy torts include intrusion upon seclusion, public disclosure of private facts, false light, and appropriation of name or likeness.
- Sectoral federal laws cover specific data: HIPAA (health), GLBA (financial), COPPA (children under 13), FERPA (education records), FCRA (consumer reports), TCPA (calls and texts).
- State comprehensive laws (e.g., CCPA/CPRA, Virginia CDPA, Colorado CPA, Connecticut CTDPA) create consumer rights and apply by thresholds and exemptions; state AGs and sometimes private plaintiffs enforce.
- Preemption is narrow: federal sectoral statutes may preempt conflicting state requirements, but states retain broad authority, especially over breach notification and unfair practices.
Worked example
A retailer advertises “military-grade encryption protects every chat” but stores chats in plain text. The FTC can assert deception under Section 5 because the security claim is material and false; a state UDAP statute may also apply. HIPAA does not apply because the retailer is not a covered entity or business associate.
Traps that cost marks
- Assuming the GDPR’s rights apply nationwide; US rights depend on sector and state.
- Treating HIPAA as covering all health data-many wellness apps are outside it.
- Believing FTC Act Section 5 reaches only banks or only privacy policies.
- Ignoring state AG enforcement and state constitutional privacy provisions.