Sectoral and State Privacy Laws
What this domain tests
This domain tests whether you can match a data type, entity, or consumer to the correct federal sectoral statute or state comprehensive law-and spot exemptions.
Core rules and concepts
- HIPAA regulates protected health information held by covered entities (providers, plans, clearinghouses) and business associates; it does not generally cover consumer wellness apps.
- GLBA covers nonpublic personal information held by financial institutions; COPPA requires verifiable parental consent for online collection from children under 13; FERPA protects education records; FCRA governs consumer reporting; TCPA restricts automated calls and texts without consent.
- State comprehensive laws apply by revenue, data volume, or percentage of revenue from selling data. CCPA/CPRA applies to for-profit businesses meeting thresholds and gives rights to know, delete, correct, opt out of sale/share, limit sensitive data, and non-discrimination. Virginia, Colorado, Connecticut, Utah, and others use similar but not identical rights, thresholds, and cure periods.
- Sensitive data often requires opt-in consent (e.g., Colorado, Connecticut) or a right to limit (California).
- Exemptions are entity- and data-based; a HIPAA-covered entity may still be subject to state law for non-PHI.
Worked example
A direct-to-consumer fertility app collects cycle data and sells insights to advertisers. It is not a HIPAA covered entity. If it meets a state threshold, CCPA/CPRA may treat precise geolocation and health data as sensitive; sale/share triggers opt-out and notice at collection. The FTC Health Breach Notification Rule may also apply to unauthorized disclosure.
Traps that cost marks
- Assuming “sale” requires money-California includes other valuable consideration.
- Missing that state laws exempt some B2B or employee data, but exemptions vary.
- Applying COPPA to all teen data (it covers under 13).
- Forgetting that sectoral laws can overlap with state UDAP and breach laws.