State Attorneys General and UDAP Statutes
State AGs are the primary privacy enforcers in most states and may join federal actions under HIPAA, GLBA, and CAN-SPAM. All 50 states have UDAP statutes similar to Section 5; the FTC Act does not preempt them unless they conflict.
How this supports CIPP/US study
Use this lesson to connect a privacy programme decision with the relevant regulator, duty or enforcement route. Continue with the CIPP/US exam questions.
In all 50 states, state attorneys general are constitutional officers, popularly elected in nearly all states, and among the most powerful state officials. They have traditionally enforced state privacy protections - sometimes with sole authority, sometimes sharing it or alongside a private right of action. Certain federal statutes let state AGs bring actions with the federal agency: HIPAA, GLBA, and CAN-SPAM.
All 50 states have UDAP statutes roughly similar to Section 5 of the FTC Act. The FTC Act does NOT preempt state unfair/deceptive trade-practice laws so long as they do not conflict. Some statutes also reach unconscionable practices, and several allow private rights of action. UDAP laws are enforced by state AGs.
Key terms - quick answers
What is “State attorneys general”?
What is “Unconscionable practices”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.