Certified Information Privacy Professional – United States (CIPP/US) — Question 75

Which of the following is an example of federal preemption?

Answer options

• A. The Payment Card Industry’s (PCI) ability to self-regulate and enforce data security standards for payment card data.
• B. The U.S. Federal Trade Commission’s (FTC) ability to enforce against unfair and deceptive trade practices across sectors and industries.
• C. The California Consumer Privacy Act (CCPA) regulating businesses that have no physical brick-and-mortal presence in California, but which do business there.
• D. The U.S. Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act prohibiting states from passing laws that impose greater obligations on senders of email marketing.

Correct answer: D

Explanation

The correct answer is D because the CAN-SPAM Act explicitly prevents states from enacting stricter regulations regarding email marketing, showcasing federal preemption. Options A and B discuss regulatory powers that do not inherently conflict with state laws, and option C refers to a state law that regulates businesses without a federal conflict.