How is privacy regulation described in the United States?

• A. There is a single federal privacy statute
• B. There are several state privacy statutes with no overarching federal law
• C. Privacy is completely self-regulated by industry
• D. The FTC handles privacy matters but states lead enforcement

Answer: (D)

Privacy regulation in the United States is not centralized in one federal statute. The Federal Trade Commission uses its general consumer-protection power to police unfair or deceptive privacy and data‑security practices. At the same time, states lead the enforcement of privacy rules through their own laws and consumer-protection agencies, making state action the primary mode of enforcement. There are also sector-specific federal rules that regulate certain kinds of data, such as HIPAA for health information and GLBA for financial information. Because of this mix, there isn’t a single federal privacy law, and enforcement tends to be driven by state authorities with the FTC playing a federal role.