""The FTC just doesn't have time -- it's fabulous, but they have so many things on their plate," said Danielle Citron, a University of Maryland law professor currently serving as a senior fellow at the Future of Privacy Forum.
But when a case doesn't reach the level of federal involvement, states can often investigate because they have "mini-FTC" acts -- laws that typically give the state attorneys general some of the same powers to go after deceptive or unfair business practices. And for years now, they've pushed for stronger privacy and data security practices through enforcement actions and new legislative proposals, said Citron, who is finalizing a paper about how state attorneys general influence privacy norms.
"What we've seen in the last 10 years on the state level is state lawmakers and attorneys general seeing a vacuum because they are on the front lines," she said. "Consumers are coming to them with problems.""