Could state attorneys general strengthen the DPF after Slaughter?

The debate over the EU-U.S. Data Privacy Framework has developed a new institutional dimension. 

In Trump v. Slaughter, the U.S. Supreme Court held that a statutory protection limiting the president's ability to remove Federal Trade Commission commissioners except for cause was unconstitutional. FTC commissioners are consequently now removable by the president at will. The European Commission's DPF adequacy decision expressly cited the statutory protection against removal, which Slaughter has now invalidated.

As a result, the European Data Protection Board asked the Commission to assess how the judgment affects the FTC's ability to uphold DPF commitments. Max Schrems has taken a stronger position, arguing that the loss of the FTC's structural independence undermines a central element of the adequacy decision and calling on the Commission to "orderly withdraw" from the DPF.

While those concerns should not be dismissed, they do not necessarily determine the future of the DPF. The ruling did not remove the FTC's enforcement powers, privacy expertise or ability to hold organizations accountable for DPF violations. The ruling does not mean the DPF no longer has an effective commercial enforcement authority.

Nevertheless, if the Commission considers that additional institutional assurances are needed to maintain its DPF adequacy decision, it need look no further than other potential enforcers of companies' DPF commitments: U.S. state attorneys general. They have consumer protection powers that substantially overlap with the FTC, developed considerable privacy enforcement experience and authority that is independent of the federal executive. Eligible state attorneys general could serve as supplemental DPF supervisors to provide an additional layer of institutional resilience.

Why FTC independence matters to the DPF

EU law requires the protection of personal data to be subject to oversight by independent supervisory authorities. This requirement is rooted in Article 8(3) of the EU Charter of Fundamental Rights. That provision states that data protection rights shall be subject to control by an independent authority and is reflected in Article 52 of the EU General Data Protection Regulation. Article 45(2)(b) GDPR also specifically requires consideration of supervisory authority independence in adequacy assessments. 

The Court of Justice of the European Union has treated protection against removal as an important component of independence. This concern is not limited to actual political interference. According to the CJEU, the possibility that a supervisory authority's mandate could be prematurely terminated may itself create external influence over the exercise of its functions, which in turn limits the authority's independence. For examples, see Commission v. Germany, C‑518/07 , which concerns freedom from external influence, and Commission v. Hungary, C‑288/12, on the premature termination of a supervisory authority head's mandate.

This explains why the Slaughter ruling potentially matters to the validity of the DPF. The Commission's adequacy decision expressly referred to the statutory restriction that only permits the removal of FTC commissioners for inefficiency, neglect of duty or malfeasance in office. After the ruling, the Commission no longer has the assurance it relied on when it assessed for independence.

Following the ruling, the potential for executive interference with FTC activities provides a reason to consider whether the DPF could draw on a broader set of public enforcement authorities. State attorneys general are particularly relevant because they exercise their authority outside the federal executive and may therefore provide an additional source of institutional assurance for the independent enforcement of DPF commitments.

The DPF already relies on general consumer protection authority

Although the FTC is the principal commercial enforcement authority under the DPF, its powers derive from Section 5 of the FTC Act, a consumer protection law which more broadly prohibits unfair or deceptive trade practices, rather than from DPF-specific powers. The FTC enforces compliance with the DPF through participating organizations' obligation to honor their public commitments to the DPF Principles The FTC treats noncompliance with the DPF Principles as evidence that an organization's representations about adhering to those principles were deceptive. This model has been found to be an adequate approach across three EU-U.S. data-sharing arrangements and has not been seriously questioned.

America's network of state privacy enforcers

State attorneys general operate within a comparable structure. They enforce state laws, often called "mini-FTC Acts," prohibiting unfair or deceptive acts and practices that apply to misleading statements and other unfair business conduct involving personal data.

Attorneys general have long used this authority to bring privacy enforcement actions involving representations about the collection and use of personal data, location tracking and the security of personal information. This enforcement activity has increased in recent years as states have enacted comprehensive privacy laws, data breach notification requirements and more targeted protections for particular categories and uses of personal information. These state laws have expanded the range of privacy issues subject to enforcement and, in some states, led the offices of attorneys general to develop dedicated privacy enforcement functions. 

State privacy enforcement has also become increasingly coordinated. The Consortium of Privacy Regulators, established in 2025, brings together enforcers from nine states to share expertise, resources and, where appropriate, coordinate investigations. The consortium formalizes a model of cooperation that allows participating offices to draw on expertise outside their own jurisdictions while continuing to enforce their respective state laws.

Most importantly for the post-Slaughter debate, state attorneys general do not exercise authority delegated by the president and are not subject to presidential removal. The substantial majority are popularly elected, although methods of selection and the relationship between them and the state executive vary by jurisdiction. 

The bottom line is that state attorneys general provide independence from the federal executive, possess effective consumer protection powers and have demonstrated privacy enforcement. Those features provide a strong basis for a supplemental enforcement role under the DPF.

How state attorneys general could join the DPF framework

The DPF Principles leave room for expanding its commercial oversight mechanism with supplemental enforcement authorities. To participate in the DPF, an organization must be subject to the investigatory and enforcement powers of the FTC, the Department of Transportation "or another statutory body that will effectively ensure compliance with the Principles." The DPF Principles also state that other U.S. statutory bodies recognized by the EU may be included in an annex in the future.

A possible model could begin with voluntary participation by attorneys general offices willing to assume defined DPF-related responsibilities. The Commission, working with relevant U.S. authorities, could assess prospective participants against minimum criteria. These might address the scope of the attorneys general statutory powers, institutional position, privacy enforcement experience, operational capacity, and ability to receive or act on complaints and referrals involving DPF commitments.

There would be no need to recognize every state simultaneously. Indeed, treating all attorneys general offices as interchangeable would obscure relevant differences in their institutional structures. A limited group of qualified and willing offices would provide a more credible starting point.

There would also need to be sufficient connection between a participating state and an organization subject to the attorney general's authority. Depending on the applicable law, the necessary nexus might arise from incorporation, an establishment in the state, substantial business activities, or conduct affecting consumers in the jurisdiction. 

One possible approach would allow organizations to identify a participating state attorney general when self-certifying, in the same manner they currently identify the FTC or Department of Transportation. The designated state attorneys general could serve as supplemental enforcers for organizations that fall within their state jurisdictions.

Under that approach, the FTC would remain the principal DPF enforcement authority for organizations within its jurisdiction. A recognized state attorney general could investigate or take action where both the organization and its conduct fall within the state's existing statutory authority. DPF-related complaints could be referred to an appropriate participating office through agreed channels.

This would treat state enforcement as an added safeguard rather than an alternative selected by the regulated organization. It would also preserve the FTC's existing role while adding independent enforcement capacity outside the federal executive.

The open questions

While state attorneys general have the authority to be effective enforcers of the DPF Principles and certification commitments, their ability to ultimate serve as effective supplemental supervisors is subject to at least three legal and operational questions that would need to be overcome.

First, their offices differ in powers and institutional arrangements. Consumer protection statutes vary in their scope, remedies and jurisdictional requirements, as do the responsibilities and resources of individual offices. Recognition under the DPF would therefore need to be based on the characteristics and authority of each participating in attorney general, with minimum criteria for determining which offices could qualify.

Second, any participating attorney general would need a sufficient jurisdictional basis to act. This may be less straightforward where a DPF complaint originates with an individual in the EU and has no obvious connection with residents of the relevant state. Depending on state law, jurisdiction may instead depend on the organization's presence or activities in the state or on conduct occurring within the jurisdiction. Recognition under the DPF could not itself expand an attorney general's existing authority.

Third, a multiagency model would require workable arrangements for referrals and coordination. DPF participants may fall within the jurisdiction of several state attorneys general as well as the FTC, while individual offices will have different resources and enforcement priorities. That said, the FTC and individual state attorney general often coordinate in jointly bringing cases under their respective consumer protection laws, and this model should translate to the DPF enforcement context as well.

These issues point toward a selective model based on existing state authority and a defined group of participating state attorneys general with the powers, independence, and capacity needed to assume a DPF enforcement role.

Federalism as a source of resilience

The implications of the Slaughter ruling should not be overstated: The FTC retains its enforcement powers and established role under the DPF, and the ruling does not, by itself, require changes to the framework.

To the extent the FTC's independence is challenged under the ruling, state attorneys general provide a credible option. Their existing consumer protection powers can reach privacy practices in much the same way as the FTC's Section 5 authority; many offices have developed substantial privacy enforcement experience. A supplemental role for state attorneys general could build on existing enforcement structures rather than require the creation of a new institution.

This position is not without practical difficulties. Differences in states' authority, jurisdictional limits and the need for workable coordination would require a selective and carefully structured approach. The DPF Principles nevertheless allow for the recognition of additional statutory enforcement bodies, providing a foundation for such a model if further institutional safeguards become necessary.

U.S. federalism is often viewed from Europe as a source of fragmentation in privacy law. After the Slaughter ruling, its institutional diversity may instead prove useful as a source of enforcement resilience.