"language in the constitution that authorizes the federal government to set privacy or cybersecurity standards." Article I, Section 8. Easy one....basic 101 level stuff. Unless you're going to make some goofball "originalist' argument or claim with a straight face that doing business through the web or other forms of connectivity to everyone in your business's communication or supply chain or customers isn't related to interstate commerce.

As for your argument that most businesses don't cross state lines .... what businesses exactly do you think don't engage in interstate (or international) commerce? There is very little that is truly local any more. Especially where the vast majority of people actually live. And unless you take payment only via cash through walk-ins, you're wading into federally regulated activity.

Really hard to take posts like this seriously, no offense.

Regarding whether it's better to have a single federal or multiple state regulators, you're not wrong there, but that wasn't really my point. My point was the large states can impose their REALLY extreme views on everyone in business where there isn't federal preemption or a federal mandate. Cyber and privacy are two very recent examples, but If your'e familiar with the lending industry, there has been a race to partner wtih banks who get preemption from multi-state licenses and usury caps too. A whole lot of examples I can think of. And again....anyone doing business via the web sacrifices a LOT to exclude states like California.