State laws cannot regulate interstate trade. That is a violation of the Interstate Commerce clause.

In IMS case that means that they can buy from any state but their own (if that state regulates privacy of data), and an attempt by other states to prevent the trading of the data will fail in front of teh Supreme Court.

I predict that the case of IMS/Ayotte will reappear there with that argument.