If a US federal law creates a private right of action, say for a privacy or consumer protection tort, can the law authorize suit to be brought in a state court, particularly a small-claims court? If so, would specific state legislation to authorize such suits be required? Are there any kinds of cases for which this is currently allowed, or has been in the past?
The law works in the opposite direction of what you seem to be imagining. State courts generally have jurisdiction to hear lawsuits based on federal law, even without "authorization" from Congress. It is therefore perfectly normal to see lawsuits under Section 1983 , the Privacy Protection Act, or the Magnuson-Moss Consumer Protection Act being litigated in state court.
Instead, when Congress authorizes a private right of action, it includes explicit language when it does not want cases heard in state court. This is the case with copyright, patent, and bankruptcy litigation, for example.