Certified Information Privacy Professional / United States (CIPP/US)

Last checked November 10, 2026 against the official IAPP exam page.

1. Question 1Domain I - The U.S. Privacy Environment

   Compared with many other countries, which description best fits how the United States regulates the privacy of personal information held by private organizations?

   1. AA single comprehensive federal statute that governs all personal data in every industry sector
   2. BA licensing model in which every organization must register with a national data protection authority before processing personal data
   3. CA sectoral model with separate federal laws for health, finance, and children, plus state laws and general consumer protection enforcement
   4. DReliance almost entirely on international treaties that bind private companies directly and override domestic statutes in every sector of the economy
   Show answer and explanationHide answer

   Correct answer: C

   The United States generally takes a sectoral approach, with targeted federal laws for specific industries and data types, supplemented by state laws and FTC consumer protection enforcement. A single comprehensive federal statute, a national registration regime, and direct treaty binding of private companies do not describe the U.S. model.

2. Question 2Domain II - Federal Privacy Laws

   A health insurer's marketing department wants to send members a communication encouraging them to buy a third-party company's product, and the third party will pay the insurer for each communication sent. Under the HIPAA Privacy Rule as amended by HITECH, what is generally required?

   1. AApproval from the HHS Office for Civil Rights before each communication is sent to members
   2. BOnly a notice in the Notice of Privacy Practices, because marketing is a routine health care operation
   3. CA patient authorization that states the insurer will receive financial remuneration for the communication
   4. DNo action, because communications that mention products are treated as treatment communications
   Show answer and explanationHide answer

   Correct answer: C

   The Privacy Rule generally requires an individual's authorization for uses and disclosures of PHI for marketing, and where the covered entity receives financial remuneration from a third party for the communication, the authorization must state that. Marketing is not a routine operation, OCR does not pre-approve communications, and treatment-related communications for which no third-party payment is received fall under different exceptions.

3. Question 3Domain III - Government and Court Access to Private-sector Information

   Investigators want several weeks of historical cell-site location records from a wireless carrier to reconstruct a suspect's movements. Under the U.S. Supreme Court decision in Carpenter v. United States, what process is generally required?

   1. ANothing beyond the carrier's standard terms of service, since the customer shared the location data voluntarily
   2. BA subpoena issued by a prosecutor, because the carrier holds the records as part of its business
   3. CA National Security Letter, because the records relate to a criminal investigation rather than intelligence work
   4. DA warrant supported by probable cause, because the records reveal a detailed history of a person's movements
   Show answer and explanationHide answer

   Correct answer: D

   In Carpenter, the Court held that acquiring historical cell-site location records generally requires a warrant supported by probable cause, because the records reveal an intimate picture of a person's movements. Subpoenas, National Security Letters, and consent through terms of service do not meet that standard for this type of data.

4. Question 4Domain IV - Workplace Privacy

   A company's job application asks every applicant to list any prior arrests and convictions. The applicant's state has a law that prohibits employers from asking about criminal history on initial job applications. Which statement best describes the company's position?

   1. AThe company is compliant, because the state law restricts only background check vendors and not employers themselves
   2. BThe company is compliant, because federal law requires every applicant to disclose all prior convictions
   3. CThe company may be noncompliant, because the state law restricts criminal history questions on initial applications
   4. DThe company is compliant, because applicants agree to disclosure simply by submitting the application form
   Show answer and explanationHide answer

   Correct answer: C

   Ban-the-box laws limit when and how employers may ask about criminal history, often barring the question on initial applications. Submitting a form does not override a statutory prohibition, and federal law does not generally require applicants to disclose all prior convictions to private employers.

5. Question 5Domain V - State Privacy Laws

   A California consumer asks a business to delete the personal information it has collected about them. Under the CCPA as amended by the CPRA, which statement best describes the business's obligation?

   1. AThe business must delete the information within 24 hours of the request and may never retain any record that the request was received at all
   2. BThe business generally must delete the information, subject to statutory exceptions, and direct its service providers to do the same
   3. CThe business may refuse any deletion request from a consumer who has made a prior purchase from the business
   4. DThe business must delete the information only after the consumer pays a verification fee in advance
   Show answer and explanationHide answer

   Correct answer: B

   The CCPA gives consumers a right to request deletion, and businesses must delete covered personal information unless a statutory exception applies, and must also direct service providers and contractors to delete it. The other options invent a 24-hour deadline, a fee requirement, and a purchase-based denial that the statute does not impose.