PracticeVideosBlogFlashcardsEspañol
All Practice Exams

Free Practice Questions for CIPP/US

Exam-style questions and explanations by OpenExamPrep.

✓ No registration✓ No credit card
200+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More IAPP Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

AIGP

Practice QuestionsStudy GuideCheat SheetFlashcards1 video1 blog

CIPP/E

Practice QuestionsStudy GuideCheat SheetFlashcards1 video1 blog

CIPM

Practice QuestionsStudy Guide

CIPT

Practice Questions1 video1 blog

IAPP Certified Data Protection Officer — Brazil (CDPO/BR)

Practice Questions

IAPP Certified Data Protection Officer — France (CDPO/FR)

Practice Questions

More From This Family

Videos and articles for deeper review.

VideoAIGP Exam Guide 2026: FREE IAPP AI Governance PrepArticleAIGP Exam Guide 2026: FREE IAPP AI Governance Prep28 min read
Exam Review

Key Facts: CIPP/US Exam

90

Exam Questions

IAPP Store

2.5 hrs

Exam Time

IAPP Store

300/500

Passing Score

IAPP Certification FAQs

$550

Exam Fee

IAPP Store

15 min

Scheduled Break

IAPP Store

1 year

Use Window

IAPP Store

The CIPP/US exam uses a 90-question, 2.5-hour Pearson VUE format with a scheduled 15-minute break and a scaled passing score of 300/500. The heaviest blueprint coverage is The U.S. Privacy Environment and State Privacy Laws, and 2026 prep should include Indiana, Kentucky and Rhode Island going live on Jan. 1, 2026 plus California CPPA and Delete Act milestones.

Sample CIPP/US Practice Questions

Try these sample questions to review concepts for the CIPP/US exam. Each question includes a detailed explanation. Start the interactive quiz above for the full 200+ question experience with AI tutoring.

1How is the U.S. privacy model most often described in contrast to the EU approach?
A.A sectoral model built from overlapping federal, state, and common-law rules
B.A single omnibus statute enforced by one national privacy authority
C.A constitutionally unified privacy code that applies only to public agencies
D.A treaty-based model that automatically incorporates foreign privacy law
Explanation: The United States generally uses a sectoral privacy approach rather than one omnibus private-sector statute. Privacy obligations are spread across federal sectoral laws, state statutes, agency enforcement, contracts, and common-law doctrines.
2Which common-law privacy tort is most closely associated with intentional invasion of someone's private space or affairs?
A.False light
B.Intrusion upon seclusion
C.Public disclosure of private facts
D.Appropriation of name or likeness
Explanation: Intrusion upon seclusion focuses on the act of prying into private affairs in a manner highly offensive to a reasonable person. It does not require broad publication of the information obtained.
3Why is contract law important in U.S. privacy compliance?
A.Because contracts automatically replace all privacy statutes
B.Because privacy notices, vendor terms, and representations can create binding obligations and enforcement risk
C.Because private contracts can eliminate agency jurisdiction
D.Because contract law applies only to international data transfers
Explanation: In the United States, privacy promises often appear in consumer notices, online terms, and vendor agreements. If those promises are misleading or broken, they can create breach claims or trigger regulatory enforcement, especially under FTC deception theories.
4What is the FTC's core private-sector privacy enforcement hook in the absence of a general federal privacy statute?
A.Section 5 of the FTC Act covering unfair or deceptive acts or practices
B.The Privacy Act of 1974
C.The First Amendment
D.The Freedom of Information Act
Explanation: The FTC relies heavily on Section 5 of the FTC Act to police unfair or deceptive acts or practices. That authority has made the agency a central privacy and data-security enforcer for much of the private sector.
5Which regulator is most directly associated with HIPAA Privacy Rule enforcement?
A.The FTC
B.The FCC
C.HHS Office for Civil Rights
D.The CFPB
Explanation: HHS Office for Civil Rights enforces the HIPAA Privacy, Security, and Breach Notification Rules. The FTC and state attorneys general can also matter in health-privacy matters, but OCR is the main HIPAA regulator.
6What is the main purpose of a data inventory in a privacy program?
A.To eliminate the need for contracts with vendors
B.To identify what data the organization has, where it resides, and how it flows
C.To guarantee that all data is exempt from breach notice laws
D.To replace records retention schedules
Explanation: A data inventory helps an organization understand what personal data it collects, where the data is stored, how it moves, and who uses it. That foundation supports notices, retention, incident response, data subject rights handling, and vendor oversight.
7Which statement best describes data minimization?
A.Collect and retain all available data until legal risk is fully known
B.Limit collection, use, and retention to what is reasonably necessary for disclosed purposes
C.Encrypt every record before collecting it
D.Store all customer data only on local servers
Explanation: Data minimization means collecting and keeping only the data reasonably needed for a legitimate purpose. It reduces compliance burden, breach exposure, and risk from secondary uses that exceed what people were told to expect.
8A company keeps customer identity documents forever because storage is cheap. Which privacy principle is most directly undermined?
A.Storage limitation and retention governance
B.Source-code escrow
C.Trade-secret privilege
D.Open records compliance
Explanation: Cheap storage does not justify indefinite retention of personal data. Sound privacy programs use retention schedules tied to legal, operational, and business need, then dispose of data when that need ends.
9Which activity is most useful for understanding vendor-related privacy risk?
A.Sending every vendor the same generic marketing deck
B.Performing due diligence on the vendor's data uses, controls, and subcontracting before sharing personal data
C.Asking the vendor to promise orally that it is secure
D.Skipping review if the vendor is already well known in the industry
Explanation: Vendor due diligence helps determine whether a third party's practices match the organization's privacy and security obligations. It should cover data use limits, security, retention, incident reporting, and subcontractor controls.
10What best distinguishes privacy from security?
A.Privacy concerns why and how data is handled; security concerns protecting data against unauthorized access or misuse
B.Privacy applies only to paper records; security applies only to electronic records
C.Privacy is voluntary; security is mandatory
D.Privacy is a technical function; security is purely legal
Explanation: Privacy focuses on governance of personal data: collection, use, disclosure, rights, and expectations. Security focuses on safeguards that protect that data from unauthorized access, alteration, destruction, or disclosure.

About the CIPP/US Exam

The CIPP/US is the IAPP credential focused on U.S. private-sector privacy law. It tests the U.S. privacy environment, federal privacy laws, government and court access, workplace privacy, and fast-moving state privacy law developments.

Exam sponsor: IAPP / Pearson VUE. The requirements and fees below concern the certification or admission exam, separate from our free practice resources.

Assessment

90 multiple-choice questions with a scheduled 15-minute break halfway through the exam

Time Limit

2.5 hours

Passing Score

300/500

Exam / Certification Fees

$550

Exam sponsor website

Fees, eligibility, and exam policies can change. Confirm them with the exam sponsor before applying or paying.

Our practice resources: topics covered

We aim to reflect publicly available exam outlines and topic information in our study resources. Coverage, format, and difficulty may differ from the actual exam, and we cannot guarantee that every detail is accurate or current. Confirm exam requirements, fees, and policies with the official exam sponsor.

27-33 questions

The U.S. Privacy Environment

Legal framework, privacy concepts, regulators and enforcement, privacy governance, information life-cycle controls, vendor management, online tracking, and cross-border transfer mechanisms.

15-19 questions

Federal Privacy Laws

FTC unfair/deceptive practices, health privacy, financial privacy, education privacy, children and media privacy, telecommunications and marketing rules, and sector-specific federal statutes.

3-5 questions

Government and Court Access to Private-sector Information

Law-enforcement access, national security authorities, civil discovery, e-discovery obligations, and legal process affecting records held by private organizations.

4-6 questions

Workplace Privacy

Employee monitoring, screening, internal investigations, discrimination and disability limits, workplace biometrics and location tracking, and post-employment records handling.

17-21 questions

State Privacy Laws

California privacy law, comprehensive state privacy statutes, consumer health data laws, biometrics, AI and automated decision rules, breach notification, and current 2026 state updates.

Preparing for the CIPP/US Exam

What You Need to Know

  • Passing score: 300/500
  • Assessment: 90 multiple-choice questions with a scheduled 15-minute break halfway through the exam
  • Time limit: 2.5 hours
  • Exam / certification fees: $550 Official sources

Using Our Practice Resources

  • Work through all 200 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

CIPP/US: Suggested Study Strategy

1Study the official IAPP body of knowledge and blueprint together so you know both the topic list and the relative question ranges.
2Prioritize the U.S. Privacy Environment and State Privacy Laws first because those are the heaviest parts of the exam.
3Build comparison charts for HIPAA vs. GLBA vs. FCRA vs. COPPA vs. FERPA vs. TCPA so you can spot scope, rights and enforcement differences quickly.
4Practice California distinctions carefully: sale vs. sharing, service provider vs. contractor vs. third party, CPPA enforcement, and Delete Act timelines.
5Do not ignore workplace privacy and government-access questions just because they are smaller domains; they are usually highly specific and scenario driven.
6Stay current on late-2025 and 2026 developments because IAPP explicitly expects candidates to know important new privacy changes that may modify the authoritative texts.

Frequently Asked Questions

What is the CIPP/US exam format?

The CIPP/US exam has 90 multiple-choice questions and a 2.5-hour testing window. IAPP also schedules a 15-minute break halfway through the exam. Testing is delivered through Pearson VUE at test centers or through OnVUE remote proctoring.

What score do I need to pass CIPP/US?

All IAPP exams use a 100-500 reporting scale, and the passing score is 300. IAPP notes that 300 does not represent 60% correct because raw scores are converted to the common scale after psychometric analysis.

Are there prerequisites for the CIPP/US exam?

No formal degree or work-experience prerequisite is required to sit for the CIPP/US exam. IAPP does recommend meaningful preparation time, and its certification process page recommends at least 30 hours of study or training for each certification.

Which domains matter most on the CIPP/US blueprint?

The official blueprint gives the largest question range to The U.S. Privacy Environment at 27-33 questions. State Privacy Laws comes next at 17-21 questions, followed by Federal Privacy Laws at 15-19 questions. Government and court access plus workplace privacy are smaller but still testable domains.

Which 2026 updates should CIPP/US candidates know?

As of March 9, 2026, candidates should know that Indiana, Kentucky and Rhode Island comprehensive privacy laws are now effective, Oregon has Jan. 1, 2026 amendments in force, California CPPA regulations on risk assessments, cybersecurity audits and ADMT became effective Jan. 1, 2026, and California's data broker DROP launched Jan. 1, 2026 with 45-day deletion processing starting Aug. 1, 2026.

How should I study for CIPP/US?

Start with the U.S. privacy environment because it underpins the rest of the exam, then work through state laws and the federal sectoral statutes that are most frequently compared in practice. Mix doctrinal study with scenario questions so you can distinguish similar rules, agency roles, and exemptions under time pressure.