CIPP/US
Who needs the CIPP/US? US privacy work, role by role
The United States has no single privacy law. It has sector laws for health, finance, education and children, an FTC that polices unfair and deceptive practices, breach notification laws set state by state, and a growing set of state consumer privacy laws that each draw their lines a little differently. The CIPP/US is the IAPP's credential for working inside that patchwork. This guide is about who uses it, role by role, the laws that create the work, and what the exam weights.
The facts here come from the IAPP's CIPP/US page, the CIPP/US Body of Knowledge, version 2.6.1, the IAPP's Certification Candidate Handbook and certification FAQs, the federal regulations on eCFR, California's CCPA pages, and our CIPP/US Exam Guide. Where this page and the IAPP differ, the IAPP wins; for any legal rule, the statute or regulation does.
What does the CIPP/US cover?
The IAPP says the CIPP/US proves a strong understanding of U.S. privacy laws and regulations, and describes it as ANAB-accredited. Its Body of Knowledge divides the exam into five domains and 16 competencies, with a range of items for each:
| Domain | Items | Competencies |
|---|---|---|
| I. The U.S. Privacy Environment | 27 to 33 | The U.S. legal framework (3 to 5); the enforcement framework (5 to 7); principles of information management from a U.S. perspective (18 to 22) |
| II. Federal Privacy Laws | 15 to 19 | The FTC and consumer protection; healthcare; financial services; education; telecommunications and marketing |
| III. Government and Court Access to Private-sector Information | 3 to 5 | Law enforcement; national security; civil litigation |
| IV. Workplace Privacy | 4 to 6 | Workplace privacy issues; issues before, during and after employment |
| V. State Privacy Laws | 17 to 21 | Authority behind state laws (1 to 2); key concepts and principles of state privacy and security laws (13 to 17); breach notification (2 to 4) |
Two competencies dominate the paper. Principles of information management from a U.S. perspective carries 18 to 22 items: the practical work of handling personal information that every privacy program does. The key concepts and principles of state data privacy and security laws carry 13 to 17. Between them they can account for nearly half the exam. The CIPP/US is less a test of statute names than a test of how US privacy work is done, and of how the state laws now shape it.
The federal domain is broad but shallow by comparison: each sector gets 1 to 5 items. That matches how sector law works in practice. A privacy professional in a hospital needs HIPAA in depth, one in a bank needs Gramm-Leach-Bliley, one at a school needs FERPA, and the exam asks each candidate to know the shape of all of them.
The enforcement competency explains how the patchwork is policed. The FTC acts against unfair or deceptive practices, and a common resolution is a consent decree: a legally binding settlement approved by a court or administrative body, under which a company can be required to submit to regular audits by an independent third party. State attorneys general enforce state laws, and in California a dedicated agency shares that role. Knowing which body acts, and what it can impose, is the starting point for most CIPP/US questions about consequences.
The smaller domains are concrete. Government and court access covers how law enforcement, national security agencies and civil litigants obtain private-sector data: stored communication content, for example, requires a warrant, a court order or a subpoena, and a FISA warrant is a judicial order from a secret court that can compel communication content, while a national security letter is an administrative subpoena an agency issues directly for metadata. A HIPAA covered entity that receives a subpoena cannot simply hand over protected health information. Workplace privacy covers the issues before, during and after employment, and our guide notes that a clear policy allowing monitoring defeats an employee privacy claim.
Who uses the CIPP/US?
US privacy law reaches almost every function that touches personal data, which is why the credential's audience is wide. Read against the competencies, the people who hold it fall into these roles:
| Role | What US privacy law asks of them | CIPP/US competencies that carry the day job | Pairs it with |
|---|---|---|---|
| Privacy counsel or in-house lawyer | Which laws apply, what they require, how to respond to regulators and litigants | I.A legal framework; I.B enforcement; III civil litigation; V state laws | CIPM |
| Privacy program or compliance manager | Notices, consumer requests, assessments, vendor terms | I.C information management; V.B state law principles | CIPM |
| Healthcare privacy officer | HIPAA authorizations, uses and disclosures, breach handling | II.B healthcare; V.C breach notification | CIPM |
| Financial services privacy or compliance | Gramm-Leach-Bliley notices and safeguards; state law exemptions | II.C financial services; V.B exemptions | CIPM or CRISC |
| Education privacy lead | FERPA rights, annual notices, directory information | II.D education | CIPM |
| Marketing or digital lead | Telemarketing, email and text rules; children's data; cookies and tracking under state law | II.A FTC; II.E telecommunications and marketing; V.B | CIPT |
| Security or incident response lead | Reasonable security duties; breach notification across states | I.C security; V.C breach notification | CISSP or CIPT |
| HR or people lead | Background checks, monitoring, employee records | IV workplace privacy | CIPM |
The pairings are our suggestion, not the IAPP's. The CIPP/US teaches what the law requires. The CIPM teaches how to run a program that meets it, and the CIPT how to build privacy into systems. Many privacy careers need the law first.
When does US privacy law put the work on your desk?
US privacy obligations switch on by sector, by state, by data type and by event. These are the moments that most often make the CIPP/US relevant.
A new state privacy law reaches the business
State consumer privacy laws share a family resemblance and differ in the details, and the details are what the exam and the job both test. Our guide sets out the differences that matter. The definition of a sale varies: some states count any exchange of personal data for monetary or other valuable consideration, while others restrict it to monetary consideration only. So a scenario in which two companies swap customer lists without money changing hands is a sale in Colorado and Connecticut, but not in Virginia or Utah. Several states prohibit processing sensitive data without the consumer's prior opt-in consent, several require an appeals process when a consumer request is denied, and all the state consumer privacy laws mandate reasonable security measures.
California enforces
California's law is enforced by two bodies. The California Privacy Rights Act created the California Privacy Protection Agency, which investigates violations of the California Consumer Privacy Act and shares enforcement authority with the California Attorney General. Our guide warns of one trap: assuming the agency replaced the Attorney General; it did not, and a question asking who enforces the CCPA wants both. California also gives consumers a private right of action where a failure to maintain reasonable security leads to a data breach.
A breach crosses state lines
Breach notification is set by state law, and each state's law protects its own residents. A company headquartered in one state that suffers a breach affecting residents of 14 states must comply with 14 distinct state breach notification statutes. The incident response plan has to be built for that, with the analysis of which states are affected done early.
The business is in a regulated sector
Sector law can take an organization partly outside the state laws. If a financial institution qualifies for an entity-level exemption under the Gramm-Leach-Bliley Act, the state privacy law does not apply to it. But exemptions are narrower than they look: a hospital whose clinical data falls under HIPAA may still run a general fitness app whose data, collected outside HIPAA's scope, remains subject to state privacy law. The sector specialist who knows where the exemption stops is the person the business needs.
A product collects data from children or students
COPPA protects children under 13, so a 12-year-old receives its protections and a 13-year-old falls outside them. FERPA's reach depends on funding from the US Department of Education: a private elementary school that receives no federal funding is outside it. A product team building for families or schools needs those lines drawn before launch.
What each situation asks of the Body of Knowledge
Here is the same ground turned into the work it creates. For each situation, the second column is the law that decides it, and the third is the CIPP/US competency that teaches it.
| Situation | The law that decides it | CIPP/US competency |
|---|---|---|
| Two companies swap customer lists, no money changes hands | The state's definition of a sale: valuable consideration in Colorado and Connecticut, monetary only in Virginia and Utah | V.B state law principles |
| A consumer's access request is denied | State laws that require an appeal process and instructions on how to appeal | V.B state law principles |
| A marketing team wants to use precise location data | State laws requiring opt-in consent for sensitive data | V.B state law principles |
| A breach affects residents of many states | Each affected state's breach notification statute | V.C breach notification |
| A hospital launches a consumer fitness app | HIPAA for clinical data; state privacy law for app data outside HIPAA's scope | II.B healthcare; V.B exemptions |
| A bank asks whether a state privacy law applies | The Gramm-Leach-Bliley entity-level exemption, where the state law provides one | II.C financial services; V.B |
| An app's users include 12-year-olds | COPPA: children under 13 | II.A FTC |
| A school asks about sharing student records | FERPA, if the school receives Department of Education funding | II.D education |
| A first-time deceptive privacy practice | FTC Section 5: typically a consent decree | I.B enforcement; II.A FTC |
We have turned the federal and state questions into a first-pass applicability checklist you can copy or download below.
US privacy law applicability checklist
US privacy law applicability checklist
Use this to make a first map of which US privacy laws reach a product, a dataset or a business line. It follows the structure of the IAPP CIPP/US Body of Knowledge: federal sector laws, then state laws. It is a planning aid, not legal advice; thresholds and exemptions decide coverage, so check each law's text.
Federal: who is regulating you?
- Consumer-facing practices: the FTC's authority over unfair or deceptive practices (Section 5)
- Health data held by a covered entity or business associate: HIPAA (45 CFR Part 164)
- A financial institution: the Gramm-Leach-Bliley Act and the FTC Safeguards Rule (16 CFR Part 314)
- Education records at a school that receives US Department of Education funding: FERPA (34 CFR Part 99)
- Online services collecting personal information from children under 13: COPPA (16 CFR Part 312)
- Telephone, text or email marketing: the TCPA and CAN-SPAM
- Consumer reports used for credit, employment or insurance decisions: the FCRA
State: whose residents are you dealing with?
- Which states' residents' data you process, and how many in each: ____________
- Whether each state consumer privacy law applies, given its thresholds and exemptions
- Entity-level or data-level exemptions (for example GLBA or HIPAA) checked state by state
- How each state defines a "sale" (monetary only, or other valuable consideration too)
- Sensitive data: which states require opt-in consent before processing it
- Consumer requests: response process, and an appeal process where the state requires one
- Data protection assessments: when each state makes one mandatory
- Who enforces each law (in California, the California Privacy Protection Agency and the Attorney General)
Breach
- Every state where affected residents live, because each state's breach notification law applies to its residents
- Whether any state gives consumers a private right of action for breaches
Where does the credential apply?
The CIPP/US is a credential about US law, but it is not only for people in the United States. Any organization with US customers, employees or patients meets US privacy law, and multinational privacy teams can need someone who can speak to it. The IAPP runs the exam at Pearson VUE test centers and online through OnVUE.
The rules underneath are a mix of federal statutes and regulations and state laws. The federal ones are published in the Code of Federal Regulations: the HIPAA Privacy and Security Rules in 45 CFR Part 164, the Children's Online Privacy Protection Rule in 16 CFR Part 312, the FTC's Safeguards Rule for financial institutions in 16 CFR Part 314, and FERPA's regulations in 34 CFR Part 99. State laws come from each state's legislature, with regulators such as the California Privacy Protection Agency adding rules of their own. The CIPP/US teaches how those layers fit together; the current text of each is the authority.
The first state-law competency, on concepts of authority, is about that fit. It asks candidates to understand the relationship between federal and state authority in privacy, including the roles of state attorneys general and the California Privacy Protection Agency. In practice that is the question a privacy lead answers first for any new obligation: is this a federal rule, a state rule, or both, and who will enforce it?
What the CIPP/US is not
It is not a law degree. It shows knowledge of US privacy law and practice. It does not entitle anyone to practice law.
It is not a fixed list of state laws. State privacy law can change in any legislative session. The exam tests the concepts and principles the laws share and the differences that matter; the job means tracking the laws as they change.
It is not a security credential. Security appears throughout, from reasonable security duties to breach notification, but the CIPP/US tests what the law requires of security, not how to engineer it. A security engineer who needs the technical side should look at the CIPT or a security credential.
It is not a European credential. The GDPR is a different system, with a single regulation and supervisory authorities. For it, the IAPP offers the CIPP/E.
It is not a program management credential. Knowing what the law requires is different from building the program that meets it. That is the CIPM's subject.
What does it take to earn and keep?
| Item | The IAPP's rule |
|---|---|
| Accreditation | ANAB-accredited designation |
| Exam | 90 questions in 2.5 hours, at a Pearson VUE test center or online through OnVUE |
| Pass | 300 on a scale of 100 to 500 |
| Fee | USD 550, the same for members and non-members; USD 375 if you have attempted the exam before or hold another IAPP certification |
| Upkeep | IAPP membership or a certification maintenance fee, and continuing privacy education under the IAPP's CPE policy |
The full fee and exam-day detail, with study plans of 30, 45 or 60 hours built on the item ranges, is on our CIPP/US exam page.
How does it compare with the credentials around it?
| CIPP/US | CIPP/E | CIPM | CIPT | |
|---|---|---|---|---|
| The question it answers | What does US privacy law require? | What does European data protection law require? | How do we run a privacy program? | How do we build privacy into technology? |
| Suits | Counsel, privacy and compliance staff, sector specialists working on US law | DPOs, counsel and anyone handling EU personal data | Program managers and privacy leads | Engineers, architects, product and security people |
| Scale and pass mark | 100 to 500, with 300 to pass | |||
The IAPP's credentials are designed to stack. A US privacy counsel may take the CIPP/US and then the CIPM; a global privacy lead may hold both CIPP/US and CIPP/E; a privacy engineer may pair the CIPT with enough law to know what to build. For the European side, see our CIPP/E exam page; for the program side, the CIPM exam page.
What will the exam expect of you?
The CIPP/US has 90 questions in 2.5 hours, 1 minute 40 seconds a question on average, with a pass mark of 300 on the IAPP's scale of 100 to 500. The questions reward precise lines: who a law covers, what it requires, who enforces it and what the penalty is.
Our guide is built around those lines. A HIPAA authorization must be a specific written document containing required core elements and a signature, so a standard website cookie banner does not satisfy HIPAA. A company only needs a privacy policy if a specific law, such as COPPA or a state statute, demands it. A first-time Section 5 or COPPA violation typically produces a consent decree, and in COPPA's case a financial penalty too. A public university hospital treating non-student members of the public follows HIPAA for those patients. Each is the kind of distinction a wrong option is built from.
A practical habit follows from those examples. Before you read the options, find the fact in the stem that decides coverage: the user's age for COPPA, the school's funding for FERPA, whether the organization is a covered entity or business associate for HIPAA, whether it qualifies for an entity-level exemption, and which states the affected people live in. Most CIPP/US scenarios turn on one of those facts, and the wrong options are often correct statements about a law that does not apply.
Test yourself with the CIPP/US quiz, see the domains on one page in the CIPP/US mind map, and if the credential is part of a job move, the CIPP/US interview questions page covers what employers ask.
How to prepare
Start from the Body of Knowledge, which is what the exam is written to, and weight your time to the item ranges. With two competencies carrying nearly half the paper, information management principles and state law principles deserve the most hours. The federal sector laws need breadth more than depth, unless your own job sits in one of those sectors.
The CIPP/US Exam Guide (Wikidata) has 20 chapters across 587 pages, mapped to all five domains and all 16 competencies, from the U.S. legal framework to state breach notification laws, and weighted to the published item counts. It teaches from the statutes themselves rather than from summaries of them, and every claim traces to a primary document.
The CIPP/US Practice Questions (Wikidata) has 200 questions weighted to the published item counts, each with a rationale that says why the right answer is right and why every wrong option fails. The answer letters are spread evenly across A, B, C and D on purpose, because an uneven key teaches a habit that scores nothing on the day.
Use the practice questions as a diagnostic. Take a first set early and note your score by domain. State laws and information management are where most of the points are, so a weak score there costs more than a weak score on government access. Read every rationale, including for the questions you got right: in a law-heavy exam, the right answer for the wrong reason fails on the next question that changes one fact.
Is it current? Both books follow Body of Knowledge 2.6.1, effective 1 September 2025. State privacy law changes faster than any Body of Knowledge, so check any state rule you rely on against the current statute and the regulator's guidance.
If you plan 60 hours, the midpoints of the item ranges suggest roughly 24 hours for the U.S. privacy environment, 14 for federal laws, 3 for government and court access, 4 for workplace privacy and 15 for state laws. Then move hours toward whatever your job does not touch: a healthcare privacy officer already knows HIPAA and needs more time on state laws; a marketing lead may need more time on the sector laws.
So, do you need the CIPP/US?
Take it if US privacy law is part of your job, as counsel, a privacy or compliance lead, a sector specialist, or the security, marketing, HR or product person who keeps getting the privacy questions. It is the IAPP's credential for the patchwork, and the patchwork is where the work is. Take it especially if your organization is meeting new state privacy laws, because the concepts and the differences between states are the largest part of what the exam teaches.
It also suits someone moving into privacy from another field. A security analyst, a compliance officer or a marketing operations lead who has been handling privacy questions informally will find the Body of Knowledge turns scattered experience into a map of the law, with the gaps marked.
Look at the CIPP/E instead if your work is mostly European, the CIPM if you already know the law and need to run the program, and the CIPT if you build the systems. For most people doing privacy work in the United States, though, the CIPP/US is the place to start.
Questions people ask about the CIPP/US
Who is the CIPP/US for?
People who work on privacy under US law: privacy counsel and in-house lawyers, privacy and compliance managers, sector specialists in healthcare, finance and education, and the security, marketing, HR and product people whose work US privacy law reaches. The IAPP says the CIPP/US proves a strong understanding of U.S. privacy laws and regulations.
What does the CIPP/US cover?
Five domains in Body of Knowledge 2.6.1: the U.S. privacy environment (27 to 33 items), federal privacy laws (15 to 19), government and court access to private-sector information (3 to 5), workplace privacy (4 to 6) and state privacy laws (17 to 21).
How many questions are on the CIPP/US exam?
The IAPP's certification FAQs give the CIPP/US as 90 questions in 2.5 hours. You sit at a Pearson VUE test center or online through OnVUE.
What is the CIPP/US passing score?
300 on the IAPP's scale of 100 to 500.
How much does the CIPP/US cost?
USD 550 on the IAPP Store, the same for members and non-members, or USD 375 if you have attempted the exam before or hold another IAPP certification. After you pass, a maintenance fee or IAPP membership keeps it active.
Does the CIPP/US cover state privacy laws?
Yes, heavily. State privacy laws are 17 to 21 items, and the largest single competency in the domain, the key concepts and principles of state data privacy and security laws, carries 13 to 17 items on its own.
Is the CIPP/US only for lawyers?
No. Many of its topics are operational: notices, consumer requests, breach notification, vendor management, workplace monitoring and marketing rules. Lawyers take it, but so do privacy, security, compliance and product professionals.
CIPP/US or CIPP/E?
The CIPP/US covers US federal and state privacy law; the CIPP/E covers European data protection law, chiefly the GDPR. An organization operating on both sides of the Atlantic may want people with both.
CIPP/US or CIPM?
The CIPP/US is about what US law requires. The CIPM is about running the privacy program that meets those requirements. One sensible order is the law first and the program second.
Which CIPP/US Body of Knowledge is current?
Version 2.6.1, effective 1 September 2025. Check the IAPP's CIPP/US page before you book.
CIPP/US: test yourself in five minutes
Which books prepare you for the CIPP/US exam?
Certified Information Privacy Professional, United States. 20 chapters, 587 pages.
Practice questions with full rationales, weighted to the published blueprint. 217 pages.
How to credit this page
Using a figure or a passage from this page in an article, a course, a forum answer or AI-generated text? Please credit Credential Press and link to this page, so your readers can check the source and the date it was reviewed. Copy a ready-made citation:
Plain text
Markdown
HTML
Sources
- IAPP, CIPP/US: Certified Information Privacy Professional/United States
- IAPP, CIPP/US Body of Knowledge and Exam Blueprint, version 2.6.1, effective 1 September 2025
- IAPP, Certification Candidate Handbook: scoring scale and passing score
- IAPP, Certification FAQs: exam length
- California Attorney General, California Consumer Privacy Act (CCPA)
- California Privacy Protection Agency, Regulations
- eCFR, 45 CFR Part 164 (HIPAA Security and Privacy)
- eCFR, 16 CFR Part 312 (Children's Online Privacy Protection Rule)
- eCFR, 16 CFR Part 314 (Standards for Safeguarding Customer Information)
- eCFR, 34 CFR Part 99 (Family Educational Rights and Privacy)
- US Department of Education, Student Privacy: FERPA
Credential Press is not affiliated with, endorsed by or authorized by the IAPP. CIPP/US, CIPP/E, CIPM and CIPT are trademarks of the International Association of Privacy Professionals. This page is not legal advice.