IAPP CIPP-US Practice Exams
Last updated on Oct 22,2026- Exam Code: CIPP-US
- Exam Name: Certified Information Privacy Professional/United States (CIPP/US)
- Certification Provider: IAPP
- Latest update: Oct 22,2026
What was the original purpose of the Foreign Intelligence Surveillance Act?
- A . To further define what information can reasonably be under surveillance in public places under the USA PATRIOT Act, such as Internet access in public libraries.
- B . To further clarify a reasonable expectation of privacy stemming from the Katz v. United States decision.
- C . To further define a framework for authorizing wiretaps by the executive branch for national security purposes under Article II of the Constitution.
- D . To further clarify when a warrant is not required for a wiretap performed internally by the telephone company outside the suspect’s home, stemming from the Olmstead v. United States decision.
Chanel Hair Studio is a busy high-end hair salon. In an effort to maximize efficiency of its operations and reduce wait times for appointments, Chanel decides to implement artificial intelligence software that will use client profiles and history to predict which clients will likely be late for their appointments. Information used to create the client profile included appointment history, distance from the salon, and any references to being tardy pulled from the client’s social media accounts. If a client is predicted to be late, their appointment will be cancelled within 5 minutes.
Based on the details, what is the biggest potential privacy concern related to Chanel’s use of this new software?
- A . Scanning a client’s social media accounts to use in a client profile without notice to the client.
- B . Calculating client profile address distance from the salon to determine location from salon to help predict if the client will be late.
- C . Using client profile information for any purpose other than setting up an appointment.
- D . Assessing client tardiness history with the salon for predictive purposes.
In 2014, Google was alleged to have violated the Family Educational Rights and Privacy Act (FERPA) through its Apps for Education suite of tools. For what specific practice did students sue the company?
- A . Scanning emails sent to and received by students
- B . Making student education records publicly available
- C . Relying on verbal consent for a disclosure of education records
- D . Disclosing education records without obtaining required consent
Which of the following conditions would NOT be sufficient to excuse an entity from providing breach notification under state law?
- A . If the data involved was encrypted.
- B . If the data involved was accessed but not exported.
- C . If the entity was subject to the GLBA Safeguards Rule.
- D . If the entity followed internal notification procedures compatible with state law.
Due to cookie deprecation, businesses will be required to simplify their tracking practices by doing what?
- A . Ensuring only registered users are tracked.
- B . Running analytics only in dedicated sandboxes
- C . Purging existing IDs that identify visitors by browser.
- D . Deleting their existing data sets of any third-party cookies
SCENARIO
Please use the following to answer the next QUESTION
Felicia has spent much of her adult life overseas, and has just recently returned to the U.S. to help her friend Celeste open a jewelry store in California. Felicia, despite being excited at the prospect, has a number of security concerns, and has only grudgingly accepted the need to hire other employees. In order to guard against the loss of valuable merchandise, Felicia wants to carefully screen applicants. With their permission, Felicia would like to run credit checks, administer polygraph tests, and scrutinize videos of interviews. She intends to read applicants’ postings on social media, ask QUESTION NO:s about drug addiction, and solicit character references. Felicia believes that if potential employees are serious about becoming part of a dynamic new business, they will readily agree to these requirements.
Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check the company vehicle’s GPS for locations visited by employees. She also believes that employees who use their own devices for work-related purposes should agree to a certain amount of supervision.
Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that many types of background checks are not allowed under California law. Her friend Celeste thinks these worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results. Nor does Celeste share Felicia’s concern about state breach notification laws, which, she claims, would be costly to implement even on a minor scale. Celeste believes that even if the business grows a customer database of a few thousand, it’s unlikely that a state agency would hassle an honest business if an accidental security incident were to occur.
In any case, Celeste feels that all they need is common sense C like remembering to tear up sensitive documents before throwing them in the recycling bin. Felicia hopes that she’s right, and that all of her concerns will be put to rest next month when their new business consultant (who is also a privacy professional) arrives from North Carolina.
Regarding credit checks of potential employees, Celeste has a misconception regarding what?
- A . Consent requirements.
- B . Disclosure requirements.
- C . Employment-at-will rules.
- D . Records retention policies
Which of the following data elements is most likely to be subject to comprehensive state data security and privacy laws?
- A . Account holders’ social security numbers, maintained by a bank.
- B . Users’ sexual orientations, maintained by a social media website
- C . Individual drivers’ license numbers, maintained by a state agency.
- D . Contact details of individuals who report emergencies, maintained by local authorities
The Video Privacy Protection Act of 1988 restricted which of the following?
- A . Which purchase records of audio visual materials may be disclosed
- B . When downloading of copyrighted audio visual materials is allowed
- C . When a user’s viewing of online video content can be monitored
- D . Who advertisements for videos and video games may target
A law enforcement subpoenas the ACME telecommunications company for access to text message records of a person suspected of planning a terrorist attack. The company had previously encrypted its text message records so that only the suspect could access this data.
What law did ACME violate by designing the service to prevent access to the information by a law enforcement agency?
- A . SCA
- B . ECPA
- C . CALEA
- D . USA Freedom Act
A company based in United States receives information about its UK subsidiary’s employees in connection with the centralized HR service it provides.
How can the UK company ensure an adequate level of data protection that would allow the restricted data transfer to continue?
- A . By signing up to an approved code of conduct under UK GDPR to demonstrate compliance with its requirements, both for the parent and the subsidiary companies.
- B . By revising the contract with the United States parent company incorporating EU SCCs, as it continues to be valid for restricted transfers under the UK regime.
- C . By submitting to the ICO a new application for the UK BCRs using the UK BCR application forms, as their existing authorized EU BCRs are not recognized.
- D . By allowing each employee the option to opt-out to the restricted transfer, as it is necessary to send their names in order to book the sales bonuses.