A candidate faces a CIPP/US exam question about a healthcare app sharing user data with a third-party marketer without consent. They correctly recall HIPAA's restrictions on Protected Health Information. But the question asks for the legal basis of an FTC enforcement action. The candidate chooses the HIPAA violation, overlooking the FTC's broad authority under Section 5 to police "unfair and deceptive" practices, which is the more direct answer for an FTC case. This is the classic CIPP/US trap: knowing a specific law isn't enough. You must know the entire legal framework and which authority applies where.
The U.S. legal structure for the CIPP/US exam is a hierarchy. The Constitution sets limits on government, followed by statutory laws from Congress and states (where federal law often preempts state law), then administrative regulations from agencies like the FTC, and finally common law created by court decisions (torts and contracts).
Key facts
- Official Body
- IAPP (International Association of Privacy Professionals)
- Exam Domain
- This content covers Domain I: Introduction to the U.S. Privacy Environment.
- Exam Format
- 90 multiple-choice questions over 2.5 hours (150 minutes).
- Recommended Study Hours
- 60-100 hours for most candidates.
- Key Authorities
- Federal Trade Commission (FTC), Dept. of Health & Human Services (HHS), State Attorneys General.
- Governing Document
- The CIPP/US Body of Knowledge and Glossary of Privacy Terms.
How Does the U.S. Legal Hierarchy Work for Privacy Law?
The first domain of the CIPP/US exam tests your understanding of the U.S. legal system's architecture. It’s not about memorizing case law; it’s about building a mental flowchart to determine which rule applies in any given scenario. Misunderstanding this hierarchy is the single fastest way to get a question wrong, even if you know the facts.
The system is layered. Each layer has a different source, scope, and level of authority. Your job on the exam is to correctly identify the controlling source of law for the situation presented.
Studying for CIPP/US? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
To make this concrete, here is a breakdown of the primary sources of U.S. privacy law, from highest to lowest authority.
| Source of Law | Created By | Applies To | CIPP/US Example |
|---|---|---|---|
| Constitutional Law | U.S. & State Constitutions | Primarily government actions | Fourth Amendment search and seizure rules. |
| Statutory Law | Legislative bodies (Congress, State Legislatures) | Government and/or private sector | HIPAA, CCPA, state data breach laws. |
| Administrative Law | Executive agencies (FTC, HHS) | Private sector within agency's jurisdiction | The FTC's enforcement of Section 5. |
| Common Law | Judicial decisions (courts) | Private parties in disputes | A lawsuit for "public disclosure of private facts." |
Let's break down each of these layers. You can test your understanding of these frameworks with a set of exam-calibrated CIPP/US practice questions.
Constitutional Law
This is the supreme law. The U.S. Constitution (and to a lesser extent, state constitutions) establishes fundamental rights. For privacy, the key takeaway is that these rights, like the Fourth Amendment's protection against unreasonable searches, are a shield against government intrusion.There are rare exceptions, such as when a private company acts as an agent of the government, but the default rule is: Constitution limits the government.
Statutory Law
These are the laws you spend the most time studying. Statutes are written laws passed by legislative bodies.- Federal Statutes: Congress passes these laws, which apply nationwide. Examples include HIPAA (healthcare), GLBA (financial services), and COPPA (children's online privacy).
- State Statutes: State legislatures pass these. Every state has a data breach notification law, and many, like California (CCPA/CPRA), have comprehensive privacy statutes.
A critical concept here is preemption. If a federal and state law conflict, the federal law generally wins. However, many federal privacy laws set a floor, not a ceiling. States are often free to pass laws that provide greater privacy protection, as long as they don't directly undermine the federal law.
Administrative Law
This is a source of law that many candidates overlook. Congress often passes broad statutes and delegates the authority to implement and enforce them to federal agencies. These agencies (like the FTC or HHS) create specific rules and regulations that have the force of law.The most important example for the CIPP/US is the Federal Trade Commission (FTC). Section 5 of the FTC Act gives the agency broad power to police "unfair and deceptive acts or practices." The FTC has used this authority to become the de facto top privacy and data security enforcer in the U.S.
Common Law
Common law is judge-made law. It develops over time through court decisions that set precedents. It’s flexible and fills the gaps where no statute exists. For privacy, common law is the source of the four major privacy torts:- Intrusion Upon Seclusion: Intruding into someone's private affairs (e.g., bugging their office).
- Public Disclosure of Private Facts: Publicizing non-newsworthy private information.
- False Light: Portraying someone in a misleading and highly offensive way.
- Appropriation of Name or Likeness: Using someone's identity for commercial purposes without permission.
Contract law also falls under this umbrella. Privacy promises made in a company's terms of service or a contract are legally enforceable.
Calculate Your CIPP/US Score & Study Hours by Domain
Adjust your practice scores across official CIPP/US blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
Worked Example: Pinpointing the Right Legal Basis
Let's return to the DataGuard Inc. data breach scenario from the original article. A cloud provider has a breach affecting 5 million customers across all 50 states.
The question asks for the most direct and highest-priority legal obligation for DataGuard Inc.
- A. A customer suing for "intrusion upon seclusion" under common law.
- B. DataGuard's obligation to notify customers under state data breach notification statutes.
- C. Potential FTC penalties for unfair practices under the FTC Act.
- D. A claim of a Fourth Amendment constitutional violation.
Here is how to think like the examiner.
Step 1: Eliminate the Clearly Wrong Answer
Option D is the easiest to discard. The Fourth Amendment restricts the government, and DataGuard is a private company. This is a classic distractor.
Step 2: Compare the Remaining Valid Options
Options A, B, and C are all plausible legal consequences of a breach. Now you must rank them based on the question's prompt: "most direct and highest-priority legal obligation."
- Option A (Common Law Tort): A customer could sue. But this is a potential, individual legal action that requires proving specific harm. It is not a direct, automatic obligation placed on the company itself.
- Option C (FTC Action): The FTC will likely investigate. This is a major risk. However, it is a subsequent regulatory enforcement action, not an immediate, self-executing duty. The company's obligation is to have reasonable security; the FTC penalty comes later if they failed.
- Option B (Statutory Notification): Every single U.S. state has a law requiring companies to notify affected individuals (and often the state attorney general) after a data breach. This is a direct, affirmative, and immediate legal obligation triggered by the event itself. It's not optional or subsequent. It is the first thing the company must do.
Step 3: Select the Best Fit
Option B is the most precise answer. It describes a specific, mandatory action required by statutory law in all relevant jurisdictions, making it the most direct and highest-priority obligation. VoraPrep's platform, with over 1,400 practice questions, trains you on this kind of prioritization, and our Vory tutor can walk you through the logic 24/7 if you get stuck.
Beyond the Hierarchy: Self-Regulation
While not legally binding in the same way as statutes, self-regulatory frameworks are an important piece of the U.S. privacy puzzle. These are industry-developed codes of conduct and principles.
Examples include the Digital Advertising Alliance (DAA) Self-Regulatory Principles for Online Behavioral Advertising. While compliance is voluntary, the FTC may view a company's failure to adhere to its own public promises to follow these frameworks as a deceptive practice.
Think of it as another potential source of liability, even if it's not "the law."
Ready to Pass Your CIPP/US Exam?
Don't let the complexities of U.S. privacy law stand between you and your CIPP/US certification. VoraPrep offers a complete 6-pillar interactive course, featuring textbook-grade lessons, adaptive practice questions, 1:1 exam simulators, FSRS flashcards, a personalized study plan, and Vory, your 24/7 personal tutor. Our platform is designed to teach you to think like the examiner, ensuring you grasp not just the rules, but how to apply them.
Visit voraprep.com to get started and experience a modern approach to exam prep.
Start Your Free 14-Day Trial at voraprep.com →