A candidate, Sarah, felt confident about her grasp of privacy laws. She diligently memorized the notice requirements for GLBA, the security rule for HIPAA, and COPPA's age threshold. On exam day, she faced a scenario describing a health and wellness app that collected user data. She immediately thought HIPAA, but the question kept prompting about non-covered entities. She chose HIPAA-related answers, only to later realize she’d missed a fundamental distinction: the app wasn't a HIPAA-covered entity, yet its practices were still subject to broad FTC enforcement. This single trap, confusing specific statutory scope with general consumer protection, is a primary reason candidates lose points in CIPP/US Domain 2.
This CIPP/US Domain 2 cheat sheet for 2026 details the key private-sector data laws, including the FTC Act, HIPAA, GLBA, COPPA, FERPA, and critical state laws like CCPA/CPRA. It focuses on scope, core rules, and common exam traps to build the judgment you need to pass.
Key facts
- Official Body
- IAPP (International Association of Privacy Professionals)
- Pass Rate
- Widely estimated at ~65% (the IAPP does not publish official rates).
- Recommended Study Hours
- Candidates typically dedicate 60-100 hours of study.
- Exam Format
- 90 multiple-choice questions in 2.5 hours.
- Domain 2 Weight
- "Limits on Private-Sector Collection and Use of Data" represents a significant portion of the exam, often 20-25% of the questions.
- Average Salary
- CIPP/US certified professionals typically earn between $110,000 and $175,000 annually.
What Are the Core Federal Private-Sector Privacy Laws?
This domain tests your ability to apply the primary federal laws governing how private organizations in the U.S. handle personal information. The exam presents scenarios designed to test your judgment, not just your memory. You must identify when the FTC's broad authority applies versus when a specific law like HIPAA or GLBA takes precedence. Test your judgment with VoraPrep's adaptive CIPP/US questions to see how these concepts are tested.
Federal Trade Commission (FTC) Act: The Broad Backstop
The FTC Act is your default answer when no other specific law applies. Section 5 prohibits "unfair or deceptive acts or practices in commerce," giving the FTC wide-ranging authority to police privacy promises and data security failures.
- Scope: Applies to almost all commercial entities.
- Key Requirements: A practice is deceptive if it's likely to mislead a reasonable consumer and is material. A practice is unfair if it causes substantial consumer injury that is not reasonably avoidable and lacks countervailing benefits.
- Enforcement: The FTC can issue consent decrees, cease and desist orders, and seek civil penalties.
Health Insurance Portability and Accountability Act (HIPAA)
HIPAA protects the privacy and security of a specific type of data, Protected Health Information (PHI), when handled by specific entities.
- Scope: Applies only to Covered Entities (health plans, healthcare clearinghouses, most healthcare providers) and their Business Associates (vendors handling PHI on their behalf).
- Key Requirements: The Privacy Rule governs use and disclosure of PHI. The Security Rule mandates administrative, physical, and technical safeguards for electronic PHI. The Breach Notification Rule requires notice to individuals and HHS within 60 days of discovering a breach of unsecured PHI.
- Enforcement: The HHS Office for Civil Rights (OCR) enforces HIPAA, with significant civil and criminal penalties.
Gramm-Leach-Bliley Act (GLBA)
GLBA requires financial institutions to protect consumer financial data and explain their information-sharing practices.
- Scope: Applies to Financial Institutions, defined broadly to include banks, mortgage lenders, securities brokers, and even some non-traditional financial companies.
- Key Requirements: The Privacy Rule requires providing privacy notices and giving consumers the right to opt out of sharing Nonpublic Personal Information (NPI) with non-affiliated third parties. The Safeguards Rule requires a comprehensive, written information security program.
- Enforcement: Enforced by the FTC, federal banking agencies, and state insurance authorities.
Children's Online Privacy Protection Act (COPPA)
COPPA gives parents control over what information is collected from their young children online.
- Scope: Applies to operators of commercial websites and online services directed to children under 13, or operators with actual knowledge they are collecting personal information from a child under 13.
- Key Requirements: The core mandate is to obtain verifiable parental consent before collecting, using, or disclosing a child's personal information. A clear privacy policy is also required.
- Enforcement: The FTC enforces COPPA with steep civil penalties.
Family Educational Rights and Privacy Act (FERPA)
FERPA protects the privacy of student education records.
Studying for CIPP/US? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
- Scope: Applies to educational institutions that receive federal funding from the U.S. Department of Education.
- Key Requirements: Gives parents (or eligible students over 18) rights to access, inspect, and request amendments to education records. Generally requires written consent before disclosing personally identifiable information from these records, with some key exceptions.
- Enforcement: The U.S. Department of Education can withdraw federal funding for violations.
Calculate Your CIPP/US Score & Study Hours by Domain
Adjust your practice scores across official CIPP/US blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
Which State and Marketing Laws Are Tested on the Exam?
A huge portion of Domain 2 questions now involve state-level privacy laws and specific federal marketing rules. Ignoring these is a critical error.
California Consumer Privacy Act (CCPA) as amended by CPRA
The CCPA created a set of consumer rights for California residents and is a major focus of the CIPP/US exam.
- Scope: Applies to for-profit businesses that do business in California and meet certain revenue, data processing, or data sales thresholds.
- Key Requirements: Grants consumers rights to know, delete, correct, and opt out of the sale/sharing of their personal information. Requires businesses to provide detailed privacy notices.
- Enforcement: Enforced by the California Privacy Protection Agency (CPPA).
Other State Comprehensive Privacy Laws
The exam expects you to know the general landscape of laws in states like Virginia (VCDPA), Colorado (CPA), Utah (UCPA), and Connecticut (CTDPA). While you don't need to know every detail of each, understand their common principles: consumer rights (access, delete, opt-out), controller/processor obligations, and general exemptions (e.g., for GLBA or HIPAA-covered data).
Illinois Biometric Information Privacy Act (BIPA)
BIPA is a unique and heavily tested state law regulating the collection and use of biometric identifiers like fingerprints and facial scans.
- Scope: Applies to private entities collecting biometric information in Illinois.
- Key Requirements: Requires a written policy, informed written consent before collection, and prohibits profiting from biometric data. It is famous for providing a private right of action.
- Enforcement: Primarily through private lawsuits, leading to significant damages.
CAN-SPAM Act
This federal law sets the rules for commercial email.
- Scope: Applies to all commercial electronic mail messages.
- Key Requirements: Must not have false or misleading header information, must identify the message as an ad, must include a physical postal address, and must provide a clear way to opt out of future emails.
- Enforcement: Enforced by the FTC.
Telephone Consumer Protection Act (TCPA) & Telemarketing Sales Rule (TSR)
These rules govern telemarketing calls, text messages, and faxes.
- Scope: TCPA applies broadly to autodialed calls/texts. The TSR applies to most telemarketing plans.
- Key Requirements: Prohibits most non-emergency autodialed calls/texts to wireless numbers without prior express consent. The TSR created the National Do Not Call Registry.
- Enforcement: Enforced by the FCC and FTC, with a private right of action under the TCPA.
Quick Comparison of Key Privacy Laws
| Feature | FTC Act (Section 5) | HIPAA | GLBA | COPPA | CCPA/CPRA | BIPA |
|---|---|---|---|---|---|---|
| Scope | Most commercial entities | Covered Entities & Business Associates | Financial Institutions | Online operators targeting kids <13 | For-profit businesses in CA (thresholds apply) | Entities collecting biometrics in IL |
| Data Type | Any consumer data | Protected Health Info (PHI) | Nonpublic Personal Info (NPI) | Personal info from children < 13 | Personal Information (broadly defined) | Biometric Identifiers & Information |
| Core Rule | No unfair or deceptive acts | Privacy & Security Rules | Privacy notices, opt-out, safeguards | Verifiable parental consent | Consumer rights (know, delete, opt-out) | Written policy, informed consent |
| Enforcer | FTC | HHS OCR | FTC, banking regulators | FTC | CPPA | Private lawsuits |
Common Traps and Test-Day Reminders
The CIPP/US exam tests your thinking, not just your memory. Questions will present scenarios where multiple laws seem to apply. Your job is to find the most applicable one.
Always ask: Is this a Covered Entity? A Financial Institution? An online service directed at children under 13? A business meeting CCPA thresholds? If not, your default should be the FTC Act.
- Identify the context: The game is for children 8-10. This is a huge signal for COPPA.
- Check COPPA's trigger: Is it an online service directed to children under 13? Yes. Is it collecting personal information? Yes.
- Apply COPPA's core rule: COPPA requires verifiable parental consent before collecting this information.
- Conclude: The primary violation is under COPPA for failing to get verifiable parental consent.
Mnemonics and Memory Aids
Use mnemonics to lock in key lists and concepts.
- HIPAA Covered Entities: "The 3 H's"
- Health Plans
- Healthcare Clearinghouses
- Healthcare Providers (who transmit electronically)
- GLBA's Pillars: "SPO"
- Safeguards Rule (security program)
- Privacy Rule (notices)
- Opt-out rights (for sharing NPI)
- COPPA's Core: "VPC"
- Verifiable Parental Consent is the central requirement before collection from kids under 13.
- CCPA Consumer Rights: "Don't Know My SECRET"
- Right to Delete
- Right to Know
- Right to Opt-Out of Sale/Sharing
- Right to Correct
- Right against Retaliation
- Right to Limit Use of Sensitive PI
VoraPrep's platform includes FSRS spaced-repetition flashcards built from your lessons, ensuring you review these critical concepts at the perfect time for long-term retention.
How to Use This Cheat Sheet in Your Study Routine
This cheat sheet is a map, not the entire territory. Use it to frame your studies and for quick reviews.
- Start and End with It: Before diving into Domain 2 practice questions, spend five minutes scanning these rules. This primes your brain to spot the patterns. Do the same at the end of a study session to reinforce what you learned.
- Pair with Practice: After reviewing a section here, immediately tackle relevant MCQs. When you get a question wrong, come back to this sheet and your detailed VoraPrep lessons. Our question explanations show why the right answer is right and why the distractors are wrong, which is key to building judgment.
- Focus on Scope: For every practice question, your first thought should be: "What law applies here?" Use the "Scope" sections in this guide as your mental checklist. This deliberate practice is how you avoid the most common exam traps.
For a complete study system, including textbook-grade lessons, adaptive practice, and 1:1 exam simulation, explore the full VoraPrep CIPP/US course.