Most candidates fail Domain II of the CIPP/US exam not because they don't know the acronyms like HIPAA or GLBA. They fail because they can't correctly identify which law doesn't apply when a scenario mixes healthcare data, financial information, and a child's online activity. The test isn't about reciting rules; it's about applying the right rule by first eliminating the wrong ones.
To pass the CIPP/US Domain II, "Limits on Private-Sector Collection and Use," you must master the scope and application of key sectoral privacy laws like HIPAA, GLBA, FCRA, and COPPA. This domain is the largest on the exam, requiring you to analyze complex scenarios and determine which specific regulations apply.
Key facts
- Exam Domain
- Domain II: Limits on Private-Sector Collection and Use of Data
- Official Body
- International Association of Privacy Professionals (IAPP)
- Exam Weight
- 37% (the largest domain on the CIPP/US exam)
- Key Laws
- FTC Act, HIPAA, GLBA, FCRA, COPPA, FERPA, VPPA
- Passing Score
- Not officially published, but estimated to be around 70-75% correct
- Study Hours
- 30-40 hours for this domain alone, as part of a 60-100 hour total CIPP/US plan
What is Domain II: Limits on Private-Sector Collection and Use of Data?
This domain is the core of the CIPP/US exam, covering the web of federal laws that govern how private companies handle personal information. It represents 37% of your total score, making it the single most important section. The IAPP reports that the overall CIPP/US pass rate is approximately 65%, and weakness in this heavily-weighted domain is a primary reason candidates need a second attempt.
The exam questions for this domain test your ability to act like a practicing privacy professional. You won't just be asked "What does HIPAA stand for?". Instead, you'll get a scenario about a new mobile app and have to determine if it qualifies as a "covered entity" or "business associate" and what its obligations are.
Studying for CIPP/US? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
This domain is broken down into four major areas:
- The Federal Trade Commission (FTC): Understanding the FTC's broad authority under Section 5 of the FTC Act to police "unfair and deceptive" trade practices is foundational.
- Healthcare: This primarily means the Health Insurance Portability and Accountability Act (HIPAA), its Privacy Rule, Security Rule, and the HITECH Act.
- Financial Services: This section focuses on the Gramm-Leach-Bliley Act (GLBA) and the Fair Credit Reporting Act (FCRA).
- Education and Children's Privacy: Here, you'll need to know the Family Educational Rights and Privacy Act (FERPA) and the Children's Online Privacy Protection Act (COPPA).
Mastering this domain means you can confidently advise a business on its data handling obligations across multiple sectors.
Key Sectoral Privacy Laws at a Glance
The exam requires you to know the specific triggers and scope for each major federal privacy law. Memorizing a list of rules is not enough; you must be able to compare and contrast them in a given scenario.
| Law | Who is Covered? | What Data is Protected? | Key Requirement Example |
|---|---|---|---|
| HIPAA | Health plans, healthcare clearinghouses, and most healthcare providers ("Covered Entities"). | Protected Health Information (PHI) in any form. | Must obtain patient authorization for uses and disclosures not related to treatment, payment, or operations. |
| GLBA | "Financial institutions" (broadly defined: banks, mortgage lenders, investment advisors, even some travel agents). | Nonpublic Personal Information (NPI) of customers. | Must provide initial and annual privacy notices and offer an opt-out for sharing with non-affiliated third parties. |
| COPPA | Operators of commercial websites and online services directed to children under 13. | Personal information collected from children under 13. | Must obtain verifiable parental consent before collecting, using, or disclosing a child's personal information. |
| FCRA | Consumer Reporting Agencies (CRAs) and entities that use or furnish data to them. | Information in a "consumer report" bearing on creditworthiness, character, or reputation. | Users must have a "permissible purpose" to obtain a consumer report (e.g., for a credit application). |
This table is a starting point. Your study plan must go deeper. For instance, what's the difference between a GLBA "consumer" and a "customer"? What are the 18 identifiers that make health data PHI? Try VoraPrep's free CIPP/US practice questions to see how these details are tested.
How to Think Like the Examiner: A Worked Example
The CIPP/US exam doesn't test rote memorization. It tests judgment. Let's walk through a scenario that illustrates how to apply the rules under pressure.
Here is how to break it down, step-by-step.
Step 1: Identify the Data and Actors
- Actors: HealthFit (app developer), Parents, Child (age 10).
- Data: Child's name, age (under 13), allergy info (health-related), credit card number (financial).
Step 2: Analyze Each Law's Applicability
This is where most candidates go wrong. They see "health data" and immediately jump to HIPAA. Don't. You must check the scope of the law first.
- Does COPPA apply? Yes, absolutely. The service collects personal information (name, age) from a child known to be under 13. HealthFit is an "operator" and must get verifiable parental consent. This makes any answer without COPPA incorrect.
- Does HIPAA apply? This is the main trap. While allergy information is health-related, HIPAA only applies to "Covered Entities" (like doctors, hospitals, insurers) and their "Business Associates." HealthFit is a direct-to-consumer wellness app. It is not a covered entity. Therefore, HIPAA does not apply. This is a critical distinction the exam tests constantly.
- Does GLBA apply? HealthFit processes a credit card payment. Does that make it a "financial institution"? No. The definition under GLBA is for entities significantly engaged in financial activities like lending, insuring, or investment advice. Simply accepting payment for a service does not trigger GLBA's main requirements (like privacy notices).
- Does the FTC Act apply? Yes. Always. The FTC has broad authority under Section 5 to bring enforcement actions for "unfair or deceptive acts or practices." If HealthFit made false promises about its data security or used the children's data in a way parents didn't expect, the FTC could act.
Step 3: Select the Best Answer
Based on the analysis:
- COPPA applies.
- HIPAA does not apply.
- GLBA does not apply.
- The FTC Act applies as a baseline.
Therefore, the best answer is C) COPPA and the FTC Act.
Platforms like VoraPrep build your skills for this with an adaptive learning engine. If you miss a question about HIPAA's scope, our system will serve you more scenarios that test the boundaries of a "covered entity" until you master the concept.
Calculate Your CIPP/US Score & Study Hours by Domain
Adjust your practice scores across official CIPP/US blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How to Study for Domain II Effectively
Given that this domain is 37% of the exam, you should dedicate a proportional amount of your study time here. For a 100-hour study plan, that's roughly 35-40 hours.
Your Weekly Drill
Instead of just reading the textbook, make your study active. Each week, focus on one sectoral law and follow this pattern:
- Define the Scope (Monday): Write down, in your own words, who the law covers, what data it protects, and who it doesn't cover. For HIPAA, list the three types of Covered Entities. For GLBA, define "financial institution," "consumer," and "customer."
- Map the Obligations (Wednesday): Create a one-page cheat sheet of the key rules. For COPPA, list the elements of a compliant privacy policy and the methods for verifiable parental consent. For FCRA, outline the concept of "permissible purpose." Our CIPP Limits on Private-Sector Collection and Use of Data (FTC, Healthcare, Financial, Education) Cheat Sheet (2026): Key Formulas, Rules, and Mnemonics is a great resource for this.
- Drill with Scenarios (Friday/Saturday): This is the most important step. Do 50-100 practice questions focused only on that law and its interaction with others. Don't just check if you got it right. For every question, force yourself to explain why the other three options are wrong. If you get stuck, a tool like VoraPrep's 24/7 tutor, Vory, can walk you through the logic step-by-step.
Using spaced repetition is also key. VoraPrep's platform includes flashcards that use this method, ensuring you don't forget the definition of PHI or the GLBA Safeguards Rule as you move on to other topics.
Best Study Resources for CIPP/US Domain II in 2026
Choosing the right study material is critical. You need a complete course that emphasizes application, not just passive learning.
Many candidates try to patch together free resources and an official textbook, but this approach often fails to prepare them for the exam's scenario-based nature. Legacy prep courses often rely on long, passive video lectures that are inefficient for busy professionals.
A modern, interactive platform is a better choice. VoraPrep is a complete, 6-pillar course designed for effective self-study.
| Feature | VoraPrep CIPP/US Course | Traditional Video Courses |
|---|---|---|
| Lessons | Interactive textbook-grade lessons with active recall checkpoints. | 20+ hours of passive video lectures. |
| Practice | 1,400+ adaptive questions with detailed rationales for every answer. | Static question banks with limited feedback. |
| Simulation | 1:1 timed exam simulators that replicate the real testing environment. | Basic quizzes that don't match the exam's format. |
| Support | Vory, your 24/7 personal tutor, for instant help on any question. | Email support with a 24-48 hour turnaround. |
| Study Plan | Personalized daily plan based on your exam date and weak areas. | Generic, one-size-fits-all study schedule. |
| Pricing | $25/month or $199/year. | $1,500 - $2,500 for a full package. |
The key difference is the learning methodology. Watching someone explain GLBA for an hour has low retention. Answering 30 targeted questions that force you to distinguish between GLBA, FCRA, and the FTC Act builds real skill. This is why VoraPrep's interactive approach is more efficient, helping you pass in less time. You can see a full breakdown of the exam details and format breakdown on our site.
Ready to Pass Your CIPP/US Exam?
Don't let the largest domain on the CIPP/US exam intimidate you. With the right strategy and tools, you can master the complexities of U.S. private-sector privacy law. VoraPrep offers a complete course with adaptive practice questions, interactive lessons, and Vory, your 24/7 personal tutor, all for a simple monthly subscription.
Visit voraprep.com to get started and see why hundreds of successful CIPP/US professionals chose our platform.
Start Your Free 14-Day Trial at voraprep.com →