Applicant screening questions on the CIPP/US exam are not about memorizing FCRA. They are judgment tests on which law is the most restrictive when federal, state, and EEOC guidelines conflict in a single hiring scenario.
Quick answer
For the CIPP/US exam, applicant screening requires applying the Fair Credit Reporting Act (FCRA) for background checks, including its two-step adverse action notice process. You must also know the Employee Polygraph Protection Act (EPPA) for lie detectors and apply the most restrictive state-specific "ban-the-box" or social media privacy laws.
Key facts
- Exam Body
- IAPP (International Association of Privacy Professionals)
- CIPP/US Pass Rate
- Approximately 65% historically, according to IAPP data.
- Study Hours
- Typically 60-100 hours for comprehensive preparation.
- Key Domain
- Applicant screening falls primarily under Domain IV: Workplace Privacy.
- Exam Format
- Multiple-choice questions, administered at Pearson VUE test centers.
- Salary Range
- Certified CIPP/US professionals typically earn $110,000-$175,000 annually.
How Does Applicant Screening Appear on the CIPP/US Exam?
Applicant screening is a critical and frequently tested topic in Domain IV: Workplace Privacy. The exam doesn't just ask for definitions. It presents scenarios where you must act as a privacy professional advising a company on a hiring decision.
The key is to master the federal frameworks first, then understand how state and local laws raise the compliance bar. Your mental model must be: Federal law sets the floor, but state law and EEOC guidance can raise the ceiling. Examiners create questions that punish candidates who only know the federal rule. To see how these complex scenarios are structured, try a set of CIPP/US practice questions that mirror the exam's difficulty.
Free 5-Min Diagnostic
Studying for CIPP/US? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
What Are the Core Applicant Screening Rules?
Navigating these rules for the exam means mastering four distinct areas and their interactions.
The Fair Credit Reporting Act (FCRA)
FCRA governs the use of "consumer reports" (background checks) from third-party consumer reporting agencies (CRAs). The process has two main phases.
- Prerequisite: Disclosure and Authorization. Before an employer can even request a consumer report, it must provide a clear and conspicuous disclosure to the applicant in a standalone document that a report may be obtained. The employer must then get the applicant's written authorization. For Investigative Consumer Reports (which include interviews with third parties), the disclosure must also state the applicant has a right to request information about the nature and scope of the investigation.
- Two-Step Adverse Action Process. If the employer considers taking adverse action (like not hiring) based on the report, it must follow a strict two-step notification process.
- Step 1: Pre-Adverse Action Notice. The employer must provide the applicant with a copy of the report and the FTC's "A Summary of Your Rights Under the FCRA" document. This must be done before taking the adverse action, giving the applicant a "reasonable time" to respond or dispute the report's accuracy. While 5 business days is a common practice, the exam tests the "reasonable time" standard, which can be affected by state law.
- Step 2: Final Adverse Action Notice. After waiting a reasonable time, if the employer proceeds, it must issue a final notice. This notice must include the CRA's contact information, a statement that the CRA did not make the decision, and a notice of the applicant's right to dispute the information and get another free report within 60 days.
The Employee Polygraph Protection Act (EPPA)
EPPA makes it illegal for most private employers to use lie detector tests for pre-employment screening or during employment. The prohibition is broad.
The exceptions are very narrow and are a favorite topic for exam questions.
Tip: Use the mnemonic "GovSec Drugs" to remember the EPPA exceptions.
- Gov: Federal, state, and local government employers are exempt.
- Sec: Certain security service firms (e.g., armored car, security systems) can test applicants.
- Drugs: Pharmaceutical companies and other firms handling controlled substances can test certain employees during an ongoing investigation into economic loss or injury.
Crucially, some states like Massachusetts have near-total bans on polygraphs for employment. In those states, the stricter state law applies, nullifying EPPA's narrow exceptions.
State and Local Law Overlays
State and local laws add significant complexity.
- "Ban-the-Box" Laws: These laws, which vary by city and state, restrict when an employer can ask about criminal history. Many prohibit such inquiries until after the employer has determined the applicant is otherwise qualified or has made a conditional job offer. This timing rule often precedes FCRA's adverse action process.
- Social Media Privacy Laws: A growing number of states prohibit employers from requesting or requiring an applicant or employee to disclose their username and password for personal social media accounts. These laws do not stop employers from viewing publicly available information.
- EEOC Guidance: Layered on top of this, the Equal Employment Opportunity Commission (EEOC) guidance on criminal records cautions that blanket policies excluding applicants with any criminal history may constitute illegal discrimination. Employers are expected to conduct an individualized assessment, considering the nature of the crime, the time elapsed, and the nature of the job.
| Screening Method | Federal Law (Primary) | Key Requirements & Nuances | State/Local Variations & Overlays |
|---|---|---|---|
| Background Checks | FCRA | Standalone disclosure & authorization. Two-step adverse action process. "Reasonable time" for pre-adverse notice. | Ban-the-Box: Delays timing of criminal history inquiry. EEOC: Requires individualized assessment for criminal records. Some states set specific notice periods (e.g., 7 days). |
| Polygraph Tests | EPPA | Generally prohibited for private employers. Very narrow "GovSec Drugs" exceptions. | Some states have stricter bans with no exceptions, which override EPPA's allowances. |
| Social Media Review | None (specific) | General anti-discrimination laws apply. Reviewing public information is generally permissible. | Many states prohibit employers from requesting login credentials or requiring access to private accounts. |
| Drug Testing | ADA | Post-offer, pre-employment testing is generally allowed. Must be job-related and non-discriminatory. | Varies widely. Some states regulate random testing. State medical marijuana laws create complex conflicts with federal law. |
✨ Free Interactive Calculator
Open CIPP/US Score Calculator →Calculate Your CIPP/US Score & Study Hours by Domain
Adjust your practice scores across official CIPP/US blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
Worked Example: Solving a Multi-Layered Screening Problem
Exam questions will force you to synthesize these rules. Let's walk through a realistic scenario.
Worked example:
A financial services firm in Boston, Massachusetts, is hiring a portfolio manager.
- The firm uses a CRA for background checks. Before the first interview, it includes a disclosure and authorization for a background check on page 8 of a 10-page employment application. The candidate, Maria, signs it.
- After determining Maria is otherwise qualified, the firm runs the check, which reveals a misdemeanor conviction for disorderly conduct from 8 years ago. Massachusetts has a "ban-the-box" law.
- Based on the report, the firm's HR director decides not to hire Maria. They immediately send her a final adverse action notice via email.
- The HR director also notes that company policy requires polygraph tests for all portfolio managers due to the sensitive nature of the job and asks Maria to schedule one. Massachusetts has a strict anti-polygraph law.
Which of the firm's actions violated applicable law?
A. The timing of the background check and the polygraph request. B. The FCRA disclosure, the adverse action process, and the polygraph request. C. Only the adverse action process and the polygraph request. D. The FCRA disclosure and the adverse action process only.- Analyze the FCRA Disclosure: FCRA requires a "clear and conspicuous disclosure" in a "document that consists solely of the disclosure." Burying it on page 8 of an application packet violates this "standalone document" rule. This is a violation.
- Analyze the Background Check Timing: Massachusetts's "ban-the-box" law generally restricts criminal history inquiries until later in the process. However, the firm waited until Maria was deemed "otherwise qualified." This part of the process is likely compliant with the state timing rule.
- Analyze the FCRA Adverse Action Process: The firm went directly to a final adverse action notice. It skipped the mandatory "pre-adverse action" step, which requires providing a copy of the report and summary of rights, and waiting a "reasonable time" for Maria to respond. This is a clear violation. Furthermore, a single misdemeanor from 8 years ago would likely fail an EEOC individualized assessment for this role.
- Analyze the Polygraph Request: The firm is a private employer. While handling money is sensitive, it does not fall under EPPA's narrow exceptions. More importantly, the scenario is in Massachusetts, which has one of the strictest state laws, effectively banning all employer polygraph tests. This is a violation of both EPPA and state law.
- A is incorrect. The adverse action process and disclosure were also violations.
- B is correct. The disclosure was not standalone (Violation 1). The adverse action process was missing a step (Violation 2). The polygraph request violated both federal and stricter state law (Violation 3).
- C is incorrect. The initial FCRA disclosure was also a clear violation.
- D is incorrect. The polygraph request was a definite violation.
How to Master Applicant Screening This Week: A 7-Day Sprint
Use this focused plan to lock in your knowledge.
Day 1: Master FCRA
Focus only on FCRA. Diagram the two phases: 1) Disclosure/Authorization (including the standalone rule and ICRs) and 2) the Two-Step Adverse Action process. Use flashcards for the specific contents of the pre-adverse and final adverse notices. Complete 10-15 adaptive practice questions on FCRA scenarios.Day 2: Master EPPA and ADA
Drill the "GovSec Drugs" mnemonic for EPPA. Research two states with stricter anti-polygraph laws to understand preemption. For the ADA, focus on the distinction between illegal pre-offer medical inquiries and permissible post-offer, pre-employment exams and drug tests.Day 3: Layer on Ban-the-Box and EEOC
Study the purpose of ban-the-box laws: to delay inquiries. Then, read the EEOC's summary of guidance on criminal records. Understand the concept of an "individualized assessment" and the three factors to consider (crime, time, job).Day 4: Layer on State Social Media & Other Laws
Review the common structure of state social media privacy laws. The key is the prohibition on demanding login credentials. Contrast this with the permissibility of viewing public profiles.Day 5: Preemption Drills
This is judgment day. Find practice questions that involve a federal law and a more protective state law. Your only task is to identify which law controls and why. The rule is simple: the law that is more protective of the individual's privacy wins.Day 6: Integrated Scenario Practice
Now, put it all together. Work through complex scenarios like the worked example above. Use VoraPrep's detailed explanations to see how each rule is applied. When you get one wrong, ask Vory, your 24/7 tutor, to explain the legal hierarchy step-by-step.Day 7: Review and Solidify
Review your notes and flashcards, focusing on timelines, notice requirements, and exceptions. Take a 20-question quiz focused solely on Domain IV. This targeted practice, guided by an interactive CIPP/US study plan, builds the confidence you need for exam day.Ready to Pass Your CIPP/US Exam? VoraPrep offers a complete 6-pillar interactive course designed for busy professionals. Our platform includes textbook-grade lessons, thousands of adaptive practice questions, 1:1 exam simulators, and a personalized study plan that targets your weak areas. Visit voraprep.com to get started Start Your Free 14-Day Trial at voraprep.com →