Most CIPP/US candidates approach the State Privacy Laws domain by trying to memorize the differences between each law first. This is a fatal error. You end up with a jumbled list of thresholds and cure periods that are impossible to apply under exam pressure. The candidates who pass master the common architecture first, then layer on the critical state-specific distinctions.
To pass the CIPP/US State Privacy Laws domain (CIPP5), first master the common framework of consumer rights (access, deletion) and controller duties. Then, pinpoint the key state differences: CCPA/CPRA's broad "sale" definition and lack of a cure period versus the VCDPA/CPA model of a monetary-only "sale" and a 30-day cure period.
Key facts
- Exam Domain
- CIPP/US Domain 5: State Privacy Laws
- Weight on Exam
- ~17% of the total score
- Study Time
- 10-15 hours dedicated to this domain
- Primary Laws Tested
- California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA)
- Key Exemptions
- Non-profits, government agencies, and data subject to federal laws like HIPAA and GLBA are often exempt.
- IAPP Pass Rate
- The overall CIPP/US exam has a pass rate of approximately 65% (IAPP).
The 3-Step Framework for State Law Questions
The exam doesn't want a walking encyclopedia. It wants to see if you can think like a privacy professional. For any scenario involving state laws, you must run this exact three-step mental playbook.
Step 1: Does the Law Even Apply?
This is the gatekeeper question. If the law doesn't apply, all other obligations are irrelevant. Applicability is a two-part test: the entity's nature and its operational scale.
Studying for CIPP/US? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
First, check for exemptions. Is the entity a non-profit, a government agency, or an institution of higher education? Most state laws (VCDPA, CPA, UCPA, CTDPA) exempt these. Is the data itself already covered by a federal law like HIPAA or the GLBA? If so, it's likely carved out.
Second, apply the numerical thresholds. These are pure memorization and are guaranteed to be on your exam.
| State | Key Applicability Thresholds (for businesses/controllers) |
|---|---|
| CA (CCPA/CPRA) | Meets any 1 of: 1) >$25M gross annual revenue (adjusted for inflation annually), 2) Buys, sells, or shares personal info of ≥100,000 consumers, OR 3) Derives ≥50% of annual revenue from selling/sharing personal info. |
| VA (VCDPA) | Meets either: 1) Controls/processes personal data of ≥100,000 consumers, OR 2) Controls/processes personal data of ≥25,000 consumers and derives >50% of gross revenue from the sale of personal data. |
| CO (CPA) | Meets either: 1) Controls/processes personal data of ≥100,000 consumers, OR 2) Controls/processes personal data of ≥25,000 consumers and derives revenue or gets a discount from the sale of personal data. |
| CT (CTDPA) | Meets either: 1) Controls/processes personal data of ≥100,000 consumers (excluding for payment transactions), OR 2) Controls/processes personal data of ≥25,000 consumers and derives >25% of gross revenue from the sale of personal data. |
| UT (UCPA) | Meets all 3: 1) >$25M in annual revenue, 2) Conducts business in Utah, and 3) Meets either: a) Controls/processes personal data of ≥100,000 consumers, OR b) Derives >50% of gross revenue from data sales and controls/processes data of ≥25,000 consumers. |
Step 2: What Are the Core Obligations and Rights?
Once a law applies, you must identify the specific duties of the company (the controller) and the rights of the individual (the consumer).
Controller Obligations: While there are many, focus on these heavily tested duties:- Privacy Notices: Provide a clear, accessible notice at or before the point of collection.
- Data Protection Assessments (DPAs): Conduct and document DPAs for high-risk processing activities like selling data, targeted advertising, or processing sensitive data.
- Controller-Processor Contracts: You must have a binding contract in place with any processor (e.g., a cloud provider, marketing vendor) that details processing instructions, security duties, and assistance obligations.
- Recognize Universal Opt-Outs: In California, Colorado, and Connecticut, controllers must recognize universal opt-out mechanisms like the Global Privacy Control (GPC) signal.
- Data Broker Registration: California requires entities that knowingly collect and sell the personal information of consumers with whom they do not have a direct relationship to register with the CPPA.
- Access: The right to confirm processing and access one's data.
- Correction: The right to correct inaccurate personal data.
- Deletion: The right to delete personal data.
- Portability: The right to obtain data in a portable format.
- Opt-Out: The right to opt out of the "sale" of data, targeted advertising, and certain types of profiling.
The critical distinction lies in how states handle "sale" and sensitive data.
- Does VCDPA (Virginia) apply?
- Consumer Count: Yes, 120,000 > 100,000. VCDPA applies.
- Does CPA (Colorado) apply?
- Consumer Count: No, 80,000 < 100,000.
- Second Threshold: Yes, it processes data of >25,000 consumers and derives a benefit ("discount or enhanced service" counts) from the "sale" of data. CPA applies.
- Must Global AdTech honor an opt-out of "sale" request from a Virginian?
- The VCDPA defines "sale" as an exchange for monetary consideration. Since Global AdTech only exchanges data for services, it is not a "sale" under Virginia law.
- Verdict: No. This is a classic exam trap.
The common wrong answer is to assume "sale" means the same thing everywhere. The examiner is testing your knowledge of that precise definitional difference between states.
Step 3: What Happens When Things Go Wrong?
Enforcement is the final piece. You need to know who brings the action and whether the company gets a chance to fix the problem.
| State | Primary Enforcement Authority | Cure Period |
|---|---|---|
| CA (CCPA/CPRA) | CA Attorney General & CA Privacy Protection Agency (CPPA) | None (Discretionary) |
| VA (VCDPA) | VA Attorney General | 30 Days (Mandatory) |
| CO (CPA) | CO Attorney General & District Attorneys | 60 Days (Sunsets in 2025) |
| CT (CTDPA) | CT Attorney General | 60 Days (Discretionary, sunsets in 2025) |
| UT (UCPA) | UT Attorney General | 30 Days (Mandatory) |
The single most important fact here is that the CPRA removed the mandatory 30-day cure period from California law. Violations can lead directly to enforcement. Do not get this wrong.
Calculate Your CIPP/US Score & Study Hours by Domain
Adjust your practice scores across official CIPP/US blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
Mnemonics to Lock in Key Rules
- "CA has No Cure." Simple and effective. California's law (post-CPRA) offers no guaranteed chance to fix a violation before facing penalties.
- "Utah is UNIQUE." Remember that Utah's law is an outlier. It's the only one that requires a business to meet both a revenue threshold and a data processing threshold to be covered.
- Sale Definition: "CA$H + CONSIDERATION." This reminds you that California's definition of sale includes both money and "other valuable consideration," making it the broadest. Most others are just cash.
To master these details, active recall is essential. VoraPrep's platform uses FSRS Spaced-Repetition Flashcards to drill these thresholds and rules until they are second nature, which is exactly what you need for exam day.
How to Use This Cheat Sheet in Your Study Plan
This guide is your high-level map, not the entire territory.
- Initial Read-Through: After completing the Domain 5 lessons in your primary study course, use this cheat sheet to consolidate the most important concepts.
- Practice Application: Take a block of 25-30 practice questions focused only on state privacy laws. When you get one wrong, don't just read the explanation. Come back to this sheet and identify which rule you misapplied: was it an incorrect threshold, a misunderstanding of "sale," or a forgotten cure period?
- Pre-Exam Cram: In the final 48 hours before your exam, this should be one of your primary review documents. Read it through two or three times to refresh the frameworks and lock in the numbers.
VoraPrep's complete course integrates this approach, with textbook-grade lessons to build your foundation and an adaptive question bank to test your application of these rules in exam-like scenarios.