For most professionals starting in U.S. privacy, the CIPP/US is the correct first certification. The common mistake is choosing based on your current job title instead of the foundational knowledge the market demands.
Take the CIPP/US first. It teaches the "what" of privacy (the laws and regulations), which is the essential foundation. The CIPM teaches the "how" (managing a privacy program), which is the logical next step after you understand the legal requirements you need to manage.
Key facts
- Official Body: International Association of Privacy Professionals (IAPP) for both.
- CIPP/US Focus: The legal framework of U.S. privacy, including federal laws like the FTC Act, HIPAA, GLBA, and COPPA, plus state laws like CCPA/CPRA and VCDPA.
- CIPM Focus: The operational management of a privacy program, using the Assess, Protect, Sustain, and Respond lifecycle.
- CIPP/US Best For: Lawyers, consultants, compliance officers, and policy advisors.
- CIPM Best For: Program managers, IT professionals, and operations leaders.
- Pass Rate: The IAPP does not publish official pass rates; any figures you see are anecdotal industry estimates.
What's the Difference Between CIPP/US and CIPM?
The simplest way to decide is to understand the question each certification answers.
The CIPP/US (Certified Information Privacy Professional/United States) answers, "What are the rules?" It is a deep dive into the legal landscape of U.S. privacy. You will learn the specific requirements of laws like the California Consumer Privacy Act (CCPA) as amended by the CPRA, Virginia's VCDPA, HIPAA for healthcare, COPPA for children's privacy, GLBA for financial data, and the FTC's enforcement powers.
Studying for CIPP/US? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
It is the law-focused certification.
The CIPM (Certified Information Privacy Manager) answers, "How do we comply with the rules?" This certification is not about memorizing laws. It's about building and running the machinery of a privacy program. You will learn about data governance, creating privacy policies, training employees, responding to data breaches, and measuring program performance.
It is the operations-focused certification.
A CIPP/US professional tells the company what it needs to do. A CIPM professional builds the system to get it done. To build a strong career, you must first understand the rules before you can build a system to follow them.
Worked Example: A Data Subject Access Request (DSAR) Hits ACME Corp.
Let's make this concrete. An e-commerce company, "ACME Corp," receives a request from a customer in California: "Please send me all the personal information you have collected about me."
This single request triggers different responsibilities, perfectly illustrating the CIPP/US vs. CIPM divide.
Step 1: The CIPP/US Professional's Analysis (The "What")
The legal counsel, holding a CIPP/US, immediately analyzes the legal obligations.
Her thought process, guided by the CIPP/US body of knowledge, is:
- Validate the Request: Is this a legally valid request under the CCPA/CPRA? She must confirm the consumer's identity to a reasonable degree of certainty, following the specific methods outlined in Cal. Code Regs. title 11, § 999.323, to prevent unauthorized data disclosure.
- Define the Scope: What data are we legally required to provide? She knows the company must disclose the specific pieces of personal information it has collected (Cal. Civ. Code § 1798.110), with no default look-back period unless providing the full history is impossible or involves disproportionate effort. The 12-month look-back period applies to the categories of information collected, sold, or shared.
- Identify Exemptions: Is any of this data exempt from the access right? She knows that certain data, like information governed by the GLBA or de-identified data, is explicitly carved out of the CCPA's scope. She distinguishes this from exemptions for deletion requests, which are different.
- Check the Deadline: What is our legal timeline? The CPRA mandates an initial response within 45 calendar days. She knows the company can file for a single 45-day extension if reasonably necessary, but it requires notifying the consumer.
Her job is to define the legal boundaries of the company's response based on her knowledge of the law.
Step 2: The CIPM Professional's Execution (The "How")
Simultaneously, the privacy program manager, holding a CIPM, operationalizes the response.
His thought process, guided by the CIPM body of knowledge (Assess, Protect, Sustain, Respond), is:
- Intake and Triage: The request is logged in the company's DSAR management tool. He assigns a ticket number and confirms receipt with the consumer using a pre-approved template.
- Data Discovery: Where is this customer's data? He consults the company's data map (a core CIPM concept) to identify all relevant systems: the CRM, marketing platform, order fulfillment database, and customer support logs.
- Collection and Review: He coordinates with IT to run queries and pull the data. He then stages it for legal review to ensure no privileged or exempt information is included before it's sent to the customer.
- Fulfillment and Reporting: Once legal approves the data package, he ensures it is delivered securely. He then updates the DSAR log and tracks the time-to-completion metric to report on the program's efficiency.
He owns the process, the tools, and the workflow. He makes sure the legal requirements defined by the CIPP/US professional are met efficiently.
A tempting wrong answer for a CIPP/US candidate is "Verify the consumer's identity." This is a critical legal step, but not the first programmatic step.
The correct answer from a CIPM perspective is "Log the request in the tracking system." The CIPM focuses on the operational process: intake, tracking, and managing the workflow. The exam tests your ability to distinguish between a legal requirement (CIPP/US) and an operational best practice (CIPM). VoraPrep's adaptive question bank has over 1,400 questions designed to train you to spot these distinctions.
This example shows why starting with CIPP/US is so important. The CIPM's entire workflow is built to satisfy the legal requirements that the CIPP/US defines. Without knowing the "what," the "how" is directionless.
Calculate Your CIPP/US Score & Study Hours by Domain
Adjust your practice scores across official CIPP/US blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
Who Should Take CIPP/US First?
The CIPP/US should be your first certification if you fall into any of these categories:
- Attorneys and Legal Professionals: This is non-negotiable. The CIPP/US is the baseline credential for privacy lawyers.
- Compliance Officers and Auditors: Your job is to measure the organization against a set of rules. The CIPP/US provides those rules.
- Consultants: Clients hire you for your expertise on the law. You cannot advise them on building a privacy program if you don't have a mastery of the legal obligations.
- Anyone New to Privacy: If you are transitioning into the field, the CIPP/US provides the fundamental vocabulary and concepts the entire industry is built upon.
Who Could Consider CIPM First?
The list of professionals who should take the CIPM first is much shorter, and even they would benefit from the CIPP/US.
- Existing Program or Project Managers: If you are an experienced IT project manager tasked with implementing a privacy program already designed by legal, the CIPM might be a more immediate fit.
- IT and Security Operations: If your role is purely technical (e.g., implementing data loss prevention tools chosen by others), the CIPM provides useful context for how your work fits into the bigger picture.
Even for these roles, a lack of CIPP/US knowledge can be a career handicap. You will always be dependent on someone else to tell you why you are doing what you are doing.
How Do the CIPP/US and CIPM Exams Compare?
While both are from the IAPP, the exam experience and career impact are different.
| Feature | CIPP/US | CIPM |
|---|---|---|
| Core Focus | U.S. privacy laws, regulations, and legal precedents. | The operational lifecycle of managing a privacy program. |
| Exam Blueprint | 6 Domains: Intro to U.S. Privacy, Government Access, Private Sector, Workplace Privacy, State Laws, Enforcement. | 6 Domains: Governance, Framework, Operational Life Cycle, Metrics, Considerations, Auditing. |
| Question Style | Scenarios testing application of specific legal rules. | Scenarios testing judgment and operational best practices. |
| Best For | Lawyers, compliance officers, consultants, policy advisors. | Program managers, IT leaders, project managers, operations. |
| Common Careers | Privacy Counsel, Compliance Manager, Data Privacy Analyst. | Privacy Program Manager, DPO, Privacy Operations Lead. |
| Study Mindset | Memorization of legal details: thresholds, timelines, definitions. | Understanding of process and frameworks: lifecycles, governance. |
For a deeper look at the CIPP/US exam structure, you can review the official IAPP blueprint and body of knowledge.
Your First-Week CIPP/US Study Plan
If you've decided the CIPP/US is your starting point, here is what you should do this week to build momentum.
Step 1: Make Your Decision and Commit (Today)
Use this guide to make a final choice. Stop debating and commit to the CIPP/US path.
Step 2: Acquire Core Study Materials (This Week)
Purchase the official IAPP textbook, "U.S. Private-Sector Privacy: Law and Practice," and download the free Body of Knowledge and Exam Blueprint from the IAPP website. These are your primary sources.
Step 3: Begin Active Learning with Domain I (This Weekend)
Do not just passively read the textbook. Read the first chapter, corresponding to Domain I: Introduction to the U.S. Privacy Environment. Then, immediately test your understanding with practice questions. Active recall is the fastest way to build durable knowledge. You can try VoraPrep's free CIPP/US practice questions to see where you stand.
A complete course like VoraPrep integrates textbook-grade lessons, adaptive practice banks, and a personalized study plan to guide you through this process.
Ready to Pass Your CIPP/US Exam?
The CIPP/US is a challenging exam, but it is the critical first step to a career in privacy. VoraPrep offers a complete 6-pillar course that teaches you to think like the examiner. With over 1,400 practice questions, detailed lessons, and Vory, your 24/7 personal tutor, we give you everything you need to pass.
Visit voraprep.com to get started.
Start Your Free 14-Day Trial at voraprep.com →