A company collects user location data to provide a navigation service. Its privacy policy, buried deep within a 50-page terms of service document, states this data may also be sold to third-party marketers. Under Section 5 of the FTC Act, is this practice primarily an unfair or a deceptive act? If you immediately locked onto "deceptive" because of the hidden disclosure, you're not wrong, but you've missed the bigger picture. The highest-scoring candidates see a stronger, more direct argument for "unfair," and knowing why is critical to passing.
Domain I of the CIPP/US exam, "Introduction to the U.S. Privacy Environment," covers the foundational structure of U.S. privacy law. It focuses on America's sectoral approach, the sources of law (common law, statutes), key enforcement agencies like the FTC, and foundational concepts like personal information.
Key facts
- Official Body: International Association of Privacy Professionals (IAPP)
- Exam Domains (Current BoK): 5 (I. U.S. Privacy Environment; II. Limits on Private-Sector Collection/Use; III. Government & Court Access; IV. Workplace Privacy; V. State Privacy Laws)
- Passing Score: Scaled score; IAPP does not publish a specific passing percentage, reporting only Pass/Fail.
- Exam Format: 90 multiple-choice questions (75 scored, 15 unscored)
- Exam Length: 2.5 hours (150 minutes)
- 2026 Exam Fee: $550 USD for IAPP members
The IAPP reports an estimated pass rate of around 65% for first-time test takers (IAPP). This figure highlights the need for rigorous, judgment-based preparation and underscores why so many candidates wonder just how hard the CIPP/US exam really is.
How to Use These Domain I Practice Questions
These questions test your judgment on the foundational principles of U.S. privacy law. They are a diagnostic tool. Think of them less as a quiz and more as a preview of the reasoning required on exam day. They are a small sample from the 1,400+ adaptive questions in the full VoraPrep CIPP/US course, which are designed to pinpoint and strengthen your weak areas.
Studying for CIPP CIPP1? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Use these questions to find your blind spots. Pay close attention to the explanations, especially for the answers you get wrong. The goal isn't just to know the right answer, but to understand precisely why the tempting distractors are wrong. This is how you learn to think like the examiner.
The Most Misunderstood Concept in Domain 1: Unfair vs. Deceptive
The single biggest point of confusion for candidates in Domain I is the difference between the FTC's "unfair" and "deceptive" standards under Section 5 of the FTC Act. Memorizing the definitions isn't enough. You have to see how they apply in practice.
Here is the breakdown you need for the exam:
| Standard | FTC Three-Part Test | Key Focus & Exam Clues |
|---|---|---|
| Deceptive | 1. A representation, omission, or practice that is likely to mislead the consumer. 2. The consumer's interpretation is reasonable under the circumstances. 3. The misleading act is "material." | Focuses on a lie or misrepresentation. Look for a broken promise, a misleading statement in a privacy policy, or a deceptive omission. The harm is that the consumer was misled. |
| Unfair | 1. It causes or is likely to cause substantial injury to consumers. 2. The injury is not reasonably avoidable by consumers themselves. 3. The injury is not outweighed by countervailing benefits to consumers or competition. | Focuses on the harm itself. Look for unavoidable injury. A key trigger is when a company's practices make it impossible for a consumer to make an informed choice to avoid the harm (like hiding a disclosure). |
> 💡 Worked example: > Let's revisit the hook. Hiding the disclosure about selling location data in a 50-page document makes the injury (the unwanted sale of sensitive data) "not reasonably avoidable" by the consumer. This squarely hits prong #2 of the unfairness test, making it a very strong claim. > > While it could also be a deceptive omission, the unavoidable nature of the harm is the more powerful and direct argument. The exam will reward the candidate who can identify the strongest claim, not just a plausible one.
Introduction to the U.S. Privacy Environment Practice Questions
Answer the following questions. Read the explanations carefully, especially for the ones you get wrong. Pay attention to why the wrong answers are tempting.
---
Question 1Which of the following best describes the overall approach to data privacy regulation in the United States?
A) A comprehensive, omnibus federal law that governs all data processing. B) A sectoral approach that regulates specific industries and types of data. C) A co-regulatory model where industry self-regulation is the primary source of law. D) A system based exclusively on common law torts enforced through private litigation.
Explanation The correct answer is B. The United States employs a sectoral approach to privacy. This means there are specific laws for specific contexts, such as healthcare (HIPAA), finance (GLBA), and children's online data (COPPA), rather than a single overarching law like the GDPR in Europe.- A is incorrect. This describes the European GDPR model, the opposite of the U.S. system. The exam frequently tests your understanding of this fundamental difference.
- C is incorrect. While self-regulation (like the Digital Advertising Alliance's AdChoices program) plays a role, it is supplementary to and often enforced by statutory law. It is not the primary source.
- D is incorrect. Common law torts (like intrusion upon seclusion) are one source of privacy rights, but they exist alongside a complex web of federal and state statutes.
---
Question 2A mobile app's privacy policy states that it does not share user data with third parties. However, the company routinely sells anonymized location data to data brokers. An investigation reveals that the "anonymized" data can be easily re-identified to link back to specific individuals.
Under Section 5 of the FTC Act, this practice would most likely be considered:
A) Unfair, because the re-identification causes substantial injury. B) Deceptive, because the company's statement is a material misrepresentation. C) A reasonable business practice, as the company attempted to anonymize the data. D) Outside of FTC jurisdiction, as no financial transaction occurred.
Explanation The correct answer is B. This is a classic example of a deceptive practice. The FTC's three-part test for deception asks: 1) Was there a representation, omission, or practice that is likely to mislead? 2) Would a reasonable consumer be misled? 3) Is the representation material? Here, stating data is not shared when it is, even in a supposedly anonymized form that can be re-identified, is a material misrepresentation likely to mislead a reasonable consumer.- A is incorrect but tempting. The re-identification could certainly cause a substantial injury, forming the basis of an unfairness claim. However, the facts present a direct, explicit lie: the privacy policy made a specific promise ("we do not share") and the company broke it. The exam will test your ability to pick the most direct violation. The explicit misrepresentation makes deception the stronger and more immediate claim.
- C is incorrect. The failure of an anonymization technique does not excuse the misrepresentation. The standard is whether the data was actually protected as promised, not whether the company made a failed attempt.
- D is incorrect. FTC jurisdiction is broad and does not require a direct financial transaction. The collection and use of personal information in commerce is sufficient to trigger the FTC's authority over unfair and deceptive acts or practices.
---
Question 3A journalist uses a telephoto lens to take pictures of a celebrity inside their fenced-in, private backyard. The celebrity sues the journalist. Which common law tort is the most likely basis for the lawsuit?
A) Appropriation of name or likeness B) Public disclosure of private facts C) False light D) Intrusion upon seclusion
Explanation The correct answer is D. Intrusion upon seclusion occurs when one intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or their private affairs, and the intrusion would be highly offensive to a reasonable person. Using a telephoto lens to view someone in their private, fenced-in yard is a classic example. The tort is about the act of intruding, regardless of whether any information is published.- A is incorrect. Appropriation involves using someone's name or likeness for commercial advantage without their consent (e.g., using a celebrity's photo in an advertisement).
- B is incorrect. Public disclosure of private facts requires the publication of private information that is not of legitimate public concern. While publishing the photos could lead to this claim, the act of taking them is the intrusion.
- C is incorrect. False light involves publishing information that places someone in a false light that is highly offensive to a reasonable person. It's akin to defamation but doesn't require harm to reputation. This scenario is about the intrusion, not about misrepresentation.
---
Question 4Which U.S. federal agency is the primary enforcer of the Children's Online Privacy Protection Act (COPPA)?
Free 10-Question Diagnostic Assessment
Pinpoint your exact knowledge gaps in 10 minutes and receive a personalized 12-week study roadmap PDF with zero obligation.
A) The Department of Justice (DOJ) B) The Federal Communications Commission (FCC) C) The Federal Trade Commission (FTC) D) The Department of Education
Explanation The correct answer is C. The Federal Trade Commission (FTC) is the primary federal agency responsible for enforcing COPPA. COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age.- A is incorrect. The DOJ can be involved in criminal enforcement but is not the primary civil regulator for COPPA.
- B is incorrect. The FCC's authority generally relates to telecommunications services, though its jurisdiction can sometimes overlap with the FTC's in the digital space. However, for COPPA, the FTC is the designated lead.
- D is incorrect. The Department of Education focuses on privacy in educational institutions, primarily through the Family Educational Rights and Privacy Act (FERPA), not on commercial online services for children.
---
Question 5A financial institution wants to share its customer's nonpublic personal information with a non-affiliated third party for marketing purposes. What must the institution do first under the Gramm-Leach-Bliley Act (GLBA)?
A) Obtain affirmative, opt-in consent from the customer. B) Encrypt the data before sharing it. C) Provide a clear and conspicuous privacy notice and an opportunity to opt out. D) Anonymize the data to remove all personally identifiable information.
Explanation The correct answer is C. The GLBA Privacy Rule requires financial institutions to provide customers with a privacy notice that explains their information-sharing practices. For sharing with most non-affiliated third parties, the institution must also give consumers the right to opt out, meaning they can direct the institution not to share their information.- A is incorrect. GLBA is an "opt-out" regime for this type of sharing, not "opt-in." Opt-in is a higher standard. For example, under the California Privacy Rights Act (CPRA), a business must get opt-in consent to sell or share the personal information of a consumer under 16.
- B is incorrect. The GLBA Safeguards Rule requires reasonable security measures, which would likely include encryption, but the Privacy Rule's notice and opt-out requirement must be met before the sharing can occur at all.
- D is incorrect. While anonymization is a privacy-enhancing technique, it is not the specific procedural requirement mandated by GLBA for sharing nonpublic personal information.
---
Question 6Under the Health Insurance Portability and Accountability Act (HIPAA), which of the following would be considered a "business associate"?
A) A hospital nurse who accesses patient records to provide care. B) A patient's spouse who picks up a prescription. C) A third-party cloud storage provider that hosts electronic health records for a hospital. D) A postal worker who delivers mail containing patient bills.
Explanation The correct answer is C. A "business associate" under HIPAA is a person or entity that performs certain functions or activities on behalf of, or provides services to, a covered entity (like a hospital), which involve the use or disclosure of Protected Health Information (PHI). A cloud provider hosting electronic health records is a prime example. Business associates are directly liable for certain HIPAA violations.- A is incorrect. The nurse is part of the hospital's workforce, not a separate entity acting as a business associate.
- B is incorrect. A patient's spouse is not performing a function on behalf of the covered entity.
- D is incorrect. This is the "conduit" exception. Entities like the U.S. Postal Service, whose only role is to transport PHI but do not have routine access to it, are not considered business associates.
How Should You Interpret Your Score?
Your score here is a valuable data point. It tells you where to focus your efforts for Domain 1.
Scored 5-6: Solidify Your Expertise
You have a strong grasp of the core concepts. Your task is to practice applying them to more complex scenarios. Use VoraPrep's adaptive question bank to drill on intermediate and hard-level questions for this domain, forcing you to distinguish between closely related concepts like the different common law torts or the specific triggers for FTC action.Scored 3-4: Reinforce the Foundations
This is a common result. It means you know the basic definitions but struggle when they are put into a scenario. You might know that the FTC is important, but you're shaky on the specifics of "unfair" versus "deceptive." Your next step is to go back to the source material. Spend your next two study sessions reviewing foundational lessons on the U.S. sectoral approach and the FTC Act in the VoraPrep course before returning to practice questions.Scored 0-2: Build from the Ground Up
Don't worry. This is a fixable problem. It's a sign that you need to build your foundation from the ground up. Trying to pass by just answering practice questions will lead to frustration. Start with the first lesson in the VoraPrep CIPP/US study guide and work through it systematically. Our personalized study planner can create a day-by-day schedule to get you back on track.Get More CIPP Practice on VoraPrep
A handful of sample questions is a good start, but it's not enough to get you across the finish line. The CIPP/US exam has a challenging pass rate because it tests your ability to apply knowledge under pressure, a skill that determines if the CIPP/US is worth it for your career.
That's why VoraPrep offers a complete, 6-pillar CIPP/US course designed to build true mastery. We provide:
- Textbook-Grade Lessons: Clear lessons that cover every topic on the IAPP blueprint.
- Adaptive Practice: A bank of over 1,400 exam-calibrated questions that target your weak spots.
- 1:1 Exam Simulators: Full-length, timed mock exams that replicate the real Prometric testing experience.
- Spaced-Repetition Flashcards: Smart flashcards to help you memorize key terms, timelines, and legal tests.
- Personalized Study Plan: A dynamic calendar that tells you exactly what to study each day.
- Vory, Your 24/7 Tutor: Stuck on a question? Ask Vory for a step-by-step explanation, available 24/7.
See how VoraPrep's complete, 6-pillar course compares to outdated video bundles that cost thousands more. We provide a complete, interactive course starting at just $25/month. You can find more details on our CIPP/US exam format breakdown.