Passing the CIPP/US feels like learning a playbook. But Domain 2 is like being a paramedic at a multi-car pileup. It’s not about reciting the textbook; it’s about making an instant triage decision. Is this a HIPAA case, a GLBA case, or a COPPA case? The wrong call isn't just a point lost; it's a failure of professional judgment.
These free practice questions test your ability to apply the correct sector-specific law (HIPAA, GLBA, COPPA, FTC Act) to complex scenarios in Domain 2 of the CIPP/US exam. They are a diagnostic tool to pinpoint weaknesses in the exam's most challenging, application-focused section, which requires judgment, not just memorization.
Key facts
- Exam Domain: CIPP/US Domain 2: Limits on Private-Sector Collection and Use of Data
- Domain Weighting: Approximately 27% of the exam
- Key Laws: FTC Act, HIPAA/HITECH, GLBA, FCRA/FACTA, COPPA, FERPA, VPPA
- Question Format: Multiple-choice with a single best answer
- Official Body: International Association of Privacy Professionals (IAPP)
- Passing Score: Not officially published; estimated around 65-70% correct
The IAPP reports there are over 40,000 CIPP-certified professionals worldwide (IAPP), making it a critical credential for career advancement in privacy.
How to Use This Domain 2 Diagnostic Quiz
This is not a random list of questions. It's a diagnostic tool designed to simulate the logic of the real CIPP/US exam's second domain. This section accounts for roughly 27% of your score, and your ability to apply these rules under pressure is non-negotiable.
Studying for CIPP/US CIPP2? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
The questions are aligned with the 2026 IAPP Body of Knowledge and cover the major federal privacy laws you must know cold:
- FTC Act: The foundational law against "unfair or deceptive" practices.
- Healthcare (HIPAA/HITECH): Rules for Protected Health Information (PHI).
- Financial (GLBA/FCRA/FACTA): Rules for Nonpublic Personal Information (NPI) and credit reporting.
- Education (FERPA): Rules for student education records.
- Children's Privacy (COPPA): Rules for collecting data from children under 13.
Pay close attention to the explanations. The goal is to understand why the right answer is right and why the distractors are tempting but wrong. This is how you learn to think like the exam writers. For a complete set of over 1,400 adaptive questions and a personalized study plan, you can try VoraPrep's complete CIPP/US course with a free trial.
CIPP/US Domain 2: Practice Questions & Explanations
Work through these questions one by one. Read the fact pattern carefully, identify the key players and the type of data involved, and then select the best possible answer.
Question 1
A mobile gaming company launches a new app targeted at middle school students. The app includes social features that allow users to create profiles with their full name, photo, and location. The company's privacy policy, available via a link at the bottom of the sign-up page, states that it collects this information. To sign up, a user must simply click "I Agree." The company does not implement any age-verification mechanism. Which law is the company most likely violating?
A) The Children's Television Act (CTA) B) The Family Educational Rights and Privacy Act (FERPA) C) The Children's Online Privacy Protection Act (COPPA) D) The FTC Act Section 5 for deceptive practices
Answer and Explanation Correct Answer: (C)
The Children's Online Privacy Protection Act (COPPA) applies to operators of commercial websites or online services either directed to children under 13 OR who have actual knowledge they are collecting personal information from children under 13. This scenario triggers the "directed to" prong ("targeted at middle school students"). COPPA requires verifiable parental consent before collecting personal information like a "full name, photo, and location." A simple "I Agree" button is insufficient.
Why the others are wrong:- (A) The CTA governs advertising on children's television, not data collection in mobile apps.
- (B) FERPA applies to educational records maintained by educational institutions. This is a classic distractor that confuses a law related to children with the correct law for this commercial context.
- (D) While this might also be an "unfair" practice under the FTC Act, COPPA is the specific and more directly applicable law. The exam always favors the most precise answer.
Question 2
A regional bank, "First Fiduciary," wants to share its customer list, including names, addresses, and transaction histories, with a non-affiliated insurance company for marketing purposes. Under the Gramm-Leach-Bliley Act (GLBA), what must First Fiduciary do before sharing this information?
A) Obtain express, opt-in consent from each customer. B) Provide a clear privacy notice and an opportunity for customers to opt out. C) Anonymize the data before sharing it. D) Nothing, as this is a permissible use for marketing.
Answer and Explanation Correct Answer: (B)
The Gramm-Leach-Bliley Act (GLBA) governs how "financial institutions" handle Nonpublic Personal Information (NPI). To share NPI with a non-affiliated third party for marketing, the institution must provide customers with a clear privacy notice and a reasonable opportunity to opt out of the sharing.
Why the others are wrong:- (A) Express, opt-in consent is a higher standard than what GLBA requires for this specific type of sharing. Don't confuse GLBA's opt-out model with stricter opt-in requirements found in other laws (like HIPAA's "authorization" for marketing).
- (C) Anonymizing the data would remove it from GLBA's scope, but the question asks what is required to share the identifiable customer list.
- (D) This is incorrect. Sharing NPI with non-affiliates is highly regulated by GLBA.
Question 3
A patient asks their hospital for a copy of their medical records in an electronic format. The hospital's administrator informs the patient that their system can only produce paper printouts and it will take 45 days. According to the Health Insurance Portability and Accountability Act (HIPAA), as amended by HITECH, is the hospital's response compliant?
A) Yes, because HIPAA allows for a 45-day response time. B) Yes, because the hospital is not required to provide records in an electronic format if its system cannot do so. C) No, because the hospital must provide electronic access within 15 days. D) No, because if the records are maintained electronically, the hospital must provide them in the requested electronic format if it is readily producible.
Answer and Explanation Correct Answer: (D)
The HITECH Act strengthened HIPAA's right of access. If a covered entity maintains Protected Health Information (PHI) electronically, it must provide an electronic copy in the format requested if "readily producible." The standard response time is within 30 days. The hospital can take one 30-day extension if they notify the patient, for a maximum of 60 days. A 45-day response without justification is non-compliant, as is the refusal to provide an electronic copy simply because the system's default is paper.
Why the others are wrong:- (A) The standard response time is 30 days, not 45. While an extension is possible, 45 days is not the rule.
- (B) This is a common misconception. "Readily producible" requires a reasonable effort; a covered entity cannot simply claim inability if the underlying data is electronic.
- (C) The timeline is 30 days, not 15.
Question 4
An online news subscription service, "Daily Digital," uses video clips to supplement its articles. The service discloses a subscriber's viewing history to a third-party analytics firm to improve its recommendation engine. The user agreement, which users agree to at sign-up, mentions this practice. This disclosure likely violates which of the following laws?
A) The Cable Communications Policy Act B) The Electronic Communications Privacy Act (ECPA) C) The Video Privacy Protection Act (VPPA) D) The Fair Credit Reporting Act (FCRA)
Answer and Explanation Correct Answer: (C)
The Video Privacy Protection Act (VPPA) prohibits "video tape service providers" (a term now interpreted to include online streaming services) from disclosing a consumer's viewing history without their informed, written consent. This consent must be separate from a general user agreement and can be given in advance for a set period not to exceed two years. A clause buried in a user agreement does not meet this high standard.
Why the others are wrong:- (A) The Cable Communications Policy Act applies specifically to cable operators.
- (B) ECPA governs the interception of electronic communications, not the disclosure of a viewing history log.
- (D) FCRA relates to consumer credit information.
Question 5
A consumer applies for a car loan and is denied. The lender, a bank, based its decision in part on a low credit score obtained from a credit reporting agency. What is the lender required to do under the Fair Credit Reporting Act (FCRA)?
A) Provide the consumer with a free copy of their credit report. B) Inform the consumer of the specific reasons for the denial. C) Notify the consumer of the adverse action and provide the name of the agency that supplied the report. D) Erase the record of the loan application after 90 days.
Answer and Explanation Correct Answer: (C)
When a user of a consumer report (the lender) takes an "adverse action" (denying the loan), the FCRA requires them to provide an adverse action notice. This notice must include the name and contact information of the credit reporting agency that supplied the report and a statement of the consumer's right to get a free copy of their report from that agency.
Why the others are wrong:- (A) The lender does not provide the report. Their duty is to inform the consumer how to get it from the credit reporting agency. This is a critical distinction.
- (B) This is a tempting distractor. While the Equal Credit Opportunity Act (ECOA) often applies in these scenarios and does require the lender to provide the specific reasons for the denial, the question specifically asks about the lender's requirement under the FCRA. The FCRA's core requirement is pointing to the source of the report.
- (D) FCRA does not impose such a deletion requirement.
Question 6
A university professor posts a list of student grades for a final exam on the door of her office. The list identifies students by their full names. This action is a violation of which law?
A) The Health Insurance Portability and Accountability Act (HIPAA) B) The Family Educational Rights and Privacy Act (FERPA) C) The Gramm-Leach-Bliley Act (GLBA) D) The Privacy Act of 1974
Answer and Explanation Correct Answer: (B)
The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student "education records" at all educational institutions that receive federal funding. Grades are a core part of an education record. Publicly posting grades linked to student names is an impermissible disclosure of personally identifiable information without consent.
Why the others are wrong:- (A) HIPAA applies to health information.
- (C) GLBA applies to financial information.
- (D) The Privacy Act of 1974 applies to records held by federal government agencies. FERPA is the specific law governing student records at educational institutions.
Question 7
The Federal Trade Commission (FTC) brings an enforcement action against a company for making false claims in its privacy policy about how it uses customer data. What is the FTC's primary source of authority for this action?
A) The Telemarketing and Consumer Fraud and Abuse Prevention Act B) The CAN-SPAM Act C) Section 5 of the FTC Act D) The U.S. Constitution's commerce clause
Answer and Explanation Correct Answer: (C)
The FTC's broad enforcement power in privacy comes from Section 5 of the FTC Act, which prohibits "unfair or deceptive acts or practices." A company that fails to honor the promises made in its privacy policy is committing a "deceptive" practice. This is the basis for hundreds of FTC enforcement actions.
Why the others are wrong:- (A) This act targets telemarketing fraud.
- (B) The CAN-SPAM Act regulates commercial email.
- (D) The commerce clause is the constitutional basis for the FTC Act, but the FTC's direct statutory authority is Section 5 itself.
Question 8
A "business associate" under HIPAA is an entity that:
Calculate Your CIPP/US Score & Study Hours by Domain
Adjust your practice scores across official CIPP/US blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
A) Provides healthcare services directly to patients. B) Performs a function or activity for or on behalf of a covered entity that involves the use or disclosure of PHI. C) Is a subsidiary of a hospital or insurance company. D) Has signed a confidentiality agreement with a patient.
Answer and Explanation Correct Answer: (B)
This is a core definition. A "business associate" (BA) performs functions for or on behalf of a covered entity that involve access to Protected Health Information (PHI). Examples include a billing company, a cloud storage provider, or an attorney. This definition also extends to subcontractors of a BA that handle PHI. A covered entity must have a written "business associate agreement" (BAA) with the BA.
Why the others are wrong:- (A) An entity providing healthcare directly to patients is a "covered entity" (a provider).
- (C) Corporate structure does not determine BA status; the function performed is what matters.
- (D) The required agreement is a BAA between the covered entity and the business associate, not an agreement with the patient.
Question 9
The "Red Flags Rule," which requires financial institutions and creditors to develop a program to detect the signs of identity theft, was issued under which law?
A) The Bank Secrecy Act B) The Sarbanes-Oxley Act C) The Fair and Accurate Credit Transactions Act (FACTA) D) The Right to Financial Privacy Act
Answer and Explanation Correct Answer: (C)
The Red Flags Rule was mandated by the Fair and Accurate Credit Transactions Act (FACTA), which amended the Fair Credit Reporting Act (FCRA). It requires organizations to implement a written Identity Theft Prevention Program.
Question 10
Which of the following is generally NOT considered "Nonpublic Personal Information" (NPI) under the Gramm-Leach-Bliley Act (GLBA)?
A) A customer's account balance. B) A list of a bank's customers' names and addresses derived from a public telephone directory. C) Information from a consumer report. D) Any information a consumer provides to a financial institution to obtain a financial product.
Answer and Explanation Correct Answer: (B)
GLBA's definition of NPI excludes publicly available information. A list derived solely from a public phone book, with no other data from the bank's own records, would not be NPI. However, it's critical to remember that if a financial institution combines this public data with NPI (like an account number), the entire combined dataset becomes "tainted" and is treated as protected NPI.
Why the others are wrong:- (A), (C), and (D) are all classic examples of NPI. Account information, data from a credit report, and application data are not publicly available and are protected by GLBA.
Key U.S. Privacy Law Comparison
To succeed in Domain 2, you must be able to instantly differentiate these laws. Use this table as a reference.
| Law | Primary Scope | Protected Data | Regulated Entities | Consent Standard (General Rule) |
|---|---|---|---|---|
| HIPAA | Healthcare | Protected Health Information (PHI) | Covered Entities & Business Associates | Authorization (Opt-in) for most disclosures |
| GLBA | Financial Services | Nonpublic Personal Information (NPI) | Financial Institutions | Notice & Opt-out for sharing with non-affiliates |
| COPPA | Children's Online Privacy | Personal Information from children <13 | Operators of commercial websites/online services | Verifiable Parental Consent (Opt-in) |
| FERPA | Education | Education Records | Educational institutions receiving federal funds | Written Consent (Opt-in) |
| VPPA | Video Content | Video Viewing History (PII) | Video Tape Service Providers | Written Consent (Opt-in), separate from terms |
| FCRA | Credit Reporting | Consumer Reports | Consumer Reporting Agencies (CRAs) & users of reports | Permissible Purpose (no consumer consent needed) |
Your 7-Day Turnaround Plan for Mastering Domain 2
Be honest about your score on the quiz. This is a tough domain. The pass rate for the CIPP/US is around 65%, and struggles in this section are a primary reason candidates fail. Use your score as a diagnostic to guide your next week of study.
If you scored 8-10: You have a strong command of the major laws. Your focus for the next week is on subtle distinctions and edge cases.- Day 1-2: Use the table above to chart the consent requirements: HIPAA Authorization vs. VPPA written consent vs. GLBA opt-out vs. COPPA verifiable parental consent.
- Day 3-4: Review the specific definitions. What legally makes an entity a "consumer reporting agency" under FCRA or a "financial institution" under GLBA?
- Day 5-7: Use the VoraPrep adaptive question bank to drill questions specifically tagged "FTC" and "HIPAA" to master the nuances. Ask Vory, your 24/7 tutor, to explain any concepts that are still unclear.
- Day 1-2: Focus on one law per day. Today is HIPAA only. Review PHI, covered entities, and business associates. Tomorrow is GLBA only.
- Day 3-4: Create flashcards for every acronym. You must instantly define PHI, NPI, FCRA, FACTA, FERPA, and COPPA and name the sector they apply to.
- Day 5-7: Go through VoraPrep's textbook-grade lessons for Domain 2. Don't just read. Take notes and complete the integrated quiz questions after each chapter. A structured approach is crucial.
- Day 1-3: Start with the broadest law: the FTC Act. Read the FTC's own guidance on Section 5. Understand what "unfair" and "deceptive" mean in practice. This is your foundation.
- Day 4-7: Begin a systematic review using a complete course. This is not the time for random questions. A platform like VoraPrep provides a personalized daily study plan that will guide you through the entire IAPP blueprint, starting with your weakest areas first.
Why a Structured Course Beats Random Questions
A short quiz is a great diagnostic, but it's not a complete study system. Passing the CIPP/US requires a deeper, systematic approach.
This is where VoraPrep is different from overpriced, passive video lectures. We offer a complete, 6-pillar interactive course designed to get you exam-ready efficiently.
- Complete Lessons & Study Guides: Clear, step-by-step lessons covering every topic in the IAPP blueprint.
- Adaptive Practice Bank: Our bank of 1,400+ questions adapts to your performance, giving you more exposure to your weak spots.
- 1:1 Exam Simulators: Full-length, timed mock exams that replicate the real testing environment.
- Spaced-Repetition Flashcards: Drill key definitions and thresholds until they are locked in.
- Personalized Study Plan: Enter your exam date, and our platform builds a dynamic calendar to keep you on track.
- Vory, Your 24/7 Tutor: Stuck on the GLBA Safeguards Rule at 2 AM? Ask Vory for a step-by-step explanation.
Don't just memorize facts. Learn to think like the examiner with VoraPrep.
Frequently asked questions
What is the hardest part of CIPP/US Domain 2?
The most difficult aspect is correctly identifying which sector-specific law applies to a complex scenario under time pressure. The exam tests your ability to diagnose the facts (e.g., health data, financial entity) before applying the correct rule.
How many questions are on the CIPP/US exam from Domain 2?
Domain 2 makes up approximately 27% of the exam. On a 90-question exam, this translates to about 24-25 questions, making it a critical section for passing.
Are these free cipp mcq practice questions similar to the real exam?
Yes, these questions are structured to reflect the style and difficulty of the actual CIPP/US exam, focusing on scenario-based application of the law, which is how the IAPP tests your knowledge.
Where can I find more CIPP/US sample questions?
You can find a broader set of sample questions covering all five domains. For full preparation, the VoraPrep CIPP/US course includes over 1,400 adaptive practice questions with detailed explanations.