A local police department serves your company with a standard subpoena for the content of a user's emails from the last 60 days. Must you comply? If you answered "yes," you've just fallen for the most common and costly trap in Domain 3 of the CIPP/US exam. The answer is no, and understanding precisely why is the difference between passing and failing.
These free CIPP/US practice questions cover Domain 3, "Government and Court Access to Private-Sector Information." This domain tests your judgment on the legal standards U.S. government entities must meet to compel data from private companies under statutes like the Electronic Communications Privacy Act (ECPA), FISA, and the Right to Financial Privacy Act (RFPA).
Key facts
- Official Body: International Association of Privacy Professionals (IAPP)
- Domain 3 Weighting: 21% of the exam
- Exam Format: 90 multiple-choice questions
- Exam Length: 2.5 hours (150 minutes)
- Industry Pass Rate Estimate: ~65%
- Recommended Study: 60-100 hours
While the IAPP does not publish official results, industry analysis suggests the CIPP/US pass rate hovers around 65%, making targeted practice on complex domains essential.
The Three Tiers of Government Access Under ECPA
The single most tested concept in Domain 3 is the tiered framework of the Electronic Communications Privacy Act (ECPA). The exam will relentlessly test your ability to match the correct legal instrument to the correct data type. Memorizing this table is non-negotiable.
| Legal Instrument | Legal Standard Required | Types of Data Accessible |
|---|---|---|
| Subpoena | Relevance to an investigation | Basic subscriber information (name, address, length of service, payment info). |
| § 2703(d) Order | "Specific and articulable facts" showing relevance and materiality. | Non-content records (email logs, IP addresses, cell site location data). |
| Search Warrant | Probable cause | Content of communications (emails, text messages, photos, stored files). |
This framework is your foundation. Almost every scenario question in this domain comes back to these fundamental distinctions. Try VoraPrep's free CIPP/US practice questions to see how these tiers are tested in different fact patterns.
Studying for CIPP/US? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Government and Court Access to Private-Sector Information Practice Questions
These questions are not about simple recall. They are designed to replicate the judgment-based scenarios you will face on the actual CIPP/US exam, forcing you to apply the correct legal standard under pressure.
Answer the following questions, then check your score and the detailed explanations below.
Question 1A local police department sends a subpoena to a cloud storage provider demanding access to all photos a specific user has stored on their service for the past year. The user is a suspect in a robbery investigation. Under the Stored Communications Act (SCA), what is the provider's obligation?
Question 2
The FBI issues a National Security Letter (NSL) to a telecommunications company. Which of the following types of information can the government compel the company to produce with the NSL?
Question 3
A federal agency is investigating a case of financial fraud. They want to obtain an individual's financial records from their bank without notifying the individual. Which law primarily governs the agency's ability to do this?
Question 4
The Communications Assistance for Law Enforcement Act (CALEA) requires telecommunications carriers to:
Question 5
A federal prosecutor wants to obtain transactional records from an internet service provider (ISP) showing every IP address a user connected to over the past 90 days. The prosecutor does not have probable cause for a warrant. What is the minimum level of legal process required?
Question 6
The Foreign Intelligence Surveillance Court (FISC) primarily authorizes surveillance requests related to:
Question 7
Under the Privacy Protection Act of 1980 (PPA), law enforcement is generally prohibited from searching or seizing which of the following from a journalist?
Question 8
A social media company receives a request under the Stored Communications Act (SCA) for the content of private messages that have been stored on its servers for more than 180 days. Which legal instrument is required for the government to compel disclosure?
Explanations
Explanation for Question 1 The correct answer is C. The provider is prohibited from turning over the photos with only a subpoena.Under the Stored Communications Act (part of ECPA), the content of electronic communications requires a search warrant based on probable cause. Photos are considered content.
- Why A is wrong: A subpoena is insufficient for compelling the disclosure of content. It can only be used for basic subscriber information (name, address, etc.). This is the most common trap on the exam.
- Why B is wrong: Notifying the user does not cure the defect of using a subpoena for content. Furthermore, law enforcement often seeks delayed notification to avoid tipping off a suspect.
- Why D is wrong: While a subpoena could potentially be used for some non-content metadata, the request is for the photos themselves (the content), which requires a warrant.
National Security Letters are administrative subpoenas that do not require prior judicial approval to be issued. However, their scope is strictly limited by statute to non-content information, and recipients have a statutory right to challenge them in court (judicial review).
- Why A is wrong: The content of communications can never be obtained with an NSL. It requires a warrant (or a FISA order for foreign intelligence).
- Why B is wrong: A list of websites visited is considered more sensitive transactional data. Obtaining this would generally require a § 2703(d) court order or a warrant.
- Why D is wrong: Cell site location information (CSLI) has been the subject of significant legal debate. Following the Supreme Court's decision in Carpenter v. United States, obtaining historical CSLI is considered a search and requires a warrant. An NSL is not sufficient.
The RFPA of 1978 establishes statutory procedures that federal government authorities must follow to obtain a customer's records from a financial institution. It generally requires customer notice and an opportunity to object, though there are exceptions for delayed notice.
- Why A is wrong: The FCRA governs the use of consumer credit reports for decisions on credit, insurance, and employment. It does not primarily govern government access for investigations.
- Why B is wrong: The GLBA requires financial institutions to protect the security and confidentiality of customer information, but the RFPA specifically details the process for government requests.
- Why D is wrong: The Bank Secrecy Act requires financial institutions to assist the government in detecting and preventing money laundering. It creates disclosure obligations, whereas the RFPA creates a privacy shield against government access.
CALEA was passed to ensure that as technology evolved, law enforcement's ability to conduct lawful wiretaps would not be diminished. It mandates that carriers design their systems to be "wiretap-ready." It also covers Pen Register and Trap and Trace capabilities.
- Why A is wrong: CALEA does not contain a specific data retention mandate. Data retention requirements are found in other regulations and vary by data type.
- Why C is wrong: CALEA does not grant any new surveillance authority or bypass the warrant requirement. It is a technical compliance law that ensures a carrier can execute a lawful order when it receives one.
- Why D is wrong: This describes a requirement of the Bank Secrecy Act, not CALEA.
An FBI agent is investigating a user. Here is what she needs to get different types of data from ConnectMe:
- To get Basic Subscriber Information (User's name, address, payment info): The agent can use a simple subpoena. This is the lowest bar.
- To get Transactional/Non-Content Records (Logs of who the user emailed and when, IP addresses used): The agent needs a § 2703(d) court order. To get this, she must provide "specific and articulable facts" showing the information is relevant to an ongoing criminal investigation. This is a higher standard than a subpoena but lower than a warrant.
- To get the Content of Communications (The actual text of the emails):
- If the emails are in storage for 180 days or less, the agent needs a search warrant based on probable cause. No exceptions.
- If the emails are in storage for more than 180 days, the rules become complex. While the statute technically allows for a subpoena (with notice) or a 'd' order in some cases, the Sixth Circuit's decision in U.S. v. Warshak found a constitutional right to privacy in email content, requiring a warrant regardless of age. Modern industry practice, and the safest answer on the exam, is that a warrant is required for content.
This type of non-content, transactional data falls squarely under 18 U.S.C. § 2703(d). It is more than basic subscriber information (which needs a subpoena) but is not the content of a communication (which needs a warrant). The 'd' order is the specific legal tool designed for this middle tier of data.
- Why A is wrong: A subpoena is insufficient for this level of detailed transactional data.
- Why C is wrong: A search warrant would certainly be sufficient, but the question asks for the minimum level of process required. A 'd' order has a lower evidentiary standard than probable cause.
- Why D is wrong: An NSL is used for national security investigations and is generally limited to more basic subscriber and toll billing records, not a complete log of IP address connections.
FISA created a parallel legal framework for gathering foreign intelligence. The FISC reviews government applications for electronic surveillance, physical searches, and other intelligence-gathering activities targeting foreign powers or agents of foreign powers.
- Why A and D are wrong: The FISC's jurisdiction is for foreign intelligence purposes. Ordinary federal crimes and purely domestic terrorism cases are handled through the standard criminal justice system under Title III and ECPA, requiring warrants from regular federal courts.
- Why C is wrong: The FISC is a government court dealing with national security, not a venue for resolving private civil disputes.
The Privacy Protection Act of 1980 was passed in response to the Supreme Court case Zurcher v. Stanford Daily. It protects journalists from being subjected to surprise searches by law enforcement seeking their notes, interview tapes, and other "work product." Law enforcement is generally required to use a subpoena instead of a search warrant, which gives the journalist notice and an opportunity to challenge the request in court.
- Why A, B, and D are wrong: The PPA's primary protection is for materials related to public communication. It does not create a blanket shield for all property, financial records, or other business documents a journalist may possess.
For content held in "electronic storage" by an Electronic Communications Service (ECS) for 180 days or less, a warrant is always required.
For content held for more than 180 days, the rules diverge based on the type of service:
- If held by an ECS in electronic storage, the government needs either a warrant or a § 2703(d) order. A subpoena is not sufficient.
- If held by a Remote Computing Service (RCS), the government can use a warrant, a § 2703(d) order, or a subpoena (but if using a subpoena, they must give prior notice to the customer).
Since the question asks what is required and does not specify the type of service, option B is the best answer because it includes the valid options under the statute's text. You must know this statutory distinction for the exam, even though the constitutional standard from Warshak pushes practice towards a warrant requirement for all content.
- Why A is wrong: A warrant is required for content 180 days or younger. While a warrant would also work for older content, the question asks what is required by statute, which provides lower-standard options.
- Why C is wrong: A subpoena with notice is only one possible option, and only for an RCS. A 'd' order is also sufficient, making B a more complete answer.
- Why D is wrong: An NSL can never be used to obtain the content of communications.
Calculate Your CIPP/US Score & Study Hours by Domain
Adjust your practice scores across official CIPP/US blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How Did You Score?
Count your correct answers and see where you stand on Domain 3.
- 0-3 Correct: You have some foundational gaps. The distinction between subpoenas, 'd' orders, and warrants is critical. Your first step is to re-read the ECPA and SCA sections of your study text and master the comparison table in this article.
- 4-7 Correct: You have a decent grasp of the major laws but are getting caught by the nuances, like the 180-day rule or the limits of NSLs. Your next step is to drill these specific topics. Use an adaptive learning engine to master these nuances with VoraPrep's CIPP/US question bank until you score consistently above 85%.
- 8+ Correct: Excellent work. You have a strong, detailed command of this domain. Your focus now should be on speed and confidence. Continue doing mixed-domain practice sets to ensure you can switch contexts quickly, as you will have to on exam day.
Get More CIPP Practice on VoraPrep
A handful of sample questions can show you the gaps, but a complete question bank is what fills them. If you found yourself struggling with the distinctions between different legal processes, that’s a signal you need more focused practice.
Legacy CIPP review courses often rely on passive video lectures and a few hundred static questions. That is not enough to master a judgment-based exam.
VoraPrep is a complete, 6-pillar interactive course built for busy professionals. It includes:
- Textbook-Grade Lessons: Clear, concise study guides covering every IAPP blueprint topic.
- Adaptive Practice Banks: Over 1,400 exam-calibrated questions that automatically focus on your weak areas.
- 1:1 Exam Simulators: Full-length, timed mock exams that replicate the real testing environment.
- FSRS Spaced-Repetition Flashcards: To lock in key terms, statutes, and legal standards.
- Personalized Study Plan: A dynamic calendar that tells you exactly what to study each day to be ready by your exam date.
- Vory, Your 24/7 Personal Tutor: If you don't understand why an answer is correct, ask Vory for a step-by-step explanation, right inside the question.
See a full breakdown of how VoraPrep compares to older, more expensive options in our objective comparison of the best CIPP review courses.