Domain 5, State Privacy Laws, accounts for 24-26% of the total CIPP/US exam score, making it the most heavily weighted section. Yet most candidates fail not because they don't know the laws, but because they can't distinguish between nearly identical requirements under pressure. This is where a passing score is earned or lost.
This page provides 10 free CIPP/US practice questions for Domain 5, State Privacy Laws. They cover the California (CPRA), Virginia (VCDPA), Colorado (CPA), Utah (UCPA), and Connecticut (CTDPA) laws to test your ability to apply specific revenue thresholds, consumer rights, and key definitions in exam-like scenarios.
Key facts
- Official Exam: Certified Information Privacy Professional / United States (CIPP/US)
- Official Body: International Association of Privacy Professionals (IAPP)
- Exam Domains: 5 (Domain 5, State Privacy Laws, is 24-26% of your score)
- Question Format: 90 multiple-choice questions
- Passing Score: Approximately 70-75% (scaled score of 300 out of 500)
- Typical Study Time: 60-100 hours
What Do These CIPP/US Practice Questions Cover?
This isn't a random list of facts. These 10 questions are calibrated to mimic the real CIPP/US exam, testing your judgment on the nuances of Domain 5. They are designed by certified professionals who have passed the exam and coached hundreds of candidates to a pass.
The questions cover a mix of difficulties and are aligned directly with the IAPP's official Body of Knowledge for 2026. You'll see questions on:
- Applicability thresholds (revenue, data volume)
- Definitions of "personal information," "sale," and "sharing"
- Consumer rights (access, deletion, opt-out)
- Controller and processor obligations
- Data Protection Assessments (DPAs)
The goal isn't just to get them right. It's to understand why the correct answer is the best choice and, just as importantly, why the wrong answers are tempting but incorrect. Try VoraPrep's adaptive CIPP/US question bank for over 1,400 more questions like these.
Studying for CIPP/US? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
State Privacy Law Comparison Chart (The "Big 5")
The single most effective way to master this domain is to compare the laws side-by-side. Memorize this table.
| Feature | California (CCPA/CPRA) | Virginia (VCDPA) | Colorado (CPA) | Utah (UCPA) | Connecticut (CTDPA) |
|---|---|---|---|---|---|
| Applicability | OR logic: >$25M revenue; OR Buy/Sell/Share PI of 100k+ consumers; OR 50%+ revenue from Selling/Sharing PI. | OR logic: Control/process PI of 100k+ consumers; OR Control/process PI of 25k+ consumers & >50% revenue from selling PI. | OR logic: Control/process PI of 100k+ consumers; OR Control/process PI of 25k+ consumers & derive revenue from selling PI. | AND logic: >$25M revenue AND (Control/process PI of 100k+ consumers OR Control/process PI of 25k+ consumers & >50% revenue from selling PI). | OR logic: Control/process PI of 100k+ consumers; OR Control/process PI of 25k+ consumers & >25% revenue from selling PI. |
| "Sale" Definition | Monetary or other valuable consideration. | Monetary consideration only. | Monetary or other valuable consideration. | Monetary consideration only. | Monetary or other valuable consideration. |
| Opt-Out of Profiling | Right to know about automated decision-making. | Yes, for decisions with legal or similarly significant effects. | Yes, for decisions with legal or similarly significant effects. | No explicit right. | Yes, for decisions with legal or similarly significant effects. |
| Recognize GPC? | Yes, mandatory. | No. | Yes, mandatory. | No. | Yes, mandatory. |
| Response Time | 45 days (+45 day extension) | 45 days (+45 day extension) | 45 days (+45 day extension) | 45 days (+45 day extension) | 45 days (+45 day extension) |
CIPP/US State Privacy Laws Practice Questions
Answer the following questions, then check your score and read the detailed explanations below.
Question 1
A Colorado-based e-commerce company, "Mountain Mugs," has $30 million in annual global revenue. It processes the personal data of 80,000 Colorado residents and 15,000 Virginia residents annually. The company derives 40% of its gross revenue from the sale of personal data. Which state privacy law applies to Mountain Mugs?
Question 2
Under the California Privacy Rights Act (CPRA), a consumer's "Right to Limit Use and Disclosure of Sensitive Personal Information" applies to which of the following scenarios?
Question 3
A business operates exclusively in Utah and has annual revenue of $20 million. It processes the personal data of 150,000 Utah residents annually. It does not sell personal data. Which statement is correct regarding the Utah Consumer Privacy Act (UCPA)?
Question 4
Which of the following state privacy laws provides consumers with a right to opt out of the processing of personal data for the purposes of profiling in furtherance of decisions that produce legal or similarly significant effects?
Question 5
A "sale" of personal data under the Virginia Consumer Data Protection Act (VCDPA) is defined as:
Question 6
A company subject to the Colorado Privacy Act (CPA) must conduct a Data Protection Assessment (DPA) for which of the following processing activities?
Question 7
Under the Connecticut Data Privacy Act (CTDPA), what is the default time period for a controller to respond to a consumer rights request?
Question 8
A retail company uses a third-party analytics provider to process customer data on its behalf to improve its services. Under the VCDPA, the analytics provider is most likely considered a:
Question 9
Which state's privacy law has an applicability threshold that requires a business to both control or process the data of a certain number of consumers and meet a specific revenue figure?
Question 10
A California resident submits a verifiable request to a business to delete their personal information. The business uses this information to complete transactions for which the data was collected. Which of the following is a valid reason for the business to deny the deletion request?
Answer Key & Explanations
1. D) Neither the CPA nor the VCDPA- Rationale: This is a multi-step analysis the exam requires you to perform quickly.
- Colorado (CPA) Analysis: The CPA applies if a business controls/processes data of (1) 100,000+ CO consumers OR (2) 25,000+ CO consumers and derives revenue from data sales. Mountain Mugs processes 80,000 CO consumers' data. This is less than 100,000, so it fails test (1). It is more than 25,000, but the second part of test (2) is not met because this test is for businesses that derive revenue from selling data. Wait, the company does derive revenue from data sales. So it meets the 25,000+ consumer threshold and the revenue derivation threshold. Therefore, CPA does apply.
- Virginia (VCDPA) Analysis: The VCDPA applies if a business controls/processes data of (1) 100,000+ VA consumers OR (2) 25,000+ VA consumers and derives over 50% of gross revenue from data sales. Mountain Mugs processes 15,000 VA consumers' data. This is below both the 100,000 and 25,000 thresholds. Therefore, the VCDPA does not apply.
- Conclusion: Based on this, the correct answer is A) Only the Colorado Privacy Act (CPA). The original question's scenario was designed to be tricky. Let's walk through it again with absolute precision. For CPA, it's (1) 100,000+ consumers OR (2) 25,000+ consumers AND derive revenue from sale of personal data. The company processes 80,000 CO consumers, so it meets the second prong (80k > 25k and it derives revenue). CPA applies. For VCDPA, it's (1) 100,000+ consumers OR (2) 25,000+ consumers AND derive over 50% revenue from sale. The company processes 15,000 VA consumers, failing to meet the 25,000 consumer floor for the second prong. It fails both prongs. VCDPA does not apply. The correct answer is A.
- Rationale: The CPRA grants consumers the right to limit the use and disclosure of their sensitive personal information (SPI) to that which is "necessary to perform the services or provide the goods reasonably expected by an average consumer." Using SPI for purposes like security, performing the core service, or transient use are generally permissible exceptions. Using it for cross-context behavioral advertising is a secondary use that consumers have the right to limit.
- Rationale: The Utah Consumer Privacy Act (UCPA) is unique. It uses an "AND" logic for its main threshold. A business must have annual revenue of $25 million or more AND meet one of the data processing thresholds. Since this company's revenue is only $20 million, it fails to meet the mandatory revenue gateway. It does not matter that it processes data for 150,000 consumers; the UCPA does not apply.
- Rationale: The right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects is a specific right granted under the VCDPA, CPA, and CTDPA. The CCPA/CPRA provides a right to know about automated decision-making and an ability to opt-out of "sale/sharing" of data, but it is not framed in this exact way.
- Rationale: This is a crucial distinction. While California's CCPA/CPRA has a broad definition of "sale" that includes "monetary or other valuable consideration," both the VCDPA and the UCPA define it narrowly as an exchange for monetary consideration only. The exam will absolutely test your knowledge of this difference.
- Rationale: The CPA requires Data Protection Assessments (DPAs) for processing activities that present a heightened risk of harm to a consumer. The law specifically enumerates several of these activities, including processing for targeted advertising, selling personal data, and processing sensitive data. Processing de-identified data or small volumes of data does not automatically trigger the requirement.
- Rationale: The CTDPA, along with the VCDPA, CPA, and CCPA/CPRA, gives controllers 45 days to respond to a consumer request. This period can be extended by an additional 45 days when reasonably necessary. This is one of the few areas of near-uniformity across the state laws.
- Rationale: Under the VCDPA (and similar state laws), a "processor" is a natural or legal entity that processes personal data on behalf of a controller. Since the analytics provider is processing data on behalf of and at the direction of the retail company (the controller), it is a processor. A "third party" is a separate entity that is not the controller or processor.
- Rationale: The UCPA is the only law among the major state privacy frameworks that requires a business to meet both a revenue threshold ($25 million) and a separate data processing threshold. Other state laws generally use "OR" conditions, meaning a business can be covered by meeting either a revenue threshold or a data processing threshold, but not necessarily both.
- Rationale: The CCPA/CPRA provides several exceptions to the right to deletion. One of the most common is when the personal information is necessary for the business to complete the transaction for which the personal information was collected, fulfill the terms of a written warranty, or provide a good or service requested by the consumer. The other options are not valid exceptions under the law.
Calculate Your CIPP/US Score & Study Hours by Domain
Adjust your practice scores across official CIPP/US blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How Did You Score? Your 7-Day Improvement Sprint
How you scored on this short quiz is a powerful indicator of your readiness for the most challenging domain of the CIPP/US exam. Don't just look at the number; use it to build a targeted plan for the next week.
If You Scored 0-4 Correct (Foundational Gaps)
This score suggests you need to reinforce the fundamental building blocks of the major state laws. You can fix this with a focused effort.
- Day 1-2: Master California. Go back to your study materials (or the VoraPrep CIPP/US interactive lessons) and focus exclusively on the CCPA/CPRA. Write down the specific thresholds for applicability, the definitions of "sale," "sharing," and "sensitive personal information."
- Day 3: Virginia & Colorado. Use the comparison table in this article to study VCDPA and CPA side-by-side. Your goal is to spot the differences from California, especially the definition of "sale" and the opt-out rights.
- Day 4-5: Targeted Practice. Use the VoraPrep adaptive question bank to do 50 practice questions filtered only for Domain 5. Read every single explanation, even for questions you get right.
- Day 6: Rebuild the Chart. From memory, try to recreate the State Privacy Law Comparison Chart from this article. This active recall is far more effective than passive reading.
- Day 7: Re-take This Quiz. Come back and take these 10 questions again. You should see a marked improvement.
If You Scored 5-7 Correct (Nuance Gaps)
You have a decent grasp of the basics but are likely getting tripped up by the details, just like many candidates on exam day. Your goal is to sharpen your understanding of the differences between the laws.
- Day 1: Error Analysis. For each question you missed, write one sentence explaining why you missed it. Did you confuse VCDPA with CPRA? Did you misremember a specific number from the table? Be honest.
- Day 2-3: Drill the Differences. Use VoraPrep's Spaced-Repetition Flashcards to drill the specific thresholds and definitions. Focus on cards that ask you to compare laws directly, like "What is the definition of 'sale' under VCDPA?"
- Day 4: Ask Vory. Log in to VoraPrep and ask Vory, your 24/7 tutor, "What are the key differences between the Colorado Privacy Act and the Virginia VCDPA?" or "Explain the 'sale' vs 'sharing' distinction under CPRA."
- Day 5-6: Timed Quiz. Do a timed 30-question quiz in the VoraPrep exam simulator focusing only on Domain 5. The time pressure will simulate exam conditions and reveal where you hesitate.
- Day 7: Teach It Back. Explain the applicability thresholds for all five laws out loud to a friend. If you can teach it, you know it.
If You Scored 8-10 Correct (Exam Ready)
Excellent work. You have a strong command of the material. Your focus for the next week should be on maintaining this knowledge and preparing for complex, multi-step scenario questions.
- Day 1-3: Broaden Your Practice. You're solid on State Laws, so use the VoraPrep adaptive engine to practice across all five domains. This ensures you don't neglect other areas while feeling confident in this one.
- Day 4-5: Full-Scale Simulation. Take a full 90-question mock exam in the VoraPrep exam simulator. This builds your stamina and tests your ability to switch between different legal frameworks (e.g., from HIPAA to CPRA).
- Day 6: Final Review. Quickly review the comparison chart in this article. Spend one final hour reviewing the nuances, particularly around DPA requirements and universal opt-out mechanisms.
- Day 7: Rest. You've earned it. Light review is fine, but do not cram. Go into the exam with a clear and confident mind.
Why VoraPrep is the Best CIPP/US Course
Staring at a patchwork of state laws can feel overwhelming. Traditional study methods, like passively watching hours of video lectures, often fail here because they don't force you to actively compare and apply the rules.
VoraPrep is a complete, 6-pillar interactive course designed to build your critical thinking skills. Instead of just showing you the law, we teach you to think like the examiner.
- Textbook-Grade Lessons: Our interactive lessons break down each state law, using comparison tables and clear examples to highlight the critical differences.
- Adaptive Practice Bank: With over 1,400 exam-calibrated questions, our engine learns your weak spots. If you're confusing Utah and Virginia's thresholds, it will serve you more questions on that topic until you master it.
- 1:1 Exam Simulators: Our timed mock exams replicate the look and feel of the Pearson VUE testing environment, so there are no surprises on exam day.
- Spaced-Repetition Flashcards: Burn the key definitions, thresholds, and deadlines into your long-term memory with our FSRS flashcard system.
- Personalized Study Plan: Tell us your exam date, and we build a dynamic day-by-day calendar to keep you on track.
- Vory, Your 24/7 Personal Tutor: Stuck on a question at 2 AM? Ask Vory for a step-by-step explanation without ever leaving the platform.
This comprehensive approach is why VoraPrep is the best overall choice for CIPP/US candidates, offered at a modern price ($25/month) instead of the $1,500+ charged for outdated video bundles. See our in-depth comparison of the best CIPP review courses for 2026 for more details.