CIPP/US Practice Exam 2026 – 190 Privacy Certification Questions
with Answers & Detailed Rationales, U.S. Privacy Laws, Data
Protection, Consumer Rights, Regulatory Enforcement, Information
Security & Compliance
Domain I: Introduction to the U.S. Privacy Environment (Questions 1–45)
Question 1
A multinational retailer headquartered in Chicago collects loyalty program data from
customers across the United States. The company’s privacy counsel is asked to explain why
the U.S. approach to privacy regulation differs fundamentally from the European model.
Which statement best characterizes the U.S. privacy framework?
A. A single omnibus federal statute governs all private-sector data processing.
B. Privacy obligations arise from a sectoral patchwork of federal and state laws, regulations,
and common-law doctrines.
C. The U.S. Constitution establishes a general right to privacy that preempts state law.
D. The Federal Trade Commission possesses comprehensive rulemaking authority equivalent
to that of EU supervisory authorities.
Correct Answer: B
Explanation: The U.S. relies on sector-specific federal laws, state statutes, and tort law rather
than one comprehensive federal privacy statute .
Question 2
A privacy analyst is reviewing the sources of law that may impose obligations on a financial
institution operating in multiple states. Which source of law is considered primary authority
in the U.S. legal system?
,A. A blog post published by a prominent privacy consultant.
B. A consent order issued by the Federal Trade Commission.
C. A law review article analyzing the Gramm-Leach-Bliley Act.
D. A press release from a state attorney general’s office.
Correct Answer: B
Explanation: Consent orders are binding enforcement actions with legal force; secondary
sources like articles and blogs do not create legal obligations.
Question 3
A company’s privacy officer is asked to explain the role of the Federal Trade Commission in
privacy enforcement. Under Section 5 of the FTC Act, the agency’s primary authority is to
address:
A. Criminal violations of federal privacy statutes.
B. Unfair or deceptive acts or practices affecting commerce.
C. International data transfers that violate GDPR adequacy decisions.
D. Employment discrimination based on protected health information.
Correct Answer: B
Explanation: Section 5 grants the FTC authority over unfair or deceptive practices, which it
uses to enforce privacy promises and data security standards .
Question 4
An organization is developing a data inventory as part of its privacy program. The privacy
manager explains that the primary purpose of this exercise is to:
,A. Satisfy the requirements of the Sarbanes-Oxley Act.
B. Identify what personal information the organization collects, where it resides, and how it
flows.
C. Replace the need for vendor contracts and data processing agreements.
D. Eliminate all risk of a data breach notification obligation.
Correct Answer: B
Explanation: A data inventory maps data collection, storage, and movement, providing the
foundation for notices, retention, access requests, and vendor oversight .
Question 5
A privacy team is designing a records retention schedule. The lead counsel emphasizes that
retaining personal information indefinitely “because storage is cheap” most directly conflicts
with which privacy principle?
A. Data minimization and storage limitation.
B. Purpose limitation and accuracy.
C. Integrity and confidentiality.
D. Accountability and transparency.
Correct Answer: A
Explanation: Storage limitation requires that data be kept only as long as necessary for the
disclosed purpose; indefinite retention violates this principle.
Question 6
A U.S.-based company receives a binding order from a European supervisory authority
regarding data processed in the EU. The company’s legal team must reconcile conflicting U.S.
, and EU obligations. Which framework is most relevant to resolving conflicts between U.S.
legal process and GDPR requirements?
A. The USA PATRIOT Act.
B. The Schrems II decision and the EU-U.S. Data Privacy Framework.
C. The Health Insurance Portability and Accountability Act.
D. The Electronic Communications Privacy Act.
Correct Answer: B
Explanation: Schrems II and the Data Privacy Framework govern transatlantic data transfer
mechanisms and the handling of conflicting legal demands.
Question 7
A company maintains a privacy program that includes workforce training, incident response
procedures, and vendor management. These activities are best characterized as components
of:
A. Government access compliance.
B. Information management from a U.S. perspective.
C. State breach notification laws.
D. Federal sectoral regulations.
Correct Answer: B
Explanation: Information management encompasses the operational components of a
privacy program including training, incident response, and vendor oversight .
Question 8
with Answers & Detailed Rationales, U.S. Privacy Laws, Data
Protection, Consumer Rights, Regulatory Enforcement, Information
Security & Compliance
Domain I: Introduction to the U.S. Privacy Environment (Questions 1–45)
Question 1
A multinational retailer headquartered in Chicago collects loyalty program data from
customers across the United States. The company’s privacy counsel is asked to explain why
the U.S. approach to privacy regulation differs fundamentally from the European model.
Which statement best characterizes the U.S. privacy framework?
A. A single omnibus federal statute governs all private-sector data processing.
B. Privacy obligations arise from a sectoral patchwork of federal and state laws, regulations,
and common-law doctrines.
C. The U.S. Constitution establishes a general right to privacy that preempts state law.
D. The Federal Trade Commission possesses comprehensive rulemaking authority equivalent
to that of EU supervisory authorities.
Correct Answer: B
Explanation: The U.S. relies on sector-specific federal laws, state statutes, and tort law rather
than one comprehensive federal privacy statute .
Question 2
A privacy analyst is reviewing the sources of law that may impose obligations on a financial
institution operating in multiple states. Which source of law is considered primary authority
in the U.S. legal system?
,A. A blog post published by a prominent privacy consultant.
B. A consent order issued by the Federal Trade Commission.
C. A law review article analyzing the Gramm-Leach-Bliley Act.
D. A press release from a state attorney general’s office.
Correct Answer: B
Explanation: Consent orders are binding enforcement actions with legal force; secondary
sources like articles and blogs do not create legal obligations.
Question 3
A company’s privacy officer is asked to explain the role of the Federal Trade Commission in
privacy enforcement. Under Section 5 of the FTC Act, the agency’s primary authority is to
address:
A. Criminal violations of federal privacy statutes.
B. Unfair or deceptive acts or practices affecting commerce.
C. International data transfers that violate GDPR adequacy decisions.
D. Employment discrimination based on protected health information.
Correct Answer: B
Explanation: Section 5 grants the FTC authority over unfair or deceptive practices, which it
uses to enforce privacy promises and data security standards .
Question 4
An organization is developing a data inventory as part of its privacy program. The privacy
manager explains that the primary purpose of this exercise is to:
,A. Satisfy the requirements of the Sarbanes-Oxley Act.
B. Identify what personal information the organization collects, where it resides, and how it
flows.
C. Replace the need for vendor contracts and data processing agreements.
D. Eliminate all risk of a data breach notification obligation.
Correct Answer: B
Explanation: A data inventory maps data collection, storage, and movement, providing the
foundation for notices, retention, access requests, and vendor oversight .
Question 5
A privacy team is designing a records retention schedule. The lead counsel emphasizes that
retaining personal information indefinitely “because storage is cheap” most directly conflicts
with which privacy principle?
A. Data minimization and storage limitation.
B. Purpose limitation and accuracy.
C. Integrity and confidentiality.
D. Accountability and transparency.
Correct Answer: A
Explanation: Storage limitation requires that data be kept only as long as necessary for the
disclosed purpose; indefinite retention violates this principle.
Question 6
A U.S.-based company receives a binding order from a European supervisory authority
regarding data processed in the EU. The company’s legal team must reconcile conflicting U.S.
, and EU obligations. Which framework is most relevant to resolving conflicts between U.S.
legal process and GDPR requirements?
A. The USA PATRIOT Act.
B. The Schrems II decision and the EU-U.S. Data Privacy Framework.
C. The Health Insurance Portability and Accountability Act.
D. The Electronic Communications Privacy Act.
Correct Answer: B
Explanation: Schrems II and the Data Privacy Framework govern transatlantic data transfer
mechanisms and the handling of conflicting legal demands.
Question 7
A company maintains a privacy program that includes workforce training, incident response
procedures, and vendor management. These activities are best characterized as components
of:
A. Government access compliance.
B. Information management from a U.S. perspective.
C. State breach notification laws.
D. Federal sectoral regulations.
Correct Answer: B
Explanation: Information management encompasses the operational components of a
privacy program including training, incident response, and vendor oversight .
Question 8
