What the exam asks, in what order to study it, how long it takes, what it costs and where candidates lose marks.
The CIPP/US, the Certified Information Privacy Professional/United States, is the certification for privacy law in the United States. It tests whether you can find the rule that applies, by sector, by organisation and by state, and apply it to a real situation.
It is issued by the IAPP. There are no prerequisites: no degree and no minimum experience. You sit it online or at a test centre, in English.
Format and fees
Membership of the IAPP costs $295 a year and includes the maintenance fee; without membership that fee is $250 every two years.
The IAPP publishes a body of knowledge for each certification: the list of topics the exam is written from. A separate exam blueprint gives the number of questions per topic. The 22Academy course follows the current version concept by concept.
How privacy law is built in the United States: the sources of law, who enforces it, and how an organisation manages information, incidents, vendors and transfers from a US point of view.
Who enforces. There is no single regulator: the FTC, the sector agencies and the state attorneys general each have their own reach, and the exam asks which one acts.
Which federal agency is the primary enforcer of consumer privacy in the United States, under its authority over unfair or deceptive acts or practices?
Twenty more like it, freeThe federal sector laws: health, finance, education, children, telecommunications and marketing, and the cross-sector role of the FTC.
Scope. Each sector law covers certain organisations and certain data only, and the exam offers the right rule for the wrong organisation.
Statement I: HIPAA applies to any company that holds health information about a person. Statement II: under the Fair Credit Reporting Act, an employer must give an applicant a copy of the report before taking adverse action based on it. Which statement is correct?
Twenty more like it, free
The state privacy laws take a growing share of the exam. The course shows your accuracy per domain and per module, and points at the module to work on now.
When the state can reach data held by companies: law enforcement, national security and civil litigation, and what a company must check before it hands anything over.
The instrument. A subpoena, a court order and a warrant open different things on different standards.
A police department asks an email provider for the content of a customer's messages from the past month. What should the provider require before it discloses them?
Twenty more like it, freePrivacy in the employment relationship: what an employer may ask, check and monitor before, during and after employment.
The stage. What an employer may do differs before hiring, during employment and after it ends, and the exam moves the same facts from one stage to another.
An employer wants to monitor how employees use company email. What is the BEST way to reduce its legal risk?
Twenty more like it, freeThe fastest-growing part of the field: the comprehensive state privacy laws, the state laws on health, biometric data and automated decisions, and data breach notification.
The differences. The state laws look alike, and the exam asks where they differ: thresholds, sensitive data, the right to cure and who can sue.
Which state's comprehensive privacy law gives consumers a private right of action for certain data breaches?
Twenty more like it, freeNot using your IAPP membership? Pay only the $250 maintenance fee and keep $340 every two years.
Start CIPP/US freeThere is no single American privacy law. These four groups of federal laws run through the whole exam.
Covered entities and business associates, the Privacy and Security Rules, and breach notification.
Privacy notices and safeguards for financial institutions, and the rules for consumer reports.
Verifiable parental consent online, and access to and disclosure of student records.
Calls, texts and commercial email: consent, identification and the right to opt out.
Know what each of these laws adds, and where it differs from the others. The differences are what the exam asks about.
The broadest state law, with its own agency and a private right of action for certain breaches.
The model most other states followed: controller and processor duties, enforced by the attorney general.
Adds universal opt-out signals and rulemaking by the attorney general.
Written consent for biometric identifiers, with a private right of action.
Consumer health data outside HIPAA, with a private right of action.
Every state has one. They differ on what counts as personal information, on timing and on who must be told.
American privacy law is shaped by the courts as much as by statute. These decisions come back in questions on government access, enforcement and the right to sue.
The Fourth Amendment protects a reasonable expectation of privacy, not only places.
Police need a warrant to search the phone of a person they arrest.
Police need a warrant for historical mobile phone location records held by a carrier.
The FTC may treat poor data security as an unfair practice.
A breach of a statute alone is not enough to sue in federal court; there must be concrete harm.
Only people who were concretely harmed can claim damages in federal court.
Every explanation in the course is stored once and linked to its source. When a regulation, a guideline or a decision changes, we update it in one place and every lesson that uses it is correct from that moment.
Exam questions come in a small number of structures, and a candidate who knows the content can still lose marks on the structure. The course tags every question with its structure; the technique is one tap away on each one, and every test shows whether you lost the mark on the content or on the type of question.
Buy the exam voucher when you are ready, not before. It expires a year after you buy it.
Free CIPP/US assessmentThe IAPP recommends at least 30 hours of study. People who work with American privacy law every day need less; people new to it need more. At three hours a day you can be ready in about a month.
Book the exam before you feel ready: a fixed date concentrates the effort. You have twelve months from purchase to sit it.
Or €117 a month with a trial exam included.
A four-week plan, at three hours a day
A guideline. The course builds your own plan from your assessment and the hours you have.
| Resource | Price | Worth it? |
|---|---|---|
| CIPP/US body of knowledge | Free | Essential. Work through it topic by topic, next to the exam blueprint. |
| The statutes and the FTC's own guidance | Free | No substitute for the primary sources on the main sector laws. |
| The IAPP textbook | IAPP store | Useful for self-study; it can lag the current body of knowledge. |
| IAPP official training | From $995 | A good introduction. It does not replace practice under time pressure. |
| IAPP practice exam | IAPP store | One exam, useful for the house style of the questions. |
| 22Academy CIPP/US course | €37 a week or €117 a month | The full course, the exam skills, the measurement and a trial exam. Stop when you are ready. |
| 22Academy trial exam | €42, or free with a monthly plan | Full length under real conditions, with analysis by domain and by question type. |
If you fail, fail cheap. Ten trial exams cost less than one retake.
Buy a trial examThe CIPP/US is the certification for anyone whose job depends on getting American privacy law right. It opens the door to roles on the legal side, such as privacy counsel, and on the operational side, such as privacy manager and head of privacy. Next to the CIPP/E it is the mark of someone who can work on both sides of the Atlantic.
Employers ask for it by name, because it shows that you can apply the law rather than only describe it. Pay rises with the scope of the role.
Each role page shows which certifications it takes, in which order, and how long it takes.
| Certification | What it covers | Take it when |
|---|---|---|
| CIPP/US | United States privacy law, federal and state | You work with American data, clients or colleagues |
| CIPP/E | European data protection law | You work with personal data in or for Europe |
| CIPM | Running a privacy programme | You run privacy rather than advise on it |
| CIPT | Privacy in technology | You build or run the systems |
| AIGP | AI governance | Your organisation builds or uses AI |
Not sure? The career plan starts from the job you want.
Free account, fifteen minutes, your score per domain.
About 1 minute 40 seconds a question. Flag and move on.
Removing what is wrong is faster than hunting for what is right.
Most, best, primary and except decide what is being asked.
Optional, fifteen minutes. Taking it means submitting the first half for good.
Online or at a test centre: both work. If you sit online, do a full dry run the day before, and disconnect second screens and docking stations.
Passed? You keep the certification with 20 CPE credits in every two-year period, plus the maintenance fee or an IAPP membership that includes it.
Not this time? A retake costs $375, and your progress in the course is still there.
“The quality of the trial exam is high”
It is demanding rather than hard. There is no single American privacy law, so most of the effort goes into knowing which rule applies to which sector, which organisation and which state. The rest is applying those rules to a messy scenario under a clock. The questions reward precision, so candidates who practise on exam-style questions early do far better than those who only read.
No. There are no prerequisites, no degree and no minimum experience. Candidates come from compliance, security, IT, HR and management as well as from law. The exam tests whether you can apply the rules to a situation, not whether you can argue them in court, and the course explains every concept in plain language as well as in its legal form.
Yes, if you work with American customers, colleagues or data. American privacy law reaches organisations outside the country, and employers with a transatlantic footprint often ask for the CIPP/US next to the CIPP/E.
The IAPP offers traditional classroom courses and e-learning in which the content is presented to you. We start from the fact that you already have access to all the content, so we focus on getting it into your head rather than throwing more of it at you. We test your knowledge constantly, because that is what makes it stick, and we explain every concept in the form and length that suits you. We also teach the exam skills: how the questions are built, what they are really asking and where the traps are. And we embrace AI for your study, because you use it already; we show you how to use it more effectively.
Practice questions check your knowledge one item at a time. The trial exam checks whether you can answer ninety in a row under the clock, the way the real exam asks it. Its analysis shows whether you lose marks on the content or on the type of question, so you know exactly what to work on in the last days. It is the last check before you book.
Yes, and we encourage it. An AI app is a good partner for rehearsing: it will quiz you, rephrase a concept or test you on a passage you give it. It is a poor judge of whether you are ready, because it cannot tell you what you failed to ask. The course gives you prompts that make your own app quiz you properly, and measures you with its own questions.
Yes. You can start your course for free and see whether the system suits you: the assessment and the first lesson are open without a card. When you want the rest, the course is €37 a week, or €117 a month with a trial exam included.
Yes. You pay for the weeks or months you study and cancel whenever you like; your access runs to the end of the period you paid for. If you come back within a year, your progress is still there.
No. The IAPP owns the CIPP/US and sets the exam. 22Academy prepares candidates for it independently, and has done so since 2018.
More in the FAQ.
How to plan around a job, when to book the exam, whether you are ready: connect and ask. Support is free!
Free account, fifteen minutes, your score per domain.