CIPP/US common mistakes
CIPP/US · Understand the traps and how to avoid them.
When asked what federal law obligates a private company to protect or limit its use of customer data, the candidate invokes the Fourth Amendment, or asserts that a single omnibus 'federal privacy act' governs all industries, or treats the FTC as having issued a general privacy rule that all companies must follow.
Candidates prepare with GDPR-style frameworks in mind and expect a single, cross-sector statute plus a constitutional right. The U.S. model is sectoral, and constitutional privacy limits run only against government action; the Constitution creates no cause of action against a private company. The FTC enforces Section 5 deception and unfairness case by case rather than under a general privacy rule.
What to do instead
Before answering, identify (1) the actor - government or private party - and (2) the sector. Then map: government actor to Fourth Amendment, ECPA, FISA, state constitutions; private-sector to FTC Act Section 5 plus GLBA (financial), HIPAA (health care), FCRA (consumer reporting), COPPA (children), TCPA and CAN-SPAM (marketing), DPPA, Cable Act, VPPA. Practice classifying twenty fact patterns by statute before drilling substantive details.
On a tort hypothetical, the candidate requires that the information be published before finding intrusion upon seclusion, or merges public disclosure of private facts with false light and analyzes them as the same claim.
The four common-law privacy torts are memorized as labels rather than as element lists, and they overlap factually. Intrusion is the only one with no publicity element, which is counterintuitive in a 'privacy publication' framework; false light and public disclosure both involve publicity but differ on truth and on the nature of the harm.
What to do instead
Build a four-column element checklist and apply it mechanically: intrusion (physical or electronic intrusion, reasonable expectation of privacy, highly offensive); public disclosure of private facts (publicity, private fact, highly offensive, not of legitimate public concern); false light (publicity, false or misleading impression, highly offensive); appropriation (use of name or likeness, for commercial advantage). Note that truth defeats false light but not public disclosure, and that no publication is needed for intrusion.
When a company's actual data practices contradicted statements in its posted privacy policy, the candidate selects 'no violation, because a privacy policy is a voluntary statement of intent and not legally binding.'
Candidates correctly learn that no federal statute generally requires a privacy policy and then over-extend that point into thinking the policy has no legal effect. The relevant enforcement theory - Section 5 deception - is tested less often than the underlying statutes, so it is under-drilled.
What to do instead
Separate two questions: (1) Is a policy required? Only in specific contexts (GLBA, COPPA, HIPAA notice of privacy practices, some state laws). (2) Once a statement is made, is it enforceable? Yes - a material representation likely to mislead a reasonable consumer is deceptive under Section 5, and broken promises are the FTC's core privacy theory. For unfairness, test for substantial injury not reasonably avoidable and not outweighed by benefits. Apply that two-step to every policy-related fact pattern.
The candidate applies one consent model to every marketing or data-sharing scenario - typically defaulting to opt-out - so that verifiable parental consent under COPPA, prior express written consent under the TCPA, and HIPAA authorization for marketing are all answered as 'opt-out' or 'notice only.'
CAN-SPAM's opt-out structure is the best-known U.S. model and becomes the default answer. The exam deliberately mixes regimes whose consent baselines differ, and candidates answer from memory of the most familiar statute rather than from the specific statute named in the question stem.
What to do instead
Memorize a consent matrix keyed to the statute named: COPPA - verifiable parental consent before collecting from a child under 13; TCPA - prior express written consent for autodialed or prerecorded marketing calls and texts, prior express consent for informational calls to cell numbers; CAN-SPAM - no prior consent, but opt-out must be honored within 10 business days plus required disclosures; GLBA - initial and annual notice plus opt-out for sharing nonpublic personal information with nonaffiliated third parties, with exceptions; HIPAA - authorization required for marketing and for sales of protected health information, while treatment, payment, and operations need no authorization; FCRA - opt-out for affiliate sharing of eligibility information. Read the stem for the named statute before choosing.
Asked what legal process is needed to obtain the content of a customer's email from a service provider, the candidate selects a grand jury subpoena; or, asked about basic subscriber records, selects a search warrant.
Candidates learn 'ECPA governs stored data' as a single rule rather than as a tiered statute keyed to the type of information and its age, so one instrument (whichever was studied last) is applied to every request.
What to do instead
Memorize ECPA's Stored Communications Act tiers as a grid by information type: basic subscriber information (name, address, billing records, IP) - subpoena; other non-content records such as transaction logs - Section 2703(d) court order or warrant; content in storage 180 days or less - warrant; content in storage more than 180 days - subpoena or Section 2703(d) order with prior notice to the subscriber, or a warrant. Then layer on the real-world overlay: many providers demand warrants for all content, several states require warrants by statute, and the CLOUD Act governs cross-border production. Recite the grid from memory before answering.
The candidate states either that Carpenter v. United States abolished the third-party doctrine so that a warrant is now needed for any records held by a third party, or that under Smith v. Maryland a warrant is never needed for cell-site location information because the carrier is a third party.
Carpenter is taught as a landmark and gets over-generalized in one direction, while Smith is memorized as a black-letter rule and applied without the later limitation. The narrow, fact-specific character of Carpenter is the actual testable content.
What to do instead
Frame it as: the third-party doctrine survives for ordinary business records and for pen-register-style metadata (Smith); Carpenter carved out a narrow category - historical cell-site location information capturing a comprehensive record of physical movement - requiring a warrant, and expressly declined to extend to real-time location, tower dumps, or conventional business records. When a stem involves location data, ask whether the request is for a comprehensive historical record of movement (warrant) or something narrower (subpoena or court order, subject to statute).
On a workplace monitoring question, the candidate answers either that an employer may monitor anything because employees have no privacy rights at work, or conversely that the employer must always obtain a signed employee consent before reviewing business email or recorded calls.
Workplace privacy sits at the intersection of ECPA's provider and consent exceptions, tort law, public-sector constitutional rules, and state wiretap statutes, and candidates reduce it to a single intuition about 'company property' or 'consent.' The fact-specific nature of the business-extension exception is easy to flatten.
What to do instead
Use a fixed sequence: (1) Who is the employer - public (Fourth Amendment and O'Connor v. Ortega reasonable-expectation analysis for workplace searches) or private (ECPA and tort law)? (2) Is the employer acting as a service provider whose equipment is used in the ordinary course of business, or is it intercepting a communication it is not a party to? (3) Does a state all-party consent wiretap statute apply to the call recording? (4) Are there collective-bargaining or NLRA concerns, and is the monitoring of protected concerted activity? (5) Is the monitoring of a location or device that is personally owned, which changes the analysis. Address each step explicitly in the answer.
The candidate says an employer that uses an outside vendor for a pre-employment background check owes the applicant no notice, or that the employer may take adverse action as soon as it receives a disqualifying report.
Candidates associate FCRA with credit bureaus and consumer disputes and do not map it onto ordinary hiring, while the pre-adverse action step added by the FACT Act is a procedural detail that is easily skipped in a fact pattern that focuses on the content of the report.
What to do instead
Memorize the employer sequence under FCRA as amended: a clear and conspicuous standalone disclosure that a consumer report may be obtained plus written authorization; then, before taking adverse action, provide a pre-adverse action notice with a copy of the report and the CFPB summary of rights, and allow a reasonable opportunity to dispute; only then issue the adverse action notice with the required disclosures. Also flag state overlays such as ban-the-box laws and salary-history or credit-check restrictions.
On a CCPA/CPRA question, the candidate concludes that sharing personal information for cross-context behavioral advertising is not a 'sale' because no money changed hands, or states that a consumer may sue a business for any violation, or recites a 30-day cure period as mandatory for all enforcement.
The original CCPA text and the pre-2023 enforcement posture are heavily studied, while the CPRA amendments that added 'sharing,' expanded the private right of action only for breaches, and changed the cure provisions are absorbed as a list of additions rather than as changes to the operative definitions.
What to do instead
Re-anchor on CPRA definitions: 'sale' is exchange for monetary or other valuable consideration; 'sharing' reaches cross-context behavioral advertising even without consideration; consumers have a right to opt out of both, and to limit use of sensitive personal information. Confirm the private right of action is statutory-damages-only for data breaches and otherwise enforced by the California Privacy Protection Agency and the Attorney General. Check thresholds (for example, revenue, consumer volume, or percentage of revenue from selling or sharing) before assuming the law applies at all.
The candidate applies one state's rule nationwide - for example, one definition of 'personal information' for breach notification, a single notification deadline, and an assumption that every state comprehensive privacy law has the same applicability thresholds, opt-out versus opt-in baseline, and cure period.
Study materials frequently present California as the model and treat other states as variations, so the candidate generalizes from the most detailed statute. State breach laws and comprehensive laws genuinely differ on trigger (risk of harm versus automatic notice), timing, regulator notice, and enforcement, and those differences are exactly what is tested.
What to do instead
For any state-law stem, first identify the state named and only then apply that state's rule. Maintain a comparison table with columns for: breach definition and sensitive-data categories, risk-of-harm trigger, deadline and regulator notice, consumer remedies and private right of action, applicability thresholds, opt-in versus opt-out for sensitive data, universal opt-out signal recognition, cure period, and whether a data protection assessment is required. If the state is not identified in the stem, answer at the level of the general principle and flag variation rather than importing California's numbers.