I85PREP
⌘ K
CIPP/US study materials
CIPP/US study resources

CIPP/US practice questions

One question at a time. Build your CIPP/US understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Introduction to the U.S. Privacy Environment

Which statement best describes how the United States regulates privacy at the federal level?

  1. Self-regulation only, with no federal privacy statutes enacted
  2. Sector-specific statutes aimed at particular industries or data types Correct answer.
  3. A single comprehensive statute covering all private-sector data processing
  4. Treaty-based rules that member states must transpose into domestic law

Explanation

Federal privacy law in the United States is built from many narrow statutes that each govern a defined industry, data type, or relationship, such as health, financial, or educational records. There is no omnibus federal privacy code of general application. This fragmented design is commonly called the sectoral model.

Question 2Introduction to the U.S. Privacy Environment

The Federal Trade Commission's general authority to bring privacy and data security enforcement actions comes primarily from which source?

  1. The Electronic Communications Privacy Act
  2. The Privacy Act of 1974
  3. Section 5 of the FTC Act Correct answer.
  4. The Gramm-Leach-Bliley Act

Explanation

Section 5 of the FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce, and the Commission uses it to challenge misleading privacy policies and unreasonable data security. It is the FTC's broad, cross-sector tool rather than a privacy-specific statute.

Question 3Introduction to the U.S. Privacy Environment

Which common law privacy tort addresses the commercial use of a person's name or likeness without consent?

  1. Appropriation of name or likeness Correct answer.
  2. Intrusion upon seclusion
  3. False light
  4. Public disclosure of private facts

Explanation

Appropriation protects a person's exclusive right to control the commercial exploitation of her identity, such as name, image, or voice. It underlies modern right-of-publicity statutes. The other three torts protect against snooping, embarrassing disclosure, and misleading portrayals respectively.

Question 4Introduction to the U.S. Privacy Environment

Which tort requires widespread publication of private information that would be highly offensive to a reasonable person and is not of legitimate public concern?

  1. Intrusion upon seclusion
  2. Appropriation of name or likeness
  3. False light
  4. Public disclosure of private facts Correct answer.

Explanation

Public disclosure of private facts targets the dissemination of truthful but intimate information whose revelation is highly offensive and lacks a legitimate public interest. Newsworthiness is a strong defense, and the information must actually be private rather than already public.

Question 5Introduction to the U.S. Privacy Environment

A magazine publishes an article that, although built on accurate details, creates the misleading impression that a private citizen has endorsed a controversial product. Which privacy tort is most directly implicated?

  1. Public disclosure of private facts
  2. Intrusion upon seclusion
  3. False light Correct answer.
  4. Appropriation

Explanation

False light applies when publicity places a person before the public in a false or misleading light that a reasonable person would find highly offensive. Accuracy of individual details does not defeat the claim if the overall impression is misleading. It protects dignitary interests rather than reputation, which distinguishes it from defamation.

Question 6Introduction to the U.S. Privacy Environment

Katz v. United States established which principle for Fourth Amendment analysis?

  1. That every government search requires a warrant
  2. That the Amendment protects reasonable expectations of privacy Correct answer.
  3. That the Fourth Amendment binds only federal officers
  4. That the Fourth Amendment protects only against physical trespass

Explanation

Katz shifted the inquiry from physical intrusion onto property to whether the government violated a person's reasonable expectation of privacy. The test has both a subjective and an objective component. It remains the foundation for modern search-and-seizure privacy analysis.

Question 7Introduction to the U.S. Privacy Environment

In Carpenter v. United States, the Supreme Court held that government acquisition of historical cell site location records generally does what?

  1. Requires a warrant supported by probable cause Correct answer.
  2. Falls outside the Fourth Amendment entirely because the carrier holds the data
  3. Is governed only by the Stored Communications Act, not the Constitution
  4. Requires only a subpoena because the records belong to a third party

Explanation

The Court held that a person maintains a reasonable expectation of privacy in the exhaustive, intimate record of physical movements revealed by cell site location information. Acquiring such records is therefore a search ordinarily requiring a warrant. The ruling was framed as a narrow departure from the third-party doctrine rather than its abolition.

Question 8Introduction to the U.S. Privacy Environment

Under the third-party doctrine associated with Smith v. Maryland, what happens to Fourth Amendment protection for information a person turns over to a service provider?

  1. Bank records are protected from a grand jury subpoena
  2. A person keeps a reasonable expectation of privacy in the numbers dialed from a home telephone
  3. Voluntarily disclosed information generally loses Fourth Amendment protection Correct answer.
  4. A pen register requires a warrant supported by probable cause

Explanation

The third-party doctrine reasons that information knowingly exposed to a third party, such as dialed numbers or bank records, carries no reasonable expectation of privacy against government requests. The doctrine substantially limits Fourth Amendment coverage of commercial records. Carpenter later carved out a narrow exception for comprehensive location tracking.

Question 9Introduction to the U.S. Privacy Environment

Whalen v. Roe recognized a constitutionally protected privacy interest in which of the following?

  1. Refusing to disclose financial records to federal tax authorities
  2. Avoiding disclosure of personal medical information Correct answer.
  3. Obtaining government records about oneself under FOIA
  4. Controlling the commercial use of one's own likeness

Explanation

Whalen upheld a state prescription database but recognized that the Constitution protects an individual interest in avoiding disclosure of personal matters, including medical information. The Court also identified an interest in independence in making certain important decisions. Both strands inform modern health privacy debates.

Question 10Introduction to the U.S. Privacy Environment

Griswold v. Connecticut located a right of marital privacy in what source?

  1. The common law tort of intrusion upon seclusion
  2. Penumbras of several constitutional guarantees Correct answer.
  3. The Eighth Amendment's ban on cruel and unusual punishment
  4. A federal statute enacted by Congress

Explanation

Griswold reasoned that specific guarantees in the Bill of Rights create penumbras that give them life and substance, yielding a zone of privacy in marital relations. The approach supplied the foundation later extended in cases such as Eisenstadt and Roe. It is a constitutional, not statutory or common law, holding.

Question 11Introduction to the U.S. Privacy Environment

Which state enacted the first comprehensive consumer privacy statute of general application in the United States?

  1. Washington
  2. New York
  3. California Correct answer.
  4. Illinois

Explanation

California's Consumer Privacy Act, effective in 2020 and later amended by the CPRA, was the first statewide comprehensive consumer privacy law. It grants rights of access, deletion, correction, and opt-out of sale or sharing and is enforced by the state attorney general and a dedicated agency.

Question 12Introduction to the U.S. Privacy Environment

Which state enacted the first data breach notification law?

  1. Massachusetts in 2005
  2. Texas in 2007
  3. California in 2003 Correct answer.
  4. New York in 2000

Explanation

California's breach notification statute, effective in 2003, was the first of its kind and became the model for laws adopted in every other state. These laws generally require notice to affected individuals, and sometimes to regulators, after a breach of specified personal information. They vary considerably in definitions, timing, and content requirements.

Question 13Introduction to the U.S. Privacy Environment

A company's published privacy policy misstates how it shares consumer data. In addition to the FTC, which actor most commonly brings enforcement actions over such practices under state law?

  1. The state attorney general Correct answer.
  2. The Department of Justice Antitrust Division
  3. The Consumer Financial Protection Bureau
  4. The Federal Communications Commission

Explanation

State attorneys general enforce both state consumer protection statutes and state comprehensive privacy laws, and they frequently act against deceptive privacy practices. Multi-state settlements are common. Their authority runs in parallel with federal enforcement rather than displacing it.

Question 14Introduction to the U.S. Privacy Environment

The Federal Trade Commission generally lacks jurisdiction over which category of entities?

  1. Companies that sell consumer data
  2. Retailers that operate only online
  3. App developers distributing through app stores
  4. Nonprofit organizations and common carriers Correct answer.

Explanation

The FTC's authority under the FTC Act reaches persons, partnerships, and corporations in commerce, but the statute excludes banks, certain common carriers, and nonprofit entities. Congress occasionally grants the Commission specific authority over particular nonprofits. Its jurisdiction is therefore narrower than its reputation for being a general privacy regulator.

Question 15Introduction to the U.S. Privacy Environment

Which office administers and enforces the HIPAA Privacy and Security Rules for most covered entities?

  1. The Department of Justice Civil Rights Division
  2. The Office for Civil Rights within HHS Correct answer.
  3. The Federal Trade Commission
  4. State insurance commissioners acting alone

Explanation

The Department of Health and Human Services delegates HIPAA privacy and security enforcement to its Office for Civil Rights, which investigates complaints and negotiates resolution agreements and civil money penalties. The FTC enforces the separate Health Breach Notification Rule for non-HIPAA health apps. State attorneys general may also bring HIPAA-related actions.

Question 16Introduction to the U.S. Privacy Environment

Which Fair Information Privacy Principle limits collection of personal data to what is necessary for a specified purpose?

  1. Individual participation
  2. Accountability
  3. Collection limitation Correct answer.
  4. Security safeguards

Explanation

Collection limitation, reflected in the OECD Guidelines and in the FIPPs generally, directs that personal data be collected by lawful and fair means and, where appropriate, with the knowledge or consent of the individual. It is closely related to the purpose specification and use limitation principles. Together these ideas underpin most modern privacy statutes.

Question 17Introduction to the U.S. Privacy Environment

Which of the following is one of the functions in the NIST Privacy Framework Core?

  1. Protect-P Correct answer.
  2. Audit-P
  3. Retain-P
  4. Report-P

Explanation

The NIST Privacy Framework Core organizes outcomes into five functions: Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P. The framework is voluntary and designed to help organizations manage privacy risk alongside cybersecurity risk. It uses the same function-based structure as the NIST Cybersecurity Framework.

Question 18Introduction to the U.S. Privacy Environment

When the Court of Justice of the European Union invalidated the EU-U.S. Privacy Shield in 2020, what was the central reason?

  1. U.S. surveillance law did not provide essentially equivalent protection Correct answer.
  2. The framework was never approved by the European Commission
  3. Companies failed to pay annual certification fees
  4. The FTC lacked authority to enforce the certifications

Explanation

The court concluded that U.S. surveillance programs and the limited redress available to EU residents meant the transfer mechanism did not ensure protection essentially equivalent to that in the EU. The decision, known as Schrems II, also emphasized the need for transfer impact assessments and supplementary measures. A successor framework was later adopted after executive and redress reforms.

Question 19Introduction to the U.S. Privacy Environment

Which statement best describes the relationship between federal and state privacy law in the United States?

  1. State privacy laws are unenforceable once a federal agency has acted
  2. Federal privacy statutes broadly preempt all state privacy laws
  3. States may generally impose stricter privacy protections than federal law Correct answer.
  4. Only the federal government may regulate the privacy of consumer data

Explanation

Federal privacy statutes typically set a floor rather than a ceiling, and most do not contain broad preemption clauses, so states often legislate more protective rules. Where Congress has expressly preempted a field, such as parts of the FCRA, state law must yield. This layering produces compliance obligations that vary by jurisdiction.

Question 20Introduction to the U.S. Privacy Environment

Compared with the EU's General Data Protection Regulation, federal privacy law in the United States typically does what?

  1. Grants a nationwide right to erasure
  2. Relies on sector-specific statutes and FTC enforcement Correct answer.
  3. Imposes one lawful-basis test on all controllers
  4. Requires a DPO appointment at most companies

Explanation

U.S. federal law lacks an omnibus framework with a single legal basis requirement, universal data subject rights, or mandatory data protection officers. Protection instead comes from industry-specific statutes and general consumer protection enforcement. State comprehensive laws have begun to import GDPR-style rights, but only within those states.

Question 21Introduction to the U.S. Privacy Environment

Where does the text of the U.S. Constitution explicitly mention a right to privacy?

  1. Nowhere; the right is derived from several amendments and case law Correct answer.
  2. The Fourth Amendment
  3. Article I, Section 8
  4. The Fourteenth Amendment

Explanation

The Constitution contains no express privacy clause; the Supreme Court has located privacy interests in the penumbras of the Bill of Rights and in the liberty protected by the Due Process Clause. Courts have drawn on the First, Third, Fourth, Fifth, and Ninth Amendments. The resulting doctrine is judicially constructed rather than textually enumerated.

Question 22Introduction to the U.S. Privacy Environment

How does the APEC Cross-Border Privacy Rules system operate?

  1. It replaced the EU-U.S. Data Privacy Framework in 2023
  2. It is a binding treaty enforced by international tribunals
  3. It applies only to government agencies in member economies
  4. It certifies organizations through independent third-party assessors Correct answer.

Explanation

The CBPR system is a voluntary, accountability-based certification regime in which participating organizations are certified by approved accountability agents against a common baseline of privacy protections. Enforcement occurs primarily through domestic authorities and the agents. It is not a treaty and covers private-sector organizations.

Question 23Introduction to the U.S. Privacy Environment

Which factor is central to the FTC's unfairness analysis under Section 5?

  1. Whether the injury is substantial and not reasonably avoidable Correct answer.
  2. Whether the practice violates a state statute
  3. Whether the practice was described in the privacy policy
  4. Whether the company intended to cause harm

Explanation

Unfairness requires substantial consumer injury that is not reasonably avoidable and is not outweighed by countervailing benefits to consumers or competition. Intent is not an element, and a disclosure does not cure an otherwise unfair practice. Public policy violations can be considered but are not required.

Question 24Introduction to the U.S. Privacy Environment

Which federal statute specifically protects records of video rentals and streaming viewing?

  1. The Cable Communications Policy Act
  2. The Electronic Communications Privacy Act
  3. The Video Privacy Protection Act Correct answer.
  4. The Stored Communications Act

Explanation

The Video Privacy Protection Act prohibits a video tape service provider from disclosing personally identifiable rental or viewing information without informed written consent, and it provides a private right of action. It illustrates how Congress has addressed privacy one industry at a time. Courts continue to apply it to streaming services.

Question 25Introduction to the U.S. Privacy Environment

Which explanation best accounts for describing U.S. privacy law as 'sectoral'?

  1. One agency administers all privacy statutes nationwide
  2. Different statutes govern specific domains such as health, finance, and education Correct answer.
  3. Courts create privacy rules without any legislative input
  4. Privacy rules come solely from self-regulatory industry codes

Explanation

Congress has enacted separate statutes for distinct contexts, including HIPAA for health, GLBA for financial services, and FERPA for education records. Each has its own regulator, definitions, and remedies. The sectoral approach contrasts with jurisdictions that apply a single comprehensive law across the economy.

Question 26Introduction to the U.S. Privacy Environment

A plaintiff suing for intrusion upon seclusion must establish which of the following?

  1. Publication of private facts to the public at large without consent
  2. A false statement that harms the plaintiff's reputation in the community
  3. Commercial use of the plaintiff's name or likeness without any consent
  4. Intrusion into a private matter highly offensive to a reasonable person Correct answer.

Explanation

Intrusion upon seclusion requires an intrusion, physical or electronic, into a matter in which the plaintiff had a reasonable expectation of privacy, and the intrusion must be highly offensive to a reasonable person. Publication is not an element of the tort, which is why it can be complete at the moment of the intrusion.

Question 27Introduction to the U.S. Privacy Environment

The privacy tort of appropriation most directly protects against which harm?

  1. Unconsented commercial use of a person's name or likeness Correct answer.
  2. Physical trespass into a person's home or private office
  3. Disclosure of embarrassing medical information to the public
  4. Publication of a misleading statement about a person's character

Explanation

Appropriation protects a person's interest in the exclusive control over the commercial use of their name, likeness, or other identifying attributes. Liability typically attaches when a defendant uses the plaintiff's identity for commercial advantage without consent.

Question 28Introduction to the U.S. Privacy Environment

The federal Privacy Act of 1974 principally governs which of the following?

  1. Collection of personal data by private online services
  2. Health information held by hospitals and health insurers
  3. Records maintained by federal agencies in systems of records Correct answer.
  4. Consumer credit reporting by private credit bureaus

Explanation

The Privacy Act of 1974 regulates how federal agencies collect, maintain, use, and disclose records about individuals that are stored in a system of records. It also gives individuals rights to access and seek correction of their records.

Question 29Introduction to the U.S. Privacy Environment

Under the Children's Online Privacy Protection Act, an operator of a website directed to children must generally obtain verifiable parental consent before engaging in which activity?

  1. Collecting personal information from a child under 13 Correct answer.
  2. Allowing children to view educational content online
  3. Publishing a privacy policy on the website home page
  4. Displaying contextual advertising to site visitors

Explanation

COPPA requires operators of child-directed sites and services to obtain verifiable parental consent before collecting, using, or disclosing personal information from a child under 13. It also imposes notice obligations and gives parents rights to review and delete that information.

Question 30Introduction to the U.S. Privacy Environment

Under the Family Educational Rights and Privacy Act, when do the rights granted to parents generally transfer to the student?

  1. When the student reaches 13 years of age
  2. When the student turns 18 or attends a postsecondary institution Correct answer.
  3. When the student enrolls in a public elementary school
  4. When the student graduates from high school

Explanation

FERPA gives parents access and amendment rights over education records, and those rights transfer to the student once the student turns 18 or enrolls in a postsecondary institution. At that point the student becomes an eligible student who exercises the rights directly.

Question 31Introduction to the U.S. Privacy Environment

Under the Gramm-Leach-Bliley Act, financial institutions must generally provide consumers with which of the following?

  1. Prior written authorization for every transfer of data to a service provider
  2. Annual notification of every employee who accesses customer data
  3. A right to request deletion of all account records upon demand
  4. An opt-out before sharing with nonaffiliated third parties Correct answer.

Explanation

GLBA requires financial institutions to give initial and annual privacy notices describing how nonpublic personal information is shared, and to offer consumers an opt-out before disclosing that information to nonaffiliated third parties. Certain exceptions, such as servicing and joint marketing arrangements, apply.

Question 32Introduction to the U.S. Privacy Environment

After discovering a breach of unsecured protected health information, a covered entity must generally notify affected individuals within what period?

  1. 24 hours
  2. 90 days
  3. 60 days Correct answer.
  4. 30 days

Explanation

The HIPAA Breach Notification Rule requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery of the breach. Separate rules set timing for media notice and for reporting to the Secretary of HHS when large numbers of individuals are affected.

Question 33Introduction to the U.S. Privacy Environment

Article I, Section 1 of the California Constitution is notable in the U.S. privacy landscape because it does which of the following?

  1. Creates a privacy right enforceable against private parties and government Correct answer.
  2. Requires prior legislative approval before any personal data may be collected
  3. Applies only to state agencies acting in their official capacity
  4. Replaces the state's data breach notification statute

Explanation

California's constitution expressly recognizes privacy as an inalienable right, and California courts have applied it to private actors as well as government entities. This makes it broader in reach than the federal constitutional privacy protection, which requires state action.

Question 34Introduction to the U.S. Privacy Environment

The accountability principle in the OECD Privacy Guidelines provides that a data controller remains responsible for which of the following?

  1. Ensuring that every data subject consents to each use of data
  2. Registering its databases with a central government authority
  3. Destroying all personal data within 30 days of collection
  4. Personal data transferred to a third party, even absent a contract Correct answer.

Explanation

Accountability means the controller must remain answerable for personal data it holds, including data it has transferred to third parties, regardless of whether a contract memorializes the transfer. It requires measures to ensure that obligations are honored downstream.

Question 35Introduction to the U.S. Privacy Environment

Under the FTC's deception policy, a practice is deceptive when it involves which of the following?

  1. A practice that a majority of consumers would find annoying
  2. A material representation or omission likely to mislead a reasonable consumer Correct answer.
  3. Conduct that violates a state privacy statute regardless of harm
  4. Any practice that causes financial loss to at least one consumer

Explanation

The FTC evaluates deception by asking whether there was a representation or omission likely to mislead a reasonable consumer acting reasonably, and whether that representation or omission was material. Actual reliance or financial loss by a particular consumer is not required.

Question 36Introduction to the U.S. Privacy Environment

The Driver's Privacy Protection Act restricts the disclosure of which type of information?

  1. Consumer transaction data held by retail merchants
  2. Student records held by public universities
  3. Personal information in state motor vehicle records Correct answer.
  4. Medical records maintained by health insurers

Explanation

The DPPA restricts the disclosure and use of personal information contained in motor vehicle records maintained by state departments of motor vehicles. It permits disclosure for enumerated purposes, such as law enforcement and safety recall notices.

Question 37Introduction to the U.S. Privacy Environment

A company assembles and sells reports on consumers' creditworthiness that lenders use to make credit decisions. The company is most directly regulated as which of the following?

  1. A financial institution under the GLBA privacy rule
  2. A covered entity under the HIPAA Privacy Rule
  3. A service provider under the COPPA safe harbor
  4. A consumer reporting agency under the FCRA Correct answer.

Explanation

The Fair Credit Reporting Act governs consumer reporting agencies, which assemble or evaluate consumer information for third parties that use it for credit, employment, insurance, and similar eligibility decisions. The statute imposes accuracy, permissible-purpose, and dispute-handling obligations on those agencies.

Question 38Introduction to the U.S. Privacy Environment

A state enacts a law requiring health care providers to notify patients of a breach of their health information within 15 days. How does HIPAA's preemption provision generally apply to that state law?

  1. The state law is invalid unless the HHS Secretary approves it
  2. HIPAA preempts the state law because breach notice is federally regulated
  3. The state law survives because it is more stringent than HIPAA Correct answer.
  4. HIPAA and the state law cannot both apply to the same provider

Explanation

HIPAA preempts contrary state law unless the state law is more stringent, meaning it provides greater privacy protection or more timely notice to individuals. A 15-day notice deadline is faster than HIPAA's 60-day outer limit and therefore generally survives.

Question 39Introduction to the U.S. Privacy Environment

The EU-U.S. Data Privacy Framework adopted in 2023 allows participating U.S. organizations to receive EU personal data by relying primarily on what mechanism?

  1. Self-certification to the U.S. Department of Commerce with binding commitments Correct answer.
  2. Approval by the European Data Protection Board of each transfer
  3. Automatic recognition of every U.S. privacy policy as adequate
  4. A treaty ratified by each EU member state

Explanation

The Data Privacy Framework is an adequacy-based transfer mechanism under which U.S. organizations self-certify to the Department of Commerce and commit to a set of privacy principles, including onward transfer, access, and redress commitments. The European Commission adopted an adequacy decision permitting transfers to certified organizations.

Question 40Introduction to the U.S. Privacy Environment

Which statement best describes a general right to be forgotten under U.S. law?

  1. It applies only to records held by federal agencies
  2. It was created by the Privacy Act and expanded by the FTC
  3. No general right exists; deletion duties arise from specific statutes or orders Correct answer.
  4. It exists as a constitutional right enforceable against search engines and websites

Explanation

The United States has no general, cross-sector right to have accurate personal information erased on demand. Deletion obligations instead come from particular statutes, such as COPPA's parental deletion right, or from specific enforcement orders and settlements.

Question 41Limits on Private-Sector Collection and Use of Data

The FTC's privacy framework is built on fair information practice principles (FIPPs). Which of the following is one of those core principles?

  1. Notice and awareness Correct answer.
  2. Data localization mandates
  3. Mandatory binding arbitration
  4. Biometric retention limits

Explanation

The FTC has long articulated FIPPs as including notice/awareness, choice/consent, access/participation, integrity/security, and enforcement/redress. The other options are unrelated regulatory or contractual concepts, not part of the FIPPs canon.

Question 42Limits on Private-Sector Collection and Use of Data

Under Section 5 of the FTC Act, a practice is unfair if it causes or is likely to cause substantial injury to consumers that is not reasonably avoidable by consumers and is:

  1. disclosed in the company's posted privacy policy
  2. consistent with longstanding industry custom
  3. expressly authorized by a majority of the company's customers
  4. counterbalanced by benefits to consumers or competition Correct answer.

Explanation

Section 5(n) codifies the unfairness test: substantial injury, not reasonably avoidable, and not outweighed by countervailing benefits to consumers or competition. Consent, disclosure, and industry custom do not neutralize an otherwise unfair practice.

Question 43Limits on Private-Sector Collection and Use of Data

Under FTC precedent, a representation, omission, or practice is deceptive when it is:

  1. likely to mislead a reasonable consumer and material Correct answer.
  2. intentional deception that causes actual monetary loss
  3. actually relied upon by a consumer who suffers damages
  4. a written statement the company knew to be false

Explanation

The deception standard asks whether the practice is likely to mislead a reasonable consumer acting reasonably under the circumstances, and whether the misleading aspect is material to the consumer's decision. Intent, actual reliance, and out-of-pocket loss are not required elements.

Question 44Limits on Private-Sector Collection and Use of Data

An app is directed to children and collects names, email addresses, and device identifiers. Under COPPA, the operator must generally obtain which of the following before collecting that data?

  1. Email notice to the parent within thirty days
  2. The child's own affirmative assent before collection
  3. Verifiable parental consent before collection Correct answer.
  4. A posted notice with a parental opt-out after collection

Explanation

COPPA requires operators of sites and services directed to children to obtain verifiable parental consent before collecting, using, or disclosing personal information from a child under 13. Narrow exceptions, such as limited internal use with notice and an opt-out, exist but do not cover general collection and disclosure.

Question 45Limits on Private-Sector Collection and Use of Data

Under CAN-SPAM, a commercial email sender must honor a recipient's opt-out request within:

  1. 10 business days Correct answer.
  2. 45 calendar days
  3. 5 business days
  4. 30 calendar days

Explanation

CAN-SPAM requires that opt-out requests be honored within 10 business days of receipt, and the sender may not charge a fee or require information beyond an email address to process the request. The other periods do not appear in the statute.

Question 46Limits on Private-Sector Collection and Use of Data

Which statement correctly describes the established business relationship (EBR) defense to the National Do Not Call Registry under TCPA rules?

  1. It applies only to calls placed to business telephone numbers
  2. It arises only when the consumer signs a written contract
  3. It lasts 18 months after a transaction and 3 months after an inquiry Correct answer.
  4. It lasts indefinitely once the consumer makes any purchase

Explanation

The EBR exception lasts for 18 months after the consumer's last transaction and 3 months after an inquiry or application. It ends earlier if the consumer asks to be placed on the company's internal do-not-call list.

Question 47Limits on Private-Sector Collection and Use of Data

Before a financial institution subject to GLBA discloses a consumer's nonpublic personal information to a nonaffiliated third party, it must generally:

  1. obtain a notarized authorization signed by the consumer
  2. limit the sharing to a period of no more than twelve months
  3. provide a privacy notice and a reasonable opportunity to opt out Correct answer.
  4. register the sharing arrangement with the FTC

Explanation

GLBA requires clear and conspicuous initial (and annual) privacy notices and a reasonable opportunity to opt out before disclosing nonpublic personal information to nonaffiliated third parties. Statutory exceptions, such as disclosures to service providers and joint marketers, can reduce or eliminate the opt-out requirement.

Question 48Limits on Private-Sector Collection and Use of Data

Under the federal Wiretap Act, which statement best describes when a private party may record a telephone conversation to which that party is a participant?

  1. Only when all parties give written consent
  2. A party to the conversation may generally record it Correct answer.
  3. Never, absent a warrant
  4. Only when a law enforcement officer is present

Explanation

Federal law follows a one-party consent rule: a participant may record a communication unless the recording is done for a criminal or tortious purpose. Some states impose all-party consent, so compliance must be checked jurisdiction by jurisdiction.

Question 49Limits on Private-Sector Collection and Use of Data

Which of the following is a permissible purpose for obtaining a consumer report under the FCRA?

  1. An insurer underwriting a policy the consumer applied for Correct answer.
  2. A private investigator gathering evidence in a divorce case
  3. A journalist verifying a subject's creditworthiness
  4. A neighbor checking a new resident's payment history

Explanation

The FCRA enumerates permissible purposes, including credit transactions, employment, insurance underwriting, and review of an existing account. Curiosity, journalism, and private litigation unrelated to a listed purpose do not qualify.

Question 50Limits on Private-Sector Collection and Use of Data

An employer plans to rescind a job offer based on a background report. Before taking that adverse action, the employer must generally:

  1. provide the report and an FCRA summary of rights Correct answer.
  2. wait at least thirty days after receiving the report
  3. notify the FTC of the intended adverse action
  4. obtain a court order authorizing use of the report

Explanation

The FCRA's pre-adverse action process requires that the applicant receive a copy of the report and a summary of FCRA rights before the employer finalizes an adverse decision. A second notice of adverse action is then required after the decision is made.