CIPP/US study plan

Map the four fair information practice principles (notice, choice, access, security) onto at least three U.S. sectoral statutes to see where each principle appears or is missing

Distinguish FTC Act Section 5 'deceptive' from 'unfair' practices and write a one-sentence test for each

Build a timeline card showing how U.S. privacy law moved from sectoral patchwork to comprehensive state statutes

Identify the constitutional, common-law (intrusion upon seclusion, public disclosure), and statutory sources of U.S. privacy obligations and give one example of each

Classify HIPAA covered entities versus business associates and state what triggers a business associate agreement

Summarize GLBA's safeguards, privacy notice, and pretexting prohibitions in three bullet points each

Explain COPPA's actual-knowledge standard, verifiable parental consent, and the scope of 'personal information' for children

Differentiate FCRA consumer report, furnisher, and user duties, and distinguish investigative consumer reports

List the data types protected by DPPA, VPPA, and the Cable Act and note each statute's consent mechanism

Compare CAN-SPAM, TCPA, and telemarketing rules on consent type, opt-out mechanics, and penalty structure

Trace how ECPA's Wiretap Act, Stored Communications Act, and Pen Register Act differ in the consent model and legal standard required

Apply the SCA categories (provider of electronic communication service vs. remote computing service) to a hypothetical cloud-storage scenario

Explain when the one-party consent rule permits recording and when state all-party consent law overrides it

Apply the Fourth Amendment reasonable-expectation-of-privacy test and the third-party doctrine to a set of fact patterns

Explain how Carpenter v. United States narrowed the third-party doctrine for cell-site location information and identify what it left open

Distinguish a warrant, subpoena, court order, and national security letter by showing of relevance, notice, and gag provisions

Outline FISA's Section 702 and Section 215 authorities and the role of the FISC

Describe state-level access statutes, the CLOUD Act's effect on cross-border data demands, and emergency-disclosure exceptions

Analyze employee monitoring scenarios (email, video, GPS, keystroke) using the reasonable-expectation-of-privacy and business-purpose tests

Distinguish the NLRA's protected concerted activity limits on employer social-media and speech policies

Explain the effect of a Bring Your Own Device policy and mobile-device management software on employer access rights

Summarize background-check obligations under FCRA as applied to employment, including adverse action notices

Identify workplace drug-testing, medical-information, and genetic-information constraints under ADA, GINA, and state law

Compare the threshold applicability, consumer rights, and opt-out/opt-in rules across at least four comprehensive state privacy laws

Walk through CCPA/CPRA: business versus service provider, sale versus sharing, sensitive personal information limits, and cure periods

Contrast controller/processor terminology across state statutes with the CCPA's business/service provider framing

Explain how universal opt-out mechanisms and global privacy control signals change compliance obligations

Build a state data-breach-notification comparison covering trigger standard, timing, and regulator notice

Explain the private right of action landscape across state laws, including BIPA and state consumer-protection statutes

Track sector-specific state rules for employee data, minors, and health information that overlay comprehensive statutes

Revisit Domain 1 concepts and connect federal preemption questions and FTC enforcement priorities to the state-law patchwork

Re-score every prior deliverable and rewrite the three weakest explanations from memory

Complete two full-length timed practice sets and log every missed item by domain

Drill the most-missed domain until practice accuracy on that domain exceeds 85%

Recite from memory the legal standard for each major government-access mechanism without notes