IAPP CIPP/US: Navigating American Privacy Law

American privacy compliance is a problem of overlapping authority. A consumer-data practice may involve a federal regulator, a sector-specific requirement, a state privacy law, contractual promises, and rules affecting particular technologies or populations. The United States does not have one nationwide equivalent to the GDPR that replaces all these regimes. The IAPP Certified Information Privacy Professional/United States, or CIPP/US, develops the ability to identify which privacy rules and enforcement pathways matter in a given factual situation.

The IAPP's CIPP/US Body of Knowledge version 2.6.1, effective September 2025, covers the U.S. legal and regulatory environment, federal privacy law, state privacy law, and privacy practice in the workplace and marketplace. The point of learning these areas together is to avoid superficial conclusions. An action that seems permissible under one law may face additional duties in another jurisdiction or sector; a privacy statement can create separate expectations from statutory requirements; and a company's business model can affect which rules apply.

Read legal authority before drawing conclusions

Begin with the sources of U.S. law: the Constitution, federal and state statutes, agency rules, judicial decisions, and the role of contractual commitments. A dispute about an online merchant is not analyzed in exactly the same way as access to records held by a public agency. Questions about jurisdiction, preemption, enforcement authority, and private rights of action affect what remedies and procedures are available. A candidate needs to distinguish who can enforce an obligation, not merely recognize a familiar agency acronym.

The Federal Trade Commission is an important federal privacy and consumer-protection actor, including through authority over unfair or deceptive acts or practices where the legal conditions are satisfied. Privacy notices and public promises can therefore matter operationally: a company that describes a limited data use but conducts undisclosed sharing may face more than customer dissatisfaction. However, the FTC does not enforce every U.S. privacy requirement, and not every dispute can be solved by reporting it to the FTC. Federal communications, health, financial, and other regulators have separate responsibilities.

States contribute their own privacy, security, breach-notification, biometric, consumer-protection, and other frameworks. A law may define 'personal information,' a covered business, a consumer, a sale, or a targeted-advertising activity in ways that differ from another statute. Before asserting coverage, identify the state, the applicable effective provisions, thresholds or exemptions, and the entity's activities. Newer state privacy laws and amendments make a static, undated list especially unreliable as a compliance tool.

The contrast with CIPP/E is instructive. EU legal principles and institutional architecture cannot be mechanically imported into U.S. law. Some ethical objectives, such as proportional collection and honoring representations to people, may be shared, but compliance requires matching actual obligations to applicable authority rather than calling every U.S. requirement 'GDPR-style.'

Understand federal sectoral duties and the FTC's role

Federal privacy law contains substantial sector-specific requirements. In healthcare, HIPAA's privacy and security framework applies to defined covered entities and business associates and particular protected health information. An ordinary wellness app does not become a HIPAA-covered entity merely because it processes information about fitness or health; the legal status of the entity and the information matter. Other consumer-protection and state laws may still apply when HIPAA does not.

Financial privacy brings frameworks such as the Gramm-Leach-Bliley Act and relevant regulations, including distinctions between types of financial institutions, information, notices, and safeguards. Education records can implicate FERPA in covered contexts. Children's online information raises distinct questions under COPPA and related rules, including the applicability of protections based on the service and children involved. Memorizing the law names without their scope leads to incorrect advice.

Communications and marketing rules also require precision. Email marketing, telemarketing, recording communications, and sharing certain customer information can be governed by different statutory and regulatory provisions. A company may satisfy one notice requirement and remain exposed elsewhere. For exam scenarios, first identify the type of communication and information, the relationship with the individual, and the particular practice—collection, marketing, retention, disclosure, or security—before selecting a legal response.

Regulators evaluate evidence, not just intent. A security promise should be supported by reasonable processes and technical measures. Weak access control, excessive retention, deceptive design, or inadequate vendor oversight can create real-world problems even if the organization has never publicly described itself as a privacy specialist. Operational work discussed in the approved article on data classification and data loss prevention can reduce exposure, but it should be adopted for the applicable legal and business purposes rather than presented as a statute by itself.

Interpret state privacy rights by jurisdiction

State consumer-privacy laws often address notices, individual rights, business disclosures, and controls relating to certain forms of processing. Their definitions, thresholds, deadlines, exemptions, and enforcement arrangements are not perfectly uniform. One state's 'sale' may involve a concept that cannot be reduced to a conventional cash transaction; another rule may separately address targeted advertising. A privacy professional must learn to identify the actual legal definition instead of relying on common-language assumptions.

California is particularly influential, with the CCPA as amended by the CPRA forming a substantial framework for many covered businesses and residents. Other states have adopted comprehensive privacy laws with their own requirements and implementation details. Rather than assume a national standard from one prominent state, build a comparison by the specific rights and duties relevant to a service: access, correction, deletion, portability, opt-out mechanisms, sensitive-data handling, retention, and permitted exemptions.

Consider a merchant that offers discounts through a loyalty program while sharing event data with advertising partners. The relevant questions include whether the business is covered, whether a transfer constitutes a regulated activity under the chosen state's definitions, what disclosures are required, and how a consumer can exercise an applicable right. Technical implementation may need consistent signals across web, app, and server-side integrations. A banner that changes only what the browser displays may not affect data already sent through another pipeline.

This complexity explains why a functioning privacy program under CIPM is a complement to jurisdictional legal knowledge. Teams need a way to update their obligations register, translate requirements into product controls, and record individual requests. The relevant statutes determine the duties; the program ensures a person or system is responsible for carrying them out accurately.

Address workplace, marketing, and data-broker practices

Employee information requires a distinct analysis from customer marketing data. Hiring, background checks, monitoring of workplace systems, payroll, benefits, and retention of personnel records may be influenced by labor and employment rules, consumer-reporting requirements, state law, and organizational promises. Employers often have legitimate operational needs for records, but the ability to collect information does not make every secondary use appropriate or permitted.

A background screening provider and the employer commissioning a report can have different responsibilities depending on the legal framework and transaction. Similarly, employee monitoring may require notices or limitations shaped by jurisdiction and circumstance. CIPP/US study should ask why a particular category is collected, which actor can use it, how long it remains, and what rights or restrictions apply. 'Employee data is internal data' is not a legal analysis.

In the consumer marketplace, behavioral advertising, data-broker transfers, profiling, and biometric identification create distinctive privacy risks. A person may never interact directly with the entity that acquires a compiled dossier about them. That complicates transparency, accuracy, and accountability. The correct response depends on the precise practice and legal regime; not every commercial data transfer has the same classification or permitted conditions.

Security and privacy overlap in these use cases. A breach of marketing profiles can cause identity or reputational harm, while a surveillance program may raise privacy concerns even if no attacker ever accesses the data. The distinction developed in cybersecurity and data privacy helps separate preventing unauthorized disclosure from justifying the underlying collection and use. Both dimensions belong in responsible data practices.

Manage incidents, vendors, and cross-border questions

Privacy incidents must be reviewed under the applicable notification regimes. U.S. state breach-notification rules can vary in the definition of covered information, triggering circumstances, timing, recipient, and method. Sector-specific requirements may add separate duties. A company's response should establish what happened, which records were involved, who was affected, which laws apply, and what communications are required. Avoid the assumption that one fixed deadline covers every U.S. breach.

Vendor management involves allocation of responsibilities in real workflows. Cloud hosting, payment processors, advertising technology, support platforms, and analytics services may receive different information for different reasons. Contractual promises, access controls, supplier security, onward sharing, retention, and the ability to answer consumer requests deserve review. A company cannot guarantee its privacy obligations by assuming its vendors are invisible to the business.

U.S. companies operating internationally may also need to consider foreign rules and data-transfer mechanisms. If personal data originating in Europe is processed in the United States, the legal analysis may involve EU rules as well as domestic law. This does not mean every U.S. business is automatically subject to foreign law. Applicability, actor roles, transfer circumstances, and currently valid mechanisms must be established from facts and authoritative sources.

Technical controls should support a legally justified design. The IAPP CIPT credential emphasizes implementing privacy in systems, from collection and authorization to deletion. For CIPP/US, the critical contribution is diagnosing the relevant legal constraints so product and security teams know which engineering decisions require attention.

Study for issue spotting, not a catalogue of acronyms

The current CIPP/US Body of Knowledge sets out competency expectations and the exam blueprint. Use it as the primary study map, distinguishing the U.S. legal environment, federal sectoral frameworks, state law, and practical contexts. Record the version and effective date of the study source. Rapid changes in state privacy requirements mean candidates should check authoritative updates rather than relying solely on older summaries, especially for effective dates and enforcement arrangements.

A productive exercise is to analyze a fictitious consumer-data workflow in several settings. Take one set of data—customer contact information, purchase history, device identifiers—and ask how the issues change when the service serves children, a covered medical provider processes health records, a merchant shares advertising signals, or an employer screens applicants. Write the legal questions before the solution. This trains the ability to distinguish scope from remedy.

For each scenario, identify actors and facts first; then consider sources of law, notice and choice, limitations on collection and disclosure, security, retention, rights, and enforcement. When uncertain, state what would need to be verified. A defensible answer is sometimes that more factual information is necessary, not that a familiar privacy control solves every situation.

The broader IAPP certifications serve different professional tasks. CIPP/US develops U.S. legal fluency, CIPM develops operational program management, and CIPT develops technical implementation. The value of CIPP/US preparation lies in the ability to explain which rule governs an American data practice, why it applies, who is responsible, and what a proportionate response requires.