How to Prepare for the CIPP/US
Updated on 9 October 2026, prices checked on 8 October 2026. Written by Bas Hennis.
To prepare for the CIPP/US, master the structure of US privacy law first, then the sector rules and the state laws, then the question types. A beginner needs about a month at three hours a day by our working estimate. On 22Academy that month costs €117, including sales tax or VAT where it applies and a full trial exam. The IAPP’s official online training costs $1,195 ($995 for members). Want to know where you stand before you read on? The free CIPP/US assessment on 22Academy shows it in about 15 minutes.
I have prepared professionals for certification exams since 2018 on 22Academy, our sister platform within Future Prep. Every figure about another provider in this guide names its source and the date we checked it.
What the CIPP/US is
The CIPP/US, the Certified Information Privacy Professional/United States, is the IAPP certification for US private-sector privacy law. There is no single US privacy statute. The exam therefore tests how the federal sector laws and the state privacy laws fit together, and how the FTC and state attorneys general enforce them. That is what the 22Academy CIPP/US course trains: applying the right law to the facts, question by question.
There are no prerequisites: no course, no degree and no minimum experience. You sit the exam online or at a test centre. For each certification the IAPP publishes a Body of Knowledge, which lists what the exam is written from. The CIPP/US version in force is 2.6.1, effective from 1 September 2025, with an exam blueprint giving the question range per domain.
CIPP/US exam format and fees
The exam has 90 questions: 75 scored and 15 unscored trial items. You get 150 minutes with an optional 15-minute break, and you pass at 300 on a scale of 500.
The exam costs $550 for members and non-members alike. You must sit it within a year of buying it. If you fail, a retake costs $375, and you can sit it at least seven days after your first attempt. So the cheapest preparation is the one that tells you beforehand whether you are ready. The free CIPP/US assessment is the first step. To keep the certification you earn 20 continuing education credits every two years and pay a $250 maintenance fee, which IAPP membership at $295 a year includes.
The five CIPP/US domains
CIPP/US preparation is lopsided by design. Two domains carry more than half the exam. The figures count scored questions, and the 22Academy CIPP/US course follows the same five domains.
The US privacy environment: 27 to 33 questions
The largest domain in CIPP/US preparation. It covers the structure of US law, sources of law, preemption, private rights of action and the regulators. Enforcement follows: civil and criminal liability, unfair and deceptive practices, state enforcement and self-regulation. Information management closes it, from data inventories and vendor contracts to incident response and international transfers.
Section 5 of the FTC Act is the centre of gravity. Learn the difference between deception and unfairness with our explainer on unfair or deceptive practices under the FTC.
Limits on private-sector collection and use: 15 to 19 questions
This is where CIPP/US study meets the sector laws. First the FTC Act and COPPA. Then healthcare with HIPAA and HITECH, followed by finance with the FCRA, FACTA and GLBA. Education, telecommunications and marketing follow. Coverage decides answers here. Read who HIPAA actually covers before you assume a health app falls under it. Then practise coverage questions on the more than 1,500 questions in the 22Academy CIPP/US course.
Government and court access: 3 to 5 questions
Law enforcement access to financial data and communications, national security surveillance and civil litigation. ECPA alone splits into three regimes, explained in the three parts of ECPA. It is a small domain, so learn its distinctions and move on.
Workplace privacy: 4 to 6 questions
For CIPP/US study this domain covers agencies, anti-discrimination law, automated decisions in hiring, background screening, monitoring, investigations and the end of employment. Matching an agency to a scenario is a common question form.
State privacy laws: 17 to 21 questions
The fastest-moving part of the exam. It covers federal versus state authority and the comprehensive state laws, with the CCPA as amended by the CPRA as the reference. Then data subject rights, health data rules, biometric privacy laws, AI bias laws and breach notification. Studying for the CIPP/US here means learning how each state deviates from the reference model.
How long it takes to study for the CIPP/US
Our working estimate is about a month at three hours a day for a beginner. A professional who already handles US compliance may need a week. The IAPP recommends at least 30 hours of training and study per certification, as a minimum alongside a course. Your own estimate comes from the free CIPP/US assessment: 24 questions, about 15 minutes, with a score per domain.
Plan by weight. The privacy environment and the state laws together can carry up to 54 of the 75 scored questions. Give them the bulk of your CIPP/US prep time.
How the CIPP/US questions are built
In CIPP/US study, knowing the statutes and answering the questions are two separate skills. Questions come in recognisable shapes: two-statement true or false, best answer, definitions, sequences and scenarios. Scenarios often turn on one fact: who holds the data, which state the consumer lives in or whether a promise was made.
22Academy tags every practice question with one of twenty question structures and shows your score per structure. You then see whether a lost mark came from the law or from the question type.
The Exam Question Masterclass, once a separate course, is now part of every 22Academy course, so the technique for each structure is explained where you meet it. A full trial exam closes the course, timed and analysed by domain and by question structure. We build it to be harder than the real exam, on purpose.
We stand behind that standard. Suppose you pass our trial exam at your first attempt, sit the real exam within two weeks and fail it. Then you get a free trial exam or your money back for the one you paid for. You will find the conditions in the FAQ. Already booked your exam? A trial exam on its own costs €42, or €27 with a subscription.
What the IAPP gives you free
Begin on the IAPP’s CIPP/US certification page. It links the Body of Knowledge and exam blueprint, with every topic and the question range per domain. The candidate handbook covers booking and exam-day rules. A free study guide with sample questions is available through a request form. Read all three before you pay for CIPP/US preparation. Then measure yourself against the Body of Knowledge with the free CIPP/US assessment.
What CIPP/US preparation costs: four routes compared
The breadth of the CIPP/US decides how long you study, and the time you study decides what you pay. So we priced four candidates. Our beginner needs about a month. A compliance professional needs a week. Then a third person stops after one week, and a fourth is interrupted halfway by work.
How we compared
Each price is the one listed on 8 October 2026. The 22Academy pricing page shows euro prices that include VAT or sales tax where it applies. For the other providers, the table notes whether tax is mentioned at all. We converted no currencies and estimated no figures. You can also test the 22Academy column yourself, because the free CIPP/US assessment and lesson 1 cost nothing.
Three other ways to prepare for the CIPP/US went into the table: the IAPP’s official online training, Privacy Bootcamp and a Udemy course. The Udemy course is the highest-rated one we found with at least 30 ratings that claims the current Body of Knowledge. It is “CIPP/US Privacy US – Best 2026 Practice Exam Questions” by Privacy Hub, rated 4.2 from 50 ratings.
Preparation costs compared
| 22Academy | IAPP online training | Privacy Bootcamp | Udemy course | |
|---|---|---|---|---|
| Beginner, ready to sit | €117 including tax, trial exam included (about a month) | $1,195, $995 for members; tax not stated | $499; tax not stated | Varies by country; tax may be added |
| Experienced, one week | €37 including tax | $1,195 | $499 | The same purchase price |
| Paid if you stop after week one | €37; the assessment and lesson 1 are free | $1,195 | $499 | The purchase price |
| Access and pausing | Weekly or monthly, cancel any time; progress kept for a year | Access period not stated; modules can be paused | Lifetime access, including updates | Lifetime access while Udemy holds the licence |
| Practice questions | More than 1,500 | Review questions, number not stated; a separate 90-question practice exam costs $55 ($45 for members) | 650+ | 257, in six tests |
| Trial exam | Full length, timed, analysed by domain and question structure | Practice exam as a PDF with answers and explanations; timing not stated | Full length, timed | Six tests, four full length; timing not stated |
| Flashcards | In every lesson, weighted to the topics you find hard, plus a repetition quiz | Not stated | 1,400+ | Not stated |
| Study plan | A personal route built on the assessment | Not stated | Self-paced, no plan | Not stated |
| Body of Knowledge | Version 2.6.1 | Version not named | “Latest version”, number not named | “2026”, number not named |
| Analysis by question structure | Yes, twenty structures | Not stated | Not stated | Not stated |
| Confidence against accuracy | Yes | Not stated | Not stated | Not stated |
| Using your own AI assistant | Yes, prompts on the study cards | Not stated | Not stated | Not stated |
| Technique for scenario questions | Yes, skills cards | Not stated | Not stated | Not stated |
Sources: each provider’s own pages, checked on 8 October 2026. “Not stated” means the page does not say. The 22Academy CIPP/US course page shows what sits behind the first column.
Lifetime access against a moving syllabus
US privacy law moves through statehouses as well as Congress, and the IAPP reviews each Body of Knowledge every year. A CIPP/US prep course is worth what it matches on the day you sit the exam. Access that runs for decades after you pass does not change your score. Start with the free assessment and lesson 1, no payment needed.
Stopping or pausing CIPP/US prep
Here CIPP/US prep costs split. On 22Academy you start with a free assessment (24 questions, about 15 minutes) and a free first lesson. If the course then does not suit you, one week at €37 is all you have paid. A one-off course takes its full price before you have read a page.
A pause in your CIPP/US preparation is just as cheap. Cancel your plan and we keep your progress for a year after your last paid period, while the course stays current. How it works shows the route from the assessment to the trial exam, and the CIPP/US course page shows what the course covers.
Join the CIPP/US study group
Studying alone for a certification exam is harder than it needs to be. Our CIPP/US study group on Facebook brings together candidates at every stage and certified professionals who share what they learned. Members post questions, discuss difficult topics and report back after their exams. Joining costs nothing. For articles and study tips, also follow Privacy Study Group on LinkedIn.
Want to measure your progress against a study partner? Each of you can take the free CIPP/US assessment and compare scores per domain.
After the CIPP/US exam
Your result and score appear on screen when you finish. If you pass, the IAPP sends your digital certificate by email through Accredible within two weeks. If you do not pass, you buy a new exam, which costs $375 as a retake, and you can sit it at least seven days after your attempt. Use that time on your weakest domains; the free CIPP/US assessment shows them per domain.
Where the certificate takes you depends on the job you want. The 22Academy career plan shows for each role which certifications it takes, in which order and for how long. For privacy counsel the route runs from the CIPP/E to the CIPP/US; if you already hold the CIPP/E, you start with the CIPP/US. As a CIPP, the CIPP/US is also the first half of the IAPP’s Fellow of Information Privacy designation, which adds a CIPM, CIPT or AIGP and three years of privacy work.
22Academy prepares you for the CIPP/E, CIPM, CIPT and AIGP with the same method; see all certifications.
For teams: Future Prep
Training a whole privacy or compliance team? Future Prep, which runs Privacy Study Group and 22Academy, trains organisations on a comparable system of assessment, measurement and repetition. It adds one thing: role-play of real situations at work, so people practise the decisions they will actually face. See Future Prep’s training programme.
Questions people ask before they prepare for the CIPP/US
Four questions come up when people weigh their options.
How long does it take to prepare for the CIPP/US?
About a month at three hours a day by our working estimate. A professional who already handles US compliance may need a week. The IAPP’s own minimum is 30 hours of training and study.
Do I need to live or work in the United States?
No. The CIPP/US has no prerequisites, and you can sit it online from anywhere. To see where you start, take the free CIPP/US assessment.
Which state laws does the exam cover?
Start with the CCPA as amended by the CPRA, the reference model. The Body of Knowledge also names Virginia, Colorado, Connecticut, Utah, Nevada, Florida, Oregon, Texas and Montana, with Illinois for biometrics.
Can I pause and pick it up later?
On 22Academy, yes. Cancel at the end of any week or month and your progress waits for a year. Start free and see how far you get in the first week.
Where to start
Take the free CIPP/US assessment on 22Academy. In about 15 minutes you see your score per domain and how long you need, before you spend anything. Then build your plan around the gaps with the 22Academy CIPP/US course.
