IAPP · Free, ad-free audio course
A structured, audio-first learning route for IAPP CIPP, designed for focused review and practical understanding.
PUT IT INTO PRACTICE
Try 50 original BMC questions, review every explanation, and return to the lessons behind the answer. No login is required. Earn Challenge achievements and share your progress as you go.
Independent BMC learning practice—not official exam items, a full mock exam, or an exam-readiness score.
Companion Books
The study guide helps you organize and revisit the material. The flashcards book adds active recall and rapid review across the course objectives.
Study Guide
Use the companion study guide to organize the material, compare important concepts, annotate key ideas, and build a written reference for review.
Flashcards Book
Use the flashcards book for active recall, terminology checks, rapid review, and repeated practice across the course objectives.
Complete Lesson Directory
Search by topic or narrow the directory by exam domain. Courses with multiple editions are organized below so every season remains easy to find. Each lesson includes its own audio player, full description, transcript when available, and previous-or-next navigation.
97 lessons available
Getting Started and Review
This opening episode introduces you to the Certified Information Privacy Professional/United States credential and why it has become the gold standard for privacy expertise in the U.S.…
Getting Started and Review
Preparation is as much about organization as it is about knowledge. This episode walks you through how to create a structured study timeline that balances your daily commitments with the demands of the CIPP/US Body of Knowledge.…
Getting Started and Review
Knowing what to expect on exam day is half the battle. In this episode, we break down the structure of the CIPP/US exam, including the multiple-choice question types, how scenario-based items are framed, and the scoring model used by the IAPP.…
Getting Started and Review
Memorization alone won’t get you through the CIPP/US exam—you need a strategy for long-term retention. This episode explores proven study methods such as spaced repetition with flashcards, active recall exercises, and audio reinforcement.…
Getting Started and Review
The glossary is more than a list of definitions—it’s a map of the exam’s language. In this first glossary deep dive, we focus on terms from Domains I and II, which cover the U.S.…
Getting Started and Review
Our second glossary session turns to Domains III and IV, covering government access to private-sector information and workplace privacy. These domains introduce terminology around subpoenas, national security powers, and workplace monitoring practices.…
Getting Started and Review
The third glossary episode covers Domain V and other cross-cutting terms that frequently surface across multiple sections of the exam.…
Domain I · The U.S. Privacy Environment
Domain I introduces the U.S. privacy environment at its broadest level. In this episode, we review how the branches of government shape privacy law, the sources of law that contribute to the framework, and the roles of regulatory authorities such as the FTC, FCC, and HHS.…
Domain I · The U.S. Privacy Environment
This episode examines how the structure of U.S. government influences the development and enforcement of privacy law. We look at the distinct roles of the legislative, executive, and judicial branches, and how statutes, regulations, and case law interact to shape privacy obligations.…
Domain I · The U.S. Privacy Environment
Understanding sources of law is critical to mastering the CIPP/US. In this episode, we unpack the U.S. Constitution’s role in privacy, including federal preemption, the Bill of Rights, and state constitutional guarantees.…
Domain I · The U.S. Privacy Environment
This episode dives into the analytical tools used to interpret and apply privacy laws. We’ll break down jurisdiction—who has authority over a particular dispute—and how state and federal powers often overlap.…
Domain I · The U.S. Privacy Environment
U.S. privacy law cannot be understood without recognizing the regulators that enforce it.…
Domain I · The U.S. Privacy Environment
While federal agencies are powerful, state-level enforcement often drives privacy practice in the U.S. This episode highlights the role of state attorneys general, who bring enforcement actions under state privacy laws, consumer protection statutes, and data breach notification acts.…
Domain I · The U.S. Privacy Environment
Not all privacy enforcement comes from government. This episode introduces self-regulatory models such as industry codes of conduct, seal programs, and voluntary frameworks.…
Domain I · The U.S. Privacy Environment
Liability is the heart of enforcement. In this episode, we distinguish between civil liability, such as damages from consumer lawsuits or regulatory penalties, and criminal liability, which may arise from intentional misconduct like fraud or unauthorized access.…
Domain I · The U.S. Privacy Environment
Fiduciary duty, long established in corporate and financial contexts, is increasingly applied to data stewardship. This episode introduces the three core fiduciary duties: care, loyalty, and good faith.…
Domain I · The U.S. Privacy Environment
Negligence and unfair or deceptive acts and practices (UDAP) are core theories of liability in privacy enforcement. This episode explains how negligence involves failure to meet a standard of reasonable care, such as not securing personal data.…
Domain I · The U.S. Privacy Environment
This episode focuses on the interplay of federal and state enforcement bodies. We begin with the Department of Justice, which prosecutes criminal violations and litigates civil cases on behalf of federal agencies.…
Domain I · The U.S. Privacy Environment
Privacy enforcement is increasingly global. This episode introduces the Global Privacy Enforcement Network (GPEN), a collaboration of regulators worldwide who share information and coordinate investigations.…
Domain I · The U.S. Privacy Environment
Building on our earlier discussion of self-regulation, this episode focuses specifically on enforcement mechanisms.…
Domain I · The U.S. Privacy Environment
Strong privacy programs begin with knowing what data you have. This episode covers how organizations build and maintain a data inventory, cataloging personal information across systems, applications, and vendors.…
Domain I · The U.S. Privacy Environment
Data doesn’t stay put—it flows across systems, organizations, and borders. This episode explains how to map those flows, identify points of transfer, and implement controls that ensure compliance.…
Domain I · The U.S. Privacy Environment
Building a privacy program is more than drafting policies—it requires embedding privacy into operations. In this episode, we cover workforce training, including how to tailor content for different roles and ensure employees understand their responsibilities.…
Domain I · The U.S. Privacy Environment
Cloud services and third-party vendors introduce unique privacy challenges. This episode examines how processing agreements define roles and responsibilities between controllers and processors, including clauses on security, breach notification, and sub-processing.…
Domain I · The U.S. Privacy Environment
Privacy law intersects with cybersecurity when incidents occur. This episode explains how organizations build incident response programs to address threats like ransomware, data breaches, and vendor security failures.…
Domain I · The U.S. Privacy Environment
Accountability is the thread connecting all privacy obligations. In this episode, we define accountability models as frameworks for demonstrating compliance through documentation, assessments, and governance structures.…
Domain I · The U.S. Privacy Environment
Data has a lifecycle, and managing it responsibly is critical for privacy compliance. This episode covers retention schedules that specify how long data must be kept, archival practices for historical or legal purposes, and secure disposal methods to prevent unauthorized access.…
Domain I · The U.S. Privacy Environment
The online environment presents unique privacy risks. This episode examines how tracking technologies, behavioral profiling, and targeted advertising shape consumer experiences and regulatory responses.…
Domain I · The U.S. Privacy Environment
U.S. companies regularly transfer data across borders, triggering international privacy obligations. This episode introduces the Schrems cases, which invalidated earlier EU-U.S.…
Domain I · The U.S. Privacy Environment
Privacy law collides with other legal obligations when organizations face multinational conflicts. This episode highlights the tension between U.S. e-discovery requirements in litigation and EU data protection laws that restrict data transfers.…
Domain I · The U.S. Privacy Environment
This episode explores how U.S. privacy frameworks compare to the European Union’s General Data Protection Regulation (GDPR) and Switzerland’s Federal Act on Data Protection (FADP).…
Domain II · Limits on Private-Sector Collection and Use
Domain II focuses on federal and state laws governing specific sectors such as health, finance, education, and telecommunications. This episode introduces the federal “sectoral” approach, where distinct statutes regulate different industries rather than one overarching law.…
Domain II · Limits on Private-Sector Collection and Use
The Federal Trade Commission is often described as the nation’s top privacy cop. This episode dives into Section 5 of the FTC Act, which prohibits unfair and deceptive acts or practices.…
Domain II · Limits on Private-Sector Collection and Use
Children’s privacy carries heightened protections in U.S. law. This episode introduces the Children’s Online Privacy Protection Act (COPPA), which governs the collection of personal information from children under 13.…
Domain II · Limits on Private-Sector Collection and Use
Enforcement brings theory into practice. In this episode, we review major FTC privacy and data security cases, highlighting recurring themes such as inadequate security, deceptive disclosures, and failure to honor stated practices.…
Domain II · Limits on Private-Sector Collection and Use
Privacy law continues to evolve as technology advances.…
Domain II · Limits on Private-Sector Collection and Use
The Health Insurance Portability and Accountability Act (HIPAA) remains one of the most significant federal privacy statutes. This episode explains the Privacy Rule, which establishes protections for protected health information (PHI).…
Domain II · Limits on Private-Sector Collection and Use
Complementing the Privacy Rule, the HIPAA Security Rule sets standards for protecting electronic protected health information (ePHI). This episode breaks down its three safeguard categories: administrative, physical, and technical.…
Domain II · Limits on Private-Sector Collection and Use
The Health Information Technology for Economic and Clinical Health Act (HITECH) strengthened HIPAA enforcement and introduced federal breach notification requirements.…
Domain II · Limits on Private-Sector Collection and Use
The 21st Century Cures Act sought to promote innovation by improving interoperability and data sharing in healthcare. This episode explains how the Act prohibits “information blocking,” requiring health IT systems to enable secure, authorized data exchange.…
Domain II · Limits on Private-Sector Collection and Use
Health information involving substance use disorder patients receives special protections under federal law. This episode explains 42 CFR Part 2, which imposes stricter confidentiality standards than HIPAA.…
Domain II · Limits on Private-Sector Collection and Use
Financial data is heavily regulated in the U.S., and two major statutes govern its use: the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act (FACTA).…
Domain II · Limits on Private-Sector Collection and Use
The Gramm-Leach-Bliley Act (GLBA) governs privacy in the financial services sector. This episode introduces the GLBA Privacy Rule, which requires clear disclosures about data sharing and provides consumers the right to opt out of certain uses.…
Domain II · Limits on Private-Sector Collection and Use
The Red Flags Rule is designed to help organizations detect, prevent, and mitigate identity theft. This episode explains how financial institutions and certain creditors must develop programs that identify warning signs—or “red flags”—of potential fraud.…
Domain II · Limits on Private-Sector Collection and Use
The Dodd-Frank Wall Street Reform and Consumer Protection Act created the Consumer Financial Protection Bureau (CFPB), which plays a central role in financial privacy.…
Domain II · Limits on Private-Sector Collection and Use
Online banking raises unique privacy issues. This episode looks at how institutions use biometrics for authentication, the risks of third-party tracking in financial apps, and the growing security concerns in digital transactions.…
Domain II · Limits on Private-Sector Collection and Use
Mergers and acquisitions often involve transferring large volumes of personal data. This episode explains the privacy implications of corporate transactions, including how due diligence identifies risks and how contracts manage ongoing obligations.…
Domain II · Limits on Private-Sector Collection and Use
The Family Educational Rights and Privacy Act (FERPA) governs the privacy of student education records. This episode explains the rights it grants to parents and students, including access, correction, and consent for disclosure.…
Domain II · Limits on Private-Sector Collection and Use
As schools adopt digital platforms, new privacy and security risks emerge. This episode explores issues such as online learning platforms collecting student data, targeted advertising in education settings, and cybersecurity vulnerabilities.…
Domain II · Limits on Private-Sector Collection and Use
Telemarketing is tightly regulated under the Telemarketing Sales Rule (TSR) and the Telephone Consumer Protection Act (TCPA).…
Domain II · Limits on Private-Sector Collection and Use
Electronic communications are major areas of privacy regulation. This episode explores the CAN-SPAM Act, which sets standards for commercial email, including opt-out requirements, truth in subject lines, and identification of advertisements.…
Domain II · Limits on Private-Sector Collection and Use
Telecommunications and media involve a complex mix of statutes.…
Domain II · Limits on Private-Sector Collection and Use
Telemarketing restrictions extend beyond the TSR and TCPA through registries that give consumers control. This episode explains the National Do-Not-Call (DNC) Registry, how consumers enroll, and the obligations it imposes on telemarketers.…
Domain II · Limits on Private-Sector Collection and Use
Digital advertising relies heavily on tracking and profiling. This episode covers cookies, pixels, and device identifiers, along with how they enable targeted ads. We’ll examine the privacy implications of these practices, including transparency, consent, and opt-out mechanisms.…
Domain II · Limits on Private-Sector Collection and Use
Web scraping raises both ethical and legal challenges. This episode explains how scraping can collect vast amounts of personal information, often without consumer knowledge.…
Domain III · Government and Court Access to Private-Sector Information
Domain III introduces the critical issue of government access to private-sector information. This episode provides an overview of how laws regulate subpoenas, warrants, and requests from law enforcement or intelligence agencies.…
Domain III · Government and Court Access to Private-Sector Information
Government access to financial data is governed by specific laws.…
Domain III · Government and Court Access to Private-Sector Information
Access to communications is one of the most sensitive areas of privacy law.…
Domain III · Government and Court Access to Private-Sector Information
National security laws create unique privacy challenges. This episode introduces the Foreign Intelligence Surveillance Act (FISA) and its Amendments Act, particularly Section 702, which authorizes surveillance of foreign targets.…
Domain III · Government and Court Access to Private-Sector Information
Passed after September 11, the USA PATRIOT Act expanded government surveillance powers. This episode covers how the Act broadened authority for accessing communications, financial records, and other personal data in the name of counterterrorism.…
Domain III · Government and Court Access to Private-Sector Information
This episode covers the USA Freedom Act of 2015, which curtailed some of the sweeping surveillance authorities established under the USA PATRIOT Act.…
Domain III · Government and Court Access to Private-Sector Information
The Cybersecurity Information Sharing Act (CISA) encourages private companies to share cyber threat information with the government.…
Domain III · Government and Court Access to Private-Sector Information
Media and journalism face unique privacy issues when government seeks access to information. This episode covers the Privacy Protection Act of 1980, which restricts government searches and seizures of media materials.…
Domain III · Government and Court Access to Private-Sector Information
Civil litigation often requires the disclosure of large volumes of data, raising significant privacy concerns. This episode explains the role of electronic discovery (e-discovery), including how personal information is identified, reviewed, and produced during legal proceedings.…
Domain IV · Workplace Privacy
Domain IV addresses privacy issues throughout the employment lifecycle. This episode provides an overview of pre-employment screening, workplace monitoring, and post-employment records retention.…
Domain IV · Workplace Privacy
Workplace privacy is grounded in concepts of notice, reasonable expectation of privacy, and nondiscrimination.…
Domain IV · Workplace Privacy
Multiple federal agencies shape employment privacy.…
Domain IV · Workplace Privacy
Employers increasingly use AI-driven tools for hiring, but these technologies raise privacy and fairness concerns. This episode explains how automated decision-making tools are regulated, including requirements for transparency, bias audits, and applicant rights.…
Domain IV · Workplace Privacy
Employers often rely on background screening to evaluate candidates, but privacy laws set clear limits.…
Domain IV · Workplace Privacy
Employers increasingly monitor social media use, both during hiring and employment. This episode explores the privacy risks, including potential discrimination, reputational harm, and conflicts with labor rights.…
Domain IV · Workplace Privacy
Employers often monitor employees’ use of technology and communications systems, raising important privacy issues. This episode examines the scope of monitoring activities, including computer usage, email systems, telephone records, and workplace video surveillance.…
Domain IV · Workplace Privacy
Biometric data and location-based services present unique privacy challenges in the workplace. This episode reviews how employers use tools like fingerprint scanners, facial recognition, GPS tracking, and wearable devices to monitor attendance, productivity, and health.…
Domain IV · Workplace Privacy
Organizations must often conduct internal investigations into employee misconduct, which involves significant privacy considerations. This episode explores how investigations collect and handle personal information, including interviews, system logs, and third-party services.…
Domain IV · Workplace Privacy
The Electronic Communications Privacy Act (ECPA) plays a major role in regulating workplace privacy. This episode explains how the Act governs the interception and access of electronic communications, including email and phone calls, in the employment context.…
Domain IV · Workplace Privacy
Privacy obligations continue even after employment ends. This episode reviews how employers manage personnel records after termination, including requirements for retention and eventual disposal.…
Domain V · State Privacy Laws
Domain V introduces state privacy laws, which increasingly shape the U.S. privacy landscape.…
Domain V · State Privacy Laws
State enforcement has become increasingly influential in privacy regulation. This episode examines the role of state attorneys general, who bring actions under both state privacy laws and general consumer protection statutes.…
Domain V · State Privacy Laws
Comprehensive state privacy laws often hinge on applicability thresholds. This episode explores the criteria that determine whether a business must comply, such as number of state residents, annual revenue, or percentage of revenue from selling personal information.…
Domain V · State Privacy Laws
State laws grant individuals a suite of rights over their personal data. This episode explains the rights to access, correct, delete, and port data, as well as opt-out and consent requirements.…
Domain V · State Privacy Laws
Transparency is a cornerstone of state privacy laws. This episode covers the requirements for privacy notices, including disclosures about data collection, use, sharing, and consumer rights.…
Domain V · State Privacy Laws
Contracts are central to ensuring compliance with state privacy laws. This episode explains how data protection agreements define the obligations between controllers and processors, including rules for data use, security, subcontracting, and breach notification.…
Domain V · State Privacy Laws
Most state privacy laws include explicit security requirements. This episode reviews common obligations such as implementing reasonable safeguards, risk-based controls, encryption, and access restrictions.…
Domain V · State Privacy Laws
Beyond HIPAA, states have introduced new health data privacy statutes. This episode explores Washington’s My Health My Data Act (MHMD), Nevada’s Consumer Health Data Privacy Act, and Illinois’ Genetic Information Privacy Act (GIPA).…
Domain V · State Privacy Laws
State laws increasingly regulate cookies, pixels, and online tracking. This episode explains how transparency, consent, and opt-out obligations apply to digital advertising technologies.…
Domain V · State Privacy Laws
Biometric privacy laws impose strict requirements on collecting and using data such as fingerprints, facial recognition, and iris scans.…
Domain V · State Privacy Laws
Automated decision-making (ADM) and artificial intelligence raise fairness and discrimination concerns.…
Domain V · State Privacy Laws
California remains the leader in state privacy law. This episode reviews the California Consumer Privacy Act (CCPA) and its amendment through the California Privacy Rights Act (CPRA).…
Domain V · State Privacy Laws
Children’s privacy receives special attention in California’s Age-Appropriate Design Code Act (AADC). This episode explains its requirements for online services likely to be accessed by minors, including risk assessments, high privacy default settings, and restrictions on profiling.…
Domain V · State Privacy Laws
The California Delete Act introduces obligations for data brokers, requiring them to register and enabling consumers to request deletion of their data from all registered brokers at once.…
Domain V · State Privacy Laws
Virginia’s Consumer Data Protection Act (CDPA) established one of the first comprehensive state privacy frameworks outside California. This episode reviews its applicability thresholds, consumer rights, and obligations for controllers and processors.…
Domain V · State Privacy Laws
Colorado’s Privacy Act builds on the momentum from California and Virginia, offering a comprehensive framework with unique twists. This episode reviews its applicability standards, consumer rights, and controller/processor obligations, including data protection assessments.…
Domain V · State Privacy Laws
Beyond California, Virginia, and Colorado, many states are adopting or considering comprehensive privacy laws. This episode surveys these developments, highlighting features of statutes in states like Connecticut, Utah, and others.…
Domain V · State Privacy Laws
Enforcement provisions determine how state privacy laws are applied in practice. This episode explains cure periods, which give businesses time to fix violations before penalties are imposed, and how these provisions differ across states.…
Domain V · State Privacy Laws
State breach notification laws form one of the most uniform yet varied areas of privacy law. This episode reviews the common elements—definitions of personal information, what constitutes a breach, and when notification is required.…
Domain V · State Privacy Laws
Even within the common framework of breach notification, state differences matter. This episode compares notification timelines, which can range from “without unreasonable delay” to fixed deadlines like 30 or 45 days.…
Domain V · State Privacy Laws
State privacy laws continue to evolve. This episode reviews recent changes, such as Pennsylvania SB 696, which updated breach notification requirements, and Utah S.B. 127, which amended cybersecurity provisions.…
Domain V · State Privacy Laws
The final episode ties everything together by comparing U.S. federal privacy laws, state-level frameworks, and international regimes like the GDPR.…
Try another term or clear one of the filters.
A Practical Study Routine
Use the free audio course during a commute, walk, workout, or focused study session.
Use the study guide to organize the material, annotate key ideas, and build a reference you can return to.
Use the flashcards book to practice active recall and quickly revisit weak areas.
Related Magazine Features
Related Cyber Wiki
AI bias and fairness assessment evaluates how data, labels, objectives, design choices, and deployment conditions can create uneven errors or harms across groups.
AI privacy governanceAI data-rights and deletion processes handle access, correction, objection, restriction, portability, and erasure across datasets, models, embeddings, caches, logs, and derived outputs.
AI governanceAI governance roles assign decision rights and obligations across executives, business owners, developers, data stewards, security, privacy, legal, risk, and users.
AI transparencyAI transparency notices tell people when AI is used, what it does, what information it relies on, important limitations, and how to seek review or correction.
Security principleAccountability makes people, roles, services, and organizations answerable for security decisions and actions by assigning ownership and preserving reliable evidence.
Privacy engineeringAnonymization and de-identification reduce the ability to associate released or shared data with a specific person, while accounting for linkage and re-identification risk.
