CIPP-US - Introduction to the U.S. Privacy Environment - Section 1.1

Identify the sources of US law - constitutional, statutory, regulatory, and common law - and explain how each shapes privacy obligations.

Distinguish constitutional, statutory, regulatory, and common law as the four sources of US privacy obligations, and identify how each layer - from Fourth Amendment doctrine to agency rulemaking - can impose independent duties. Recognise that federal preemption can displace state law and that common law torts such as intrusion upon seclusion provide remedies outside statute.

Constitutional lawFederal preemptionRegulatory authorityCommon law torts

Practice question for this objective

Free sampleIntroduction to the U.S. Privacy Environmentmedium

The US common law of privacy is commonly organised into four distinct privacy torts. Which statement accurately describes how these torts function as a source of privacy obligation?

  • AThey are judge-made causes of action recognised and refined state by state, allowing individuals to sue even where no privacy statute applies. Correct
  • BThey are codified uniformly in a single federal statute that every state must apply without variation.
  • CThey are enforced exclusively by the Federal Trade Commission as a federal regulatory programme rather than by private plaintiffs.
  • DThey are constitutional guarantees derived from the right to privacy implied in the Bill of Rights and enforceable against any defendant.
Recognise the four privacy torts as judge-made common law causes of action available where no privacy statute applies. The four privacy torts were articulated in judicial decisions and adopted state by state, so they operate as common law remedies that let individuals sue even in the absence of a governing statute.

Why A is correct: Correct: the privacy torts developed through judicial decisions and were adopted across states, giving individuals a remedy in court that exists independently of any statute.

Why B is wrong: Tempting because the four torts are well settled, but they arose from court decisions and influential commentary, not a uniform federal statute, so codification misstates their source.

Why C is wrong: Tempting because the FTC enforces privacy norms, but the privacy torts are private causes of action that individuals bring, not a regulatory programme the FTC administers.

Why D is wrong: Tempting because constitutional privacy exists, but the four torts are common law remedies between private parties, distinct from any constitutional right, so calling them constitutional misclassifies them.

See more CIPP-US practice questions, answers explained.

More in this domain

Back to all Introduction to the U.S. Privacy Environment objectives, or the CIPP-US cert hub.

Examworthy is not affiliated with or endorsed by IAPP. Original, blueprint-aligned practice material only.