Certified – CIPP/US Audio Course
- Episodes
- 98
- Format
- Series – listen from the start
- Latest episode
- Oct 14, 2025
About the podcast
The CIPP/US Audio Course is your complete, audio-first companion for mastering the Certified Information Privacy Professional – United States (CIPP/US) certification. Designed for learners who want structured, on-the-go preparation, this Audio Course transforms the IAPP Body of Knowledge into clear, engaging, and easy-to-follow episodes. Each lesson unpacks the foundations of U.S. privacy law—from federal and state frameworks to workplace regulations and cross-border data principles—helping you connect legal theory to real-world application. Whether you’re commuting, exercising, or reviewing between work sessions, this series gives you the structure and clarity to absorb complex legal concepts with confidence and focus. The CIPP/US certification from the International Association of Privacy Professionals (IAPP) is the gold standard for demonstrating expertise in U.S. privacy law and regulatory compliance. It covers the full spectrum of privacy governance, including laws like HIPAA, GLBA, FCRA, FERPA, and COPPA, as well as enforcement actions, key regulatory agencies, and sector-specific obligations. The certification also explores emerging state laws such as the CCPA and CPRA, illustrating how they align—or conflict—with federal frameworks. Earning the CIPP/US shows that you can navigate the evolving landscape of privacy rights, business obligations, and data protection standards that shape how organizations manage personal information. Developed by BareMetalCyber.com, the CIPP/US Audio Course provides guided walkthroughs, glossary deep dives, study strategies, and exam insights designed for lasting mastery. Each episode builds your understanding step by step, helping you think like a privacy professional, retain critical details, and approach exam day with confidence and precision.
Episodes 98
Episode 97 — Cross-Domain Comparison: Federal, State, and International Overlaps
The final episode ties everything together by comparing U.S. federal privacy laws, state-level frameworks, and international regimes like the GDPR. We’ll highlight how similar principles—such as data subject …
Show notes
The final episode ties everything together by comparing U.S. federal privacy laws, state-level frameworks, and international regimes like the GDPR. We’ll highlight how similar principles—such as data subject rights, accountability, and security safeguards—take different forms across jurisdictions. We’ll also explore where overlaps create synergies and where conflicts require careful navigation, such as multinational data transfers or AI governance.
By mastering these comparisons, you’ll see the full picture of privacy regulation and be prepared for the integrative questions on the exam. This episode closes the series with a comprehensive perspective, reinforcing that privacy law is both global and evolving. Produced by BareMetalCyber.com
Episode 96 — Recent Changes: Pennsylvania SB 696 and Utah S.B. 127
State privacy laws continue to evolve. This episode reviews recent changes, such as Pennsylvania SB 696, which updated breach notification requirements, and Utah S.B. 127, which amended cybersecurity …
Show notes
State privacy laws continue to evolve. This episode reviews recent changes, such as Pennsylvania SB 696, which updated breach notification requirements, and Utah S.B. 127, which amended cybersecurity provisions. These examples show how states adapt their frameworks to address new threats and policy priorities.
For exam purposes, understanding recent changes demonstrates that privacy law is a moving target. You may be tested on specific updates or asked to analyze how new provisions fit within existing frameworks. Produced by BareMetalCyber.com
Episode 95 — State Variations: Comparing Notification Timelines and Duties
Even within the common framework of breach notification, state differences matter. This episode compares notification timelines, which can range from “without unreasonable delay” to fixed deadlines like 30 or …
Show notes
Even within the common framework of breach notification, state differences matter. This episode compares notification timelines, which can range from “without unreasonable delay” to fixed deadlines like 30 or 45 days. We’ll also examine variations in whom to notify, from affected consumers to regulators and credit reporting agencies.
Understanding these nuances is critical for compliance and for analyzing exam questions that present breach scenarios across multiple states. By mastering state variations, you’ll be able to quickly identify which obligations apply in a given fact pattern. Produced by BareMetalCyber.com
Episode 94 — Breach Notification: Definitions, Triggers, and Scope
State breach notification laws form one of the most uniform yet varied areas of privacy law. This episode reviews the common elements—definitions of personal information, what constitutes a breach, and when …
Show notes
State breach notification laws form one of the most uniform yet varied areas of privacy law. This episode reviews the common elements—definitions of personal information, what constitutes a breach, and when notification is required. We’ll also explore differences across states, such as timelines, thresholds, and required content of notices.
We’ll also highlight consumer remedies like credit monitoring and the role of state enforcement. For the exam, expect scenarios where you must determine whether a breach triggers notification obligations under state law. Produced by BareMetalCyber.com
Episode 93 — Enforcement Mechanics: Cure Periods and Penalties
Enforcement provisions determine how state privacy laws are applied in practice. This episode explains cure periods, which give businesses time to fix violations before penalties are imposed, and how these …
Show notes
Enforcement provisions determine how state privacy laws are applied in practice. This episode explains cure periods, which give businesses time to fix violations before penalties are imposed, and how these provisions differ across states. We’ll also examine penalties, remedies, and enforcement authority, often vested in state attorneys general or privacy agencies.
We’ll highlight how enforcement design affects compliance strategies and shapes the balance between business flexibility and consumer protection. Exam scenarios may ask you to identify enforcement mechanics in a given state law, making this an important area to master. Produced by BareMetalCyber.com
Episode 92 — Other State Acts: Emerging Comprehensive Privacy Laws
Beyond California, Virginia, and Colorado, many states are adopting or considering comprehensive privacy laws. This episode surveys these developments, highlighting features of statutes in states like …
Show notes
Beyond California, Virginia, and Colorado, many states are adopting or considering comprehensive privacy laws. This episode surveys these developments, highlighting features of statutes in states like Connecticut, Utah, and others. We’ll discuss how they generally follow the same model of applicability thresholds, consumer rights, and controller/processor duties, while introducing state-specific variations.
We’ll also explain why tracking emerging laws is essential for compliance professionals, as the patchwork nature of state regulation continues to grow. For the exam, you may see references to newer laws or comparisons across jurisdictions, testing your ability to recognize shared principles and unique elements. Produced by BareMetalCyber.com
Episode 91 — Colorado Privacy Act: Rights, Duties, and Insurance Bias Provisions
Colorado’s Privacy Act builds on the momentum from California and Virginia, offering a comprehensive framework with unique twists. This episode reviews its applicability standards, consumer rights, and …
Show notes
Colorado’s Privacy Act builds on the momentum from California and Virginia, offering a comprehensive framework with unique twists. This episode reviews its applicability standards, consumer rights, and controller/processor obligations, including data protection assessments. We’ll also cover Colorado’s focus on fairness in insurance, with rules addressing discriminatory practices tied to algorithmic decision-making.
By comparing Colorado’s law with CCPA/CPRA and CDPA, you’ll understand both commonalities and distinctions across state statutes. For the exam, focus on consumer rights, opt-out mechanisms, and Colorado’s insurance-specific provisions, which highlight emerging regulatory themes. Produced by BareMetalCyber.com
Episode 90 — Virginia CDPA: Consumer Data Protection Act Essentials
Virginia’s Consumer Data Protection Act (CDPA) established one of the first comprehensive state privacy frameworks outside California. This episode reviews its applicability thresholds, consumer rights, and …
Show notes
Virginia’s Consumer Data Protection Act (CDPA) established one of the first comprehensive state privacy frameworks outside California. This episode reviews its applicability thresholds, consumer rights, and obligations for controllers and processors. We’ll also discuss how the CDPA balances business flexibility with consumer protections.
We’ll highlight how the CDPA differs from California’s laws, including its opt-in requirements for sensitive data and lack of a private right of action. For the exam, understanding these distinctions is critical for analyzing state privacy law questions. Produced by BareMetalCyber.com
Episode 89 — California Delete Act: Data Broker Registration and Rights
The California Delete Act introduces obligations for data brokers, requiring them to register and enabling consumers to request deletion of their data from all registered brokers at once. This episode explores …
Show notes
The California Delete Act introduces obligations for data brokers, requiring them to register and enabling consumers to request deletion of their data from all registered brokers at once. This episode explores the mechanics of the Act, its impact on the data broker industry, and how it expands consumer control.
We’ll also review enforcement provisions and potential national ripple effects. Exam questions may test your knowledge of how the Delete Act operates alongside the CCPA/CPRA. Produced by BareMetalCyber.com
Episode 88 — California AADC: Age-Appropriate Design Code Protections
Children’s privacy receives special attention in California’s Age-Appropriate Design Code Act (AADC). This episode explains its requirements for online services likely to be accessed by minors, including risk …
Show notes
Children’s privacy receives special attention in California’s Age-Appropriate Design Code Act (AADC). This episode explains its requirements for online services likely to be accessed by minors, including risk assessments, high privacy default settings, and restrictions on profiling. The law reflects growing concern about children’s digital wellbeing.
We’ll also discuss how the AADC interacts with COPPA and federal initiatives. Exam scenarios may involve applying AADC principles to online platforms, making this an increasingly important topic. Produced by BareMetalCyber.com
Episode 87 — California CCPA/CPRA: Comprehensive Consumer Privacy Framework
California remains the leader in state privacy law. This episode reviews the California Consumer Privacy Act (CCPA) and its amendment through the California Privacy Rights Act (CPRA). We’ll explore …
Show notes
California remains the leader in state privacy law. This episode reviews the California Consumer Privacy Act (CCPA) and its amendment through the California Privacy Rights Act (CPRA). We’ll explore applicability thresholds, data subject rights, notice obligations, and enforcement by the California Privacy Protection Agency.
We’ll also highlight how the CCPA/CPRA compares to other state laws, often serving as the template for new frameworks. Exam questions frequently reference California’s statutes, so deep familiarity with their provisions is essential. Produced by BareMetalCyber.com
Episode 86 — AI Bias and ADM: NAIC AIS Guidelines, NYC AEDT, and State Rules
Automated decision-making (ADM) and artificial intelligence raise fairness and discrimination concerns. This episode introduces the NAIC Artificial Intelligence Governance Guidelines, New York City’s Automated …
Show notes
Automated decision-making (ADM) and artificial intelligence raise fairness and discrimination concerns. This episode introduces the NAIC Artificial Intelligence Governance Guidelines, New York City’s Automated Employment Decision Tools (AEDT) law, and state-level rules in California and Colorado. We’ll examine requirements for transparency, testing, and bias audits.
We’ll also discuss how ADM intersects with both privacy and anti-discrimination frameworks. For the exam, expect questions that test your ability to identify compliance requirements for AI-driven decision-making tools across jurisdictions. Produced by BareMetalCyber.com
Episode 85 — Biometric Privacy: IL BIPA, WA, TX, and Related Statutes
Biometric privacy laws impose strict requirements on collecting and using data such as fingerprints, facial recognition, and iris scans. This episode covers the Illinois Biometric Information Privacy Act …
Show notes
Biometric privacy laws impose strict requirements on collecting and using data such as fingerprints, facial recognition, and iris scans. This episode covers the Illinois Biometric Information Privacy Act (BIPA), which requires consent, disclosure, and safeguards, as well as similar statutes in Washington and Texas. We’ll also review the growing number of lawsuits and settlements under BIPA, which highlight the risks of noncompliance.
These laws illustrate how biometric data is treated as highly sensitive and often subject to private rights of action. For the exam, focus on the core elements of biometric statutes and their enforcement impact. Produced by BareMetalCyber.com
Episode 84 — Cookies and Tracking: Online Privacy Regulations
State laws increasingly regulate cookies, pixels, and online tracking. This episode explains how transparency, consent, and opt-out obligations apply to digital advertising technologies. We’ll discuss …
Show notes
State laws increasingly regulate cookies, pixels, and online tracking. This episode explains how transparency, consent, and opt-out obligations apply to digital advertising technologies. We’ll discuss requirements for cookie banners, preference signals, and global opt-out mechanisms.
We’ll also highlight enforcement actions where regulators targeted companies for noncompliance with cookie disclosure and choice obligations. For the exam, expect scenarios involving online tracking, where you must identify compliance requirements under different state frameworks. Produced by BareMetalCyber.com
Episode 83 — Health Data Rules: WA MHMD, NV Health Data Act, and IL GIPA
Beyond HIPAA, states have introduced new health data privacy statutes. This episode explores Washington’s My Health My Data Act (MHMD), Nevada’s Consumer Health Data Privacy Act, and Illinois’ Genetic …
Show notes
Beyond HIPAA, states have introduced new health data privacy statutes. This episode explores Washington’s My Health My Data Act (MHMD), Nevada’s Consumer Health Data Privacy Act, and Illinois’ Genetic Information Privacy Act (GIPA). We’ll review how these laws define consumer health data, impose consent requirements, and establish rights for deletion and access.
We’ll also discuss enforcement patterns, including class actions under GIPA, and how these statutes expand privacy obligations beyond traditional healthcare providers. Exam questions may require distinguishing between HIPAA-covered entities and businesses subject to these new state health data rules. Produced by BareMetalCyber.com
Episode 82 — State Security Requirements: Common Controls Across Jurisdictions
Most state privacy laws include explicit security requirements. This episode reviews common obligations such as implementing reasonable safeguards, risk-based controls, encryption, and access restrictions …
Show notes
Most state privacy laws include explicit security requirements. This episode reviews common obligations such as implementing reasonable safeguards, risk-based controls, encryption, and access restrictions. While states vary in language, the underlying expectation is that businesses adopt practices proportional to the sensitivity of data.
We’ll also cover how state security requirements overlap with federal standards like the FTC’s unfairness authority and the GLBA Safeguards Rule. For the exam, pay attention to how “reasonable security” is defined and applied, as questions often test your ability to analyze what qualifies under different frameworks. Produced by BareMetalCyber.com
Episode 81 — Data Protection Agreements: Contracts and Assessments
Contracts are central to ensuring compliance with state privacy laws. This episode explains how data protection agreements define the obligations between controllers and processors, including rules for data …
Show notes
Contracts are central to ensuring compliance with state privacy laws. This episode explains how data protection agreements define the obligations between controllers and processors, including rules for data use, security, subcontracting, and breach notification. We’ll also review assessment requirements, where organizations must conduct and document evaluations of high-risk data processing activities such as targeted advertising or sensitive data handling.
We highlight how these agreements and assessments demonstrate accountability and provide evidence of due diligence to regulators. Exam questions often present scenarios where vendor contracts or assessments are incomplete, requiring you to identify compliance gaps. Produced by BareMetalCyber.com
Episode 80 — Privacy Notices: Transparency and Consumer Disclosures
Transparency is a cornerstone of state privacy laws. This episode covers the requirements for privacy notices, including disclosures about data collection, use, sharing, and consumer rights. We’ll examine …
Show notes
Transparency is a cornerstone of state privacy laws. This episode covers the requirements for privacy notices, including disclosures about data collection, use, sharing, and consumer rights. We’ll examine layered notices, just-in-time disclosures, and special statements for sensitive data or financial incentives.
We’ll also highlight enforcement trends, where regulators penalize vague or misleading notices. Exam questions frequently test your understanding of notice requirements, so mastering this topic is key to demonstrating competency. Produced by BareMetalCyber.com
Episode 79 — Data Subject Rights: Access, Deletion, Portability, and Consent
State laws grant individuals a suite of rights over their personal data. This episode explains the rights to access, correct, delete, and port data, as well as opt-out and consent requirements. We’ll highlight …
Show notes
State laws grant individuals a suite of rights over their personal data. This episode explains the rights to access, correct, delete, and port data, as well as opt-out and consent requirements. We’ll highlight how these rights compare across major state frameworks like California’s CCPA/CPRA, Virginia’s CDPA, and Colorado’s Privacy Act.
We’ll also cover how organizations must respond to rights requests, including timelines, authentication requirements, and appeal mechanisms. For the exam, be ready to recognize which rights apply under which laws and how they align with international standards. Produced by BareMetalCyber.com
Episode 78 — Applicability Tests: Resident Thresholds, Revenue, and Exemptions
Comprehensive state privacy laws often hinge on applicability thresholds. This episode explores the criteria that determine whether a business must comply, such as number of state residents, annual revenue, or …
Show notes
Comprehensive state privacy laws often hinge on applicability thresholds. This episode explores the criteria that determine whether a business must comply, such as number of state residents, annual revenue, or percentage of revenue from selling personal information. We’ll also cover common exemptions, including nonprofit entities, small businesses, and data already regulated under federal statutes.
Understanding these thresholds is vital, as they define the scope of compliance obligations. Exam questions may present hypothetical businesses and ask you to determine whether state privacy laws apply—making this topic especially important. Produced by BareMetalCyber.com
Episode 77 — State Authority: Attorneys General and CPPA Oversight
State enforcement has become increasingly influential in privacy regulation. This episode examines the role of state attorneys general, who bring actions under both state privacy laws and general consumer …
Show notes
State enforcement has become increasingly influential in privacy regulation. This episode examines the role of state attorneys general, who bring actions under both state privacy laws and general consumer protection statutes. We’ll also focus on the California Privacy Protection Agency, which has broad authority under the CCPA and CPRA to issue regulations and enforce compliance.
We’ll highlight how these authorities shape enforcement priorities and often act as models for other states. For the exam, pay close attention to how state-level oversight differs from federal enforcement, as this is a common theme in scenario questions. Produced by BareMetalCyber.com
Episode 76 — Domain V Overview: Role of States in the U.S. Privacy Framework
Domain V introduces state privacy laws, which increasingly shape the U.S. privacy landscape. This episode provides an overview of how state authority interacts with federal law, highlighting the roles of state …
Show notes
Domain V introduces state privacy laws, which increasingly shape the U.S. privacy landscape. This episode provides an overview of how state authority interacts with federal law, highlighting the roles of state attorneys general, legislatures, and agencies like the California Privacy Protection Agency. We’ll also discuss how states serve as “laboratories of democracy,” pioneering comprehensive privacy frameworks where federal law remains sectoral.
By mastering Domain V, you’ll gain the tools to analyze key state statutes, exemptions, and enforcement provisions. This foundation prepares you for the detailed state-level topics that follow in subsequent episodes. Produced by BareMetalCyber.com
Episode 75 — Post-Employment: Records, References, and Retention Duties
Privacy obligations continue even after employment ends. This episode reviews how employers manage personnel records after termination, including requirements for retention and eventual disposal. We’ll also …
Show notes
Privacy obligations continue even after employment ends. This episode reviews how employers manage personnel records after termination, including requirements for retention and eventual disposal. We’ll also cover privacy issues in providing references, balancing truthfulness with obligations to protect sensitive information.
We’ll discuss how state and federal rules shape post-employment practices, and how retention duties must be coordinated with legal holds or compliance requirements. Exam questions may test your ability to apply privacy principles beyond the active employment relationship. Produced by BareMetalCyber.com
Episode 74 — ECPA at Work: Employer Obligations and Exceptions
The Electronic Communications Privacy Act (ECPA) plays a major role in regulating workplace privacy. This episode explains how the Act governs the interception and access of electronic communications, including …
Show notes
The Electronic Communications Privacy Act (ECPA) plays a major role in regulating workplace privacy. This episode explains how the Act governs the interception and access of electronic communications, including email and phone calls, in the employment context. We’ll cover key exceptions that permit monitoring, such as the consent of at least one party or business-use exceptions.
We’ll also examine how courts interpret ECPA in workplace disputes, shaping what employers may lawfully monitor. Understanding ECPA at work is critical for analyzing exam questions that deal with employee communications and privacy expectations. Produced by BareMetalCyber.com
Episode 73 — Internal Investigations: Misconduct, Documentation, and Handling
Organizations must often conduct internal investigations into employee misconduct, which involves significant privacy considerations. This episode explores how investigations collect and handle personal …
Show notes
Organizations must often conduct internal investigations into employee misconduct, which involves significant privacy considerations. This episode explores how investigations collect and handle personal information, including interviews, system logs, and third-party services. We’ll discuss the importance of documenting evidence while respecting the rights of the individuals involved.
We’ll also highlight how confidentiality and fairness shape investigative practices, and how regulators may review the process in cases of disputes or enforcement actions. Exam scenarios often test your ability to balance investigative needs with privacy obligations, making this an essential area to master. Produced by BareMetalCyber.com
Episode 72 — Biometrics and Location: LBS, Wearables, and Wellness Programs
Biometric data and location-based services present unique privacy challenges in the workplace. This episode reviews how employers use tools like fingerprint scanners, facial recognition, GPS tracking, and …
Show notes
Biometric data and location-based services present unique privacy challenges in the workplace. This episode reviews how employers use tools like fingerprint scanners, facial recognition, GPS tracking, and wearable devices to monitor attendance, productivity, and health. We’ll cover the privacy risks, consent requirements, and the patchwork of state laws, such as Illinois’ Biometric Information Privacy Act (BIPA), that impose specific obligations.
We’ll also look at wellness programs and the sensitive data they generate, including health metrics and activity tracking. For exam purposes, focus on where biometric and location data receive heightened protections, and how these rules affect employer practices. Produced by BareMetalCyber.com
Episode 71 — Employee Monitoring: Computers, Email, Phone, and Video
Employers often monitor employees’ use of technology and communications systems, raising important privacy issues. This episode examines the scope of monitoring activities, including computer usage, email …
Show notes
Employers often monitor employees’ use of technology and communications systems, raising important privacy issues. This episode examines the scope of monitoring activities, including computer usage, email systems, telephone records, and workplace video surveillance. We’ll explain how notice and consent play central roles in shaping the legality of these practices, as well as the expectations courts use when balancing employer interests with employee rights. These monitoring tools highlight the trade-offs between productivity, security, and individual privacy.
We also discuss how agencies and statutes regulate monitoring, including the Electronic Communications Privacy Act and labor laws that protect certain employee activities. Employers must ensure their policies are clear, narrowly tailored, and compliant with applicable laws. Exam questions may test your ability to distinguish permissible monitoring from overreach, making this a key area of preparation. Produced by BareMetalCyber.com
Episode 70 — Social Media Monitoring: Policies and Union Considerations
Employers increasingly monitor social media use, both during hiring and employment. This episode explores the privacy risks, including potential discrimination, reputational harm, and conflicts with labor …
Show notes
Employers increasingly monitor social media use, both during hiring and employment. This episode explores the privacy risks, including potential discrimination, reputational harm, and conflicts with labor rights. We’ll examine how the National Labor Relations Board protects “concerted activity” on social platforms, limiting how employers can respond to employee posts.
We’ll also cover best practices, such as clear policies and limited use of social media in employment decisions. Exam questions may test your ability to analyze employer practices in light of both privacy and labor law. Produced by BareMetalCyber.com
Episode 69 — Background Screening: Psychological Tests, Polygraphs, and Drug Testing
Employers often rely on background screening to evaluate candidates, but privacy laws set clear limits. This episode examines psychological and integrity tests, restrictions on polygraph testing under the …
Show notes
Employers often rely on background screening to evaluate candidates, but privacy laws set clear limits. This episode examines psychological and integrity tests, restrictions on polygraph testing under the Employee Polygraph Protection Act, and the privacy considerations in drug and alcohol testing. We’ll also discuss how the Fair Credit Reporting Act applies to third-party background checks.
These screening tools highlight the balance between employer needs and applicant rights. For exam purposes, focus on legal boundaries, notice requirements, and candidate consent obligations. Produced by BareMetalCyber.com
These are the latest 60 of 98 episodes. You’ll find older episodes in the podcast’s feed.
Recommended by Certified – CIPP/US Audio Course
Similar podcasts
More Education podcasts
Is this your podcast?
Confirm it with an entry in your feed: you get a code here, add it as podcast:txt to the channel of your feed, and we check it. Your podcast is then shown as “verified” on SoundNode.