You can sue a company for giving out your personal information, but whether the case will go anywhere depends on three things: what law the company broke, what kind of information was exposed, and whether you can show you were actually harmed. A few state statutes let consumers collect set damages without proving a financial loss. Everywhere else, you have to point to real, measurable injury before a court will hear you out. That last requirement is what stops most claims.
When You Actually Have a Case
A lawsuit over shared or exposed personal information usually rests on one of four legal theories, and which one fits determines what you have to prove.
Negligence is the most common route. The argument is that the company had a duty to protect your data, its security practices were unreasonable given the sensitivity of what it held, and that failure led to your information getting out. Courts generally recognize this duty when a business collects things like financial account numbers, health records, or Social Security numbers.
Breach of contract works when the company’s privacy policy or terms of service made a specific promise and the company broke it. A privacy policy functions like a contract. If it said your data would be encrypted or never shared with third parties, and the company did the opposite, that broken promise is actionable. Vague marketing language like “we take your privacy seriously” is not enough. The promise has to be concrete.
Statutory violations are the strongest theory when they fit, because certain state laws let you recover damages without proving a specific financial loss. The catch is that these laws are narrow, and only a few states have them.
Unjust enrichment is a less common theory, essentially arguing that you paid a premium partly for the company’s data-handling promises and the company pocketed that premium instead of investing in security. Federal courts have split on whether it works in data cases.
State Laws That Let You Sue Directly
The clearest right to sue comes from state statutes with what lawyers call a “private right of action,” meaning the law itself authorizes individuals to file suit rather than leaving enforcement to regulators.
California’s Consumer Privacy Act is the most prominent. It lets consumers sue when their unencrypted personal information is stolen in a breach caused by the company’s failure to maintain reasonable security.1State of California Department of Justice. California Consumer Privacy Act (CCPA) The right is narrow: it covers breaches from inadequate security, not every kind of privacy violation. Statutory damages run from $107 to $799 per person per incident, or your actual damages if higher, without needing to prove specific financial loss.2California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties
Illinois’s Biometric Information Privacy Act covers fingerprints, facial scans, and iris patterns. If a company collects or shares your biometric data without proper consent, you can sue for $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus attorney fees.3Illinois General Assembly. 740 ILCS 14/20 This statute drives an enormous amount of class action activity against employers and tech companies using facial recognition or fingerprint scanners.
Most of the other state privacy laws passed in recent years do not include a private right of action. They give enforcement power exclusively to the state attorney general. Before assuming your state’s privacy statute lets you file, confirm that it actually authorizes private lawsuits.
Federal Privacy Laws Usually Don’t Let You Sue
This surprises many people: the major federal privacy laws do not give individuals a right to file lawsuits. HIPAA is enforced by the Department of Health and Human Services. The Children’s Online Privacy Protection Act is enforced by the FTC. The Gramm-Leach-Bliley Act, which covers financial institutions, is enforced by the FTC and federal banking regulators.4Federal Trade Commission. How to Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act None of them lets you sue the company yourself.
A federal violation still matters, though. If you can show the company broke HIPAA or another federal privacy rule, that helps prove it failed to exercise reasonable care under state negligence law. You are suing under state law and using the federal violation as evidence.
The Concrete Harm Problem
This is where most data privacy lawsuits fail. To sue in federal court, you have to show what courts call “standing,” which means a concrete, actual injury. The Supreme Court tightened this significantly in its 2021 decision in TransUnion LLC v. Ramirez, holding that “the mere risk of future harm, without more, cannot qualify as a concrete harm in a suit for damages.”5Justia US Supreme Court. TransUnion LLC v Ramirez – 594 US (2021)
What that means in practice: having your Social Security number leaked in a breach is often not enough on its own. If nobody has misused it yet, many federal courts will say you have not been harmed. Anxiety about future identity theft does not clear the bar.
Courts have recognized several kinds of harm that do:
- Unauthorized charges on your accounts, even if the bank later reimbursed you.
- Money spent on credit monitoring or time spent resolving fraud, particularly when tied to actual suspicious activity.
- Identity theft, meaning someone used your information to open accounts, file tax returns, or take other real-world actions.
Some courts have also accepted significant time spent monitoring accounts and cleaning up after a breach, even without outright identity theft. Federal courts are inconsistent, which is why the court you file in matters. State courts sometimes apply more lenient standing rules, making them a better option when your injury is mainly the risk of future misuse.
Statutory claims sidestep much of this problem. Under California’s law and Illinois’s biometric statute, the violation itself is the harm the legislature defined, so you generally do not need to prove separate financial loss.
What You Can Recover
The money on the table depends on which theory you pursue.
Actual damages require proof of specific financial harm: unreimbursed fraudulent charges, credit monitoring fees, credit freeze costs, lost wages from time spent on the breach, and any other out-of-pocket expense you can tie to the exposure. Time you spent resolving breach-related issues can itself count.
Statutory damages, where available, are set by law and do not require proof of a specific loss. California’s range is $107 to $799 per consumer per incident.2California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties Illinois’s runs from $1,000 to $5,000 per violation, depending on whether the company acted negligently or intentionally.3Illinois General Assembly. 740 ILCS 14/20
Injunctive relief is a court order making the company change its practices. It does not put money in your pocket, but it often appears in settlements alongside compensation.
Class Action or Individual Lawsuit
Most data breach litigation happens through class actions, and the tradeoff is worth understanding before you decide.
A class action bundles the claims of thousands or millions of affected people into one case. You do not fund the litigation yourself, and the attorneys handle the complexity. The catch is that individual payouts tend to be modest: some credit monitoring, a small cash payment, or reimbursement for documented losses. Class counsel typically take 33% to 40% of the total settlement.
An individual lawsuit makes sense when your harm is significant and well documented. If your identity was actually stolen, you lost real money, or you spent weeks dealing with fraudulent accounts, an individual claim can recover far more than your share of a class settlement. You also bear the litigation risk and have to clear standing and proof on your own.
If a class action has already been filed over the same breach, you will usually get a notice with three options: join the class, opt out and sue on your own, or do nothing. Opting out preserves your right to sue individually but forfeits any class recovery. For people with minimal documented losses, staying in the class is usually the practical choice.
Evidence to Gather Now
Strong documentation separates a viable claim from one that gets dismissed. Start collecting as soon as you learn your information was exposed.
Save the version of the company’s privacy policy and terms of service that were in effect when the exposure happened, not the current version. Companies revise these regularly, and the promises that matter are the ones in place at the time. If the current site has changed, look up the older version on the Wayback Machine at web.archive.org.
Keep every breach notification letter and email. Every state requires companies to notify affected individuals after a breach.6National Conference of State Legislatures. Summary Security Breach Notification Laws These notices usually acknowledge what happened, what data was involved, and what the company is offering. They function as admissions.
Pull together financial records showing harm: bank and credit card statements with unauthorized charges, receipts for credit monitoring, records of any fees tied to the breach. Note when and with which credit bureaus you placed a freeze or fraud alert.
Keep a running log of the time you spend dealing with the breach. Dates, what you did (called the bank, disputed a charge, filed a police report), and how long each task took. Courts have treated this time as compensable harm.
If your information was used for identity theft, file an FTC report at IdentityTheft.gov.7Federal Trade Commission. Report Identity Theft The report creates an official record and can be used to obtain transaction records from businesses where the thief used your information.8Federal Trade Commission. Businesses Must Provide Victims and Law Enforcement with Transaction Records Relating to Identity Theft
If You Can’t Sue, File Regulatory Complaints
When the standing hurdle blocks a lawsuit or your documented harm is too thin to justify one, regulatory complaints are a meaningful alternative. They will not put money in your pocket directly, but they trigger investigations that can lead to enforcement actions and settlements benefitting affected consumers.
The FTC accepts complaints about data breaches and deceptive privacy practices at ReportFraud.ftc.gov. The FTC does not resolve individual complaints, but it uses them to spot patterns and prioritize enforcement.9Federal Trade Commission. Equifax Data Breach Settlement
Your state attorney general’s office is often more responsive. Most have consumer protection divisions that accept privacy complaints and can investigate companies operating in the state. In states where the privacy law reserves enforcement to the attorney general, your complaint may be the only way to prompt an investigation.
Filing with both the FTC and your state AG costs nothing and takes little time. Even if you plan to sue, these filings create an official record that your information was compromised and that you acted on it.
Deadlines and What a Lawyer Costs
Every lawsuit has a deadline, and the statute of limitations for data privacy claims varies by state and by theory. Negligence and breach of contract claims usually fall under general personal injury or contract limitations, which run from two to six years in most states. Statutory claims may carry their own deadlines. The clock generally starts when you discover, or reasonably should have discovered, the breach. Waiting too long is one of the most common reasons viable claims never get filed.
On cost, most data breach attorneys work on contingency, meaning they take a percentage of any recovery instead of billing hourly. The standard rate runs from roughly one-third to 40% of the settlement or judgment. If you lose, you usually owe nothing in attorney fees, though your agreement may still make you responsible for court filing fees and other costs. For cases involving clear statutory violations with per-incident damages, attorneys are more willing to take the case on contingency, because the numbers are easier to predict.