Data misuse laws and consumer protections in the United States come from three overlapping sources: broad federal statutes like the FTC Act and the Fair Credit Reporting Act, sector-specific rules for health, financial, and children’s data, and a growing set of comprehensive state privacy laws now in effect in roughly nineteen states. Together they set limits on how a company that legally holds your personal information can use it, and they give you tools ranging from regulatory complaints to private lawsuits when those limits are crossed.
The distinction from a data breach matters. A breach is theft by an outsider. Misuse is the company you trusted stepping outside the boundaries you agreed to when you handed the data over.
What Counts as Data Misuse
The controlling idea is purpose limitation. When a business collects your information for a stated reason, it cannot repurpose that information for something unrelated without asking again. Those stated reasons usually live in a privacy policy or terms of service. If an online retailer takes your address to ship an order and then loads it into a marketing database sold to advertisers, that is misuse, regardless of how the retailer originally got the address.
Common patterns that fall inside the misuse category include:
- Employees pulling up records they have no business reason to see, such as a hospital worker looking at a celebrity patient’s file out of curiosity.
- Selling user datasets to third-party brokers when the privacy agreement prohibited resale.
- Feeding customer data into an AI training model when users consented only to the original service.
- Scraping information from a platform in ways that bypass access controls or violate the site’s terms.
The legal question in each case is not how the company obtained the data, but whether it stayed within the scope of what you agreed to.
Federal Laws That Apply
The broadest federal tool is Section 5 of the FTC Act, which makes unfair or deceptive business practices unlawful.1Office of the Law Revision Counsel. 15 U.S. Code 45 – Unfair Methods of Competition Unlawful; Prevention by Commission The statute never mentions privacy, but if a company publishes a policy promising to protect your data and then does the opposite, the FTC treats that broken promise as a deceptive act. It is the agency’s primary weapon in privacy enforcement.
Congress has layered sector-specific statutes on top for especially sensitive information:
- HIPAA covers individually identifiable health information held by providers, insurers, and related entities. Penalties are tiered by the level of negligence, from $100 per violation at the lowest tier up to $50,000 per violation for willful neglect, with annual caps reaching $1.5 million per violation category.2Office of the Law Revision Counsel. 42 U.S. Code 1320d – Definitions3Office of the Law Revision Counsel. 42 U.S. Code 1320d-5 – General Penalty for Failure To Comply
- The Gramm-Leach-Bliley Act obligates financial institutions to protect the security and confidentiality of customers’ nonpublic personal information, including safeguards against unauthorized access that could cause substantial harm.4Office of the Law Revision Counsel. 15 U.S. Code 6801 – Protection of Nonpublic Personal Information
- COPPA requires websites and apps to obtain verifiable parental consent before collecting personal information from anyone under thirteen. Violations have produced some of the FTC’s largest recent penalties, including a $10 million settlement with Disney in 2025 over children’s data collection.5Office of the Law Revision Counsel. 15 U.S. Code 6502 – Regulation of Unfair and Deceptive Acts and Practices in Connection with Collection and Use of Personal Information from and About Children on the Internet6Federal Trade Commission. Privacy and Security Enforcement
The Fair Credit Reporting Act
The FCRA controls who can pull your credit report and why. A credit reporting agency may furnish your report only to someone with a permissible purpose, such as evaluating you for credit, employment, or insurance.7Office of the Law Revision Counsel. 15 U.S. Code 1681b – Permissible Purposes of Consumer Reports Pulling a report out of curiosity, to check on an ex-spouse, or for a competitive business edge violates the law.
It is one of the few federal privacy statutes that lets you sue directly. Willful misuse of your credit report exposes the violator to statutory damages of $100 to $1,000 per violation, plus punitive damages and attorney’s fees. Someone who pulls your report under false pretenses faces liability of at least $1,000 or actual damages, whichever is greater.8Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance That private right of action gives the FCRA teeth that most other federal data statutes lack.
State Privacy Rights
As of early 2026, roughly nineteen states have comprehensive consumer privacy laws in effect, with more scheduled to come online. They share a common shape: residents can find out what data a business holds on them, request deletion, and opt out of the sale of their information to third parties. Many also require businesses to conduct data protection assessments before handling sensitive categories of information.
Every state, plus the District of Columbia, has a data breach notification law requiring companies to alert residents when their personal information is exposed. Thirty days is a common deadline. These notification rules apply even in states without broader privacy legislation, so every American has at least a baseline right to know when their data has been compromised.
The practical effect is that your rights depend heavily on where you live. A California or Colorado resident has substantially more leverage over a company than someone in a state that still relies only on federal law and breach notification.
Dark Patterns and AI Training
Two newer enforcement fronts touch almost everyone who uses the internet.
The FTC has focused on what it calls “dark patterns,” interface designs that push users into giving up more personal information than they intended. Examples include hiding disclosures behind extra clicks, pre-selecting privacy-invasive options so you have to actively opt out, and burying cancellation flows to keep you subscribed to data-collecting services.9Federal Trade Commission. FTC, ICPEN, GPEN Announce Results of Review of Use of Dark Patterns Affecting Subscription Services, Privacy When design choices are deliberate enough to steer users toward outcomes they would not otherwise choose, the FTC treats it as potential deception under Section 5.
The second front is AI training. Companies increasingly feed user data into machine learning models without clear consent for that secondary use. If you uploaded photos to a storage app and the company used those images to train facial recognition software, that fits the classic purpose-limitation violation. The FTC has responded with a remedy sometimes called algorithmic disgorgement: orders requiring companies to delete not only the improperly collected data but the algorithms and models built from it. Years of development work can be lost when the underlying data was misused.
Who Enforces These Rules
Enforcement runs on three independent tracks.
The FTC is the most active federal enforcer. Its typical outcome is a consent decree combining a financial penalty with long-term oversight, often a 20-year monitoring period requiring independent compliance assessments. Recent actions in 2024 and 2025 targeted data brokers, antivirus companies, and app developers for unauthorized data collection and deceptive privacy claims.6Federal Trade Commission. Privacy and Security Enforcement
State attorneys general file civil suits independently of the FTC, and they do so often. In states with comprehensive privacy laws, the attorney general is usually the sole enforcer, though a few states have dedicated privacy agencies. A single course of conduct can attract both federal and state enforcement at once.
Private lawsuits are narrower but real. The FCRA lets individuals sue for credit report misuse, with statutory damages of $100 to $1,000 per willful violation plus punitive damages.8Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance Several state privacy laws also include private rights of action, generally limited to data breaches caused by a failure to implement reasonable security. Statutory damages under those state provisions typically run from about $100 to $750 per consumer per incident. The FTC Act itself does not authorize private lawsuits, which is why FCRA and state claims are the usual routes for consumers acting on their own.
Steps to Take if Your Data Was Misused
The first few days matter more than anything that follows.
File complaints with regulators. Start with the FTC at ftc.gov/complaint or 1-877-FTC-HELP. Individual complaints feed the pattern-matching that drives FTC investigations, so filing counts even when your specific report does not become a case on its own. File with your state attorney general as well; most maintain a consumer complaint portal.
Freeze your credit if the misuse involved information that could be used for identity theft. Federal law makes credit freezes free. A freeze blocks new creditors from pulling your report, making it nearly impossible for someone else to open accounts in your name. You must contact each bureau separately: Equifax, Experian, and TransUnion. You can lift the freeze temporarily when you need to apply for credit yourself. A fraud alert is a lighter option that lasts one year and requires contacting only one bureau, which must notify the other two. A freeze is stronger in most situations.
Exercise your state privacy rights if you live in a state with a comprehensive law. Submit deletion requests and opt-out requests directly to the company. Some states run centralized platforms that let you opt out of many data broker databases in a single request instead of contacting each broker.
Document everything. Save screenshots of the privacy policy that was in effect when you shared your data, any notices the company sent about changes to its practices, and evidence of the misuse itself. Keep records of financial harm too: unauthorized charges, credit monitoring costs, and time spent cleaning up the fallout. If you eventually sue or file a formal complaint, this record is what separates a credible claim from a vague grievance.