The effects of an invasion of privacy fall on two people at once: the person whose privacy was violated can sue under one of four recognized privacy torts and recover money for financial losses, emotional distress, and, in serious cases, punitive damages; the person who did the violating can face federal criminal charges carrying up to five years in prison, and up to twenty for the most serious computer offenses. Around that legal core, victims typically deal with identity theft, credit damage, lasting anxiety, and digital security problems that persist long after the case ends.
What Counts as an Invasion of Privacy
American law recognizes four separate privacy torts, drawn from the Restatement (Second) of Torts. Which one applies shapes what you have to prove and what you can recover.
Intrusion upon seclusion covers intentional intrusion into someone’s private affairs in a way a reasonable person would find highly offensive. Phone tapping, reading private mail, searching bank records, and hidden cameras all qualify. The intrusion does not have to be physical.1Harvard Law School. Restatement of the Law, Second, Torts, 652
Public disclosure of private facts applies when someone publicizes genuinely private information that would be highly offensive to a reasonable person and is not of legitimate public concern. Truth is not a defense; the harm is the exposure itself.1Harvard Law School. Restatement of the Law, Second, Torts, 652
False light addresses being publicly portrayed in a misleading way that would be highly offensive to a reasonable person, where the person responsible knew the portrayal was false or acted with reckless disregard for the truth.2Legal Information Institute. U.S. Constitution Annotated – Privacy Torts Not every state recognizes it.
Appropriation of name or likeness covers unauthorized commercial use of a person’s name, image, voice, or other identifying features. It overlaps with what many states separately protect as a right of publicity.1Harvard Law School. Restatement of the Law, Second, Torts, 652
What You Can Recover in a Lawsuit
A successful privacy suit can produce several kinds of damages. Economic damages cover measurable losses: lost wages, therapy bills, and money spent trying to contain the breach. Non-economic damages compensate for emotional distress, anxiety, humiliation, and reputational injury. Courts have recognized recovery for plaintiffs who were “greatly distressed, humiliated, and embarrassed” by privacy violations even when the out-of-pocket losses were small.3Berkman Klein Center for Internet & Society. Common Law Tort Cases
Punitive damages are available in especially egregious cases. They exist to punish outrageous conduct and deter repeats, not to reimburse the victim. Courts can also issue injunctions ordering the invasive conduct to stop, which for many victims matters as much as the money.
Criminal Penalties the Offender Can Face
Some privacy violations are also federal crimes. The penalties are serious, and they stack on top of any civil liability.
Illegally intercepting phone calls, emails, or other electronic communications violates the Electronic Communications Privacy Act. A first offense carries up to five years in prison, a fine, or both.4Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Federal law requires at least one party’s consent to record; roughly a dozen states require everyone’s, so recording without permission in those states can trigger both federal and state charges.
Capturing images of someone’s private areas without consent on federal property is a federal video voyeurism offense punishable by up to one year in prison, a fine, or both. Most states have their own voyeurism statutes covering private homes, hotel rooms, and restrooms.5Office of the Law Revision Counsel. 18 U.S. Code 1801 – Video Voyeurism
Breaking into someone’s email, social media, or cloud storage violates the Stored Communications Act. When done for commercial gain, malicious harm, or in furtherance of another crime, a first offense carries up to five years, and a subsequent offense up to ten. Even without those aggravating factors, unauthorized access can bring up to a year in prison.6Office of the Law Revision Counsel. 18 U.S. Code 2701 – Unlawful Access to Stored Communications
The Computer Fraud and Abuse Act reaches unauthorized access to any protected computer. Penalties start at up to one year for a basic first offense, rise to five years when done for commercial gain or in furtherance of another crime, hit ten for repeat offenders, and reach up to twenty years for a repeat offense involving unauthorized access to classified government information.7Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection with Computers
Regulatory Penalties for Companies
When the violator is a business rather than an individual, federal regulators add another layer. The Federal Trade Commission enforces consumer privacy under Section 5 of the FTC Act, which prohibits unfair and deceptive practices.8Federal Trade Commission. Privacy and Security Enforcement Civil penalties can exceed $53,000 per violation.9Federal Trade Commission. FTC Reminds Data Brokers of Their Obligations to Comply with PADFAA
Sites and apps collecting data from children under 13 must obtain verifiable parental consent under the Children’s Online Privacy Protection Act, and violations carry steep per-violation penalties.10eCFR. 16 CFR Part 312 – Childrens Online Privacy Protection Rule HIPAA violations by healthcare providers and insurers follow a tiered penalty structure that can exceed $2 million annually when willful neglect goes uncorrected.
Financial Fallout for the Victim
Money problems tend to arrive fast. When stolen personal information is used to open fraudulent accounts, make unauthorized purchases, or drain existing accounts, victims can lose hundreds to thousands of dollars in charges, and reversing them takes time even when the bank ultimately cooperates.
Indirect costs stack up too. Independent credit monitoring runs roughly $20 to $40 a month when it is not offered free after a breach. Court filing fees for a civil suit typically run from $50 to over $400 depending on jurisdiction, and attorney costs dwarf the filing fee. If sensitive information reaches the wrong audience, professional consequences follow: lost opportunities, damaged business relationships, reduced earning capacity.
Federal law gives identity theft victims a specific recovery tool. Under the Fair Credit Reporting Act, a credit reporting agency must block information on your credit report that resulted from identity theft within four business days of receiving your identity theft report, proof of identity, and identification of the fraudulent information. Once the block is in place, creditors who know about it cannot sell, transfer, or place the fraudulent debt for collection, and the agency must notify the furnisher of the false information.11Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting from Identity Theft
Emotional and Personal Toll
The psychological effects often outlast the legal and financial ones. Persistent anxiety, a sense of vulnerability, and anger are common, and the specific distress that comes from knowing someone accessed parts of your life that were supposed to be off-limits is hard to explain to people who have not experienced it.
Trust erodes in several directions at once. Victims often start wondering whether the people around them were involved, and the suspicion damages relationships even when it turns out to be unfounded. Some people withdraw from social settings or online platforms, become hypervigilant about their devices and paper records, or need professional mental health support to work through the trauma. Reputational harm compounds the isolation when private information becomes public gossip.
Ongoing Digital Security Exposure
A single compromised email account can hand an attacker the keys to social media, banking, and cloud storage through password reset links. Once inside, attackers commonly move laterally, change passwords, and lock the original owner out.
The longer tail is harder to control. Stolen personal information often ends up for sale on dark web marketplaces, where multiple buyers can acquire it for different types of fraud. Targeted phishing, spam, and social engineering attempts frequently surge after a breach and can continue for years. Even after passwords are changed and accounts are secured, exposed data stays in circulation. There is no practical way to recall it.
Defenses and Deadlines That Can Stop a Claim
Not every privacy intrusion becomes a winning lawsuit. Consent is the most direct defense: if you agreed to the disclosure or access, whether through a release, an interview, or a terms-of-service agreement, you generally cannot sue for what you authorized. The consent has to cover the specific disclosure, though. Agreeing to a photo for one purpose does not authorize its use for another.
For public disclosure of private facts, newsworthiness is a strong First Amendment defense, and the tort’s own definition requires that the disclosed information not be of “legitimate concern to the public.”1Harvard Law School. Restatement of the Law, Second, Torts, 652 Journalists and media outlets have significant protection when reporting on matters of genuine public interest, even when the reporting reveals private details.
Every privacy tort has a statute of limitations. Deadlines vary by state but generally run one to three years from the date you discovered, or should have discovered, the invasion. Missing that window ends the claim regardless of its merits, and this is where people most often lose otherwise strong cases.