You can sue a company for leaking your personal information, but winning or even getting into court depends on proving the breach caused you real, documented harm, not just that your data was exposed. Courts throw out data breach cases every day where the only complaint is that information got out. Add to that the arbitration clauses buried in most terms of service, and the practical question is less “can I sue” and more “do I have the facts and the path to make a case worth bringing.”
What Counts as Harm the Court Will Recognize
Before a federal court will hear your case at all, you have to clear a constitutional threshold called Article III standing. The U.S. Supreme Court held in TransUnion LLC v. Ramirez (2021) that “only plaintiffs concretely harmed by a defendant’s statutory violation have Article III standing to seek damages against that private defendant in federal court.”1Supreme Court of the United States. TransUnion LLC v. Ramirez Translation: a statute being broken is not, by itself, an injury. Something has to have happened to you.
Tangible harms clear this bar relatively easily. Unauthorized charges on your accounts. Money you spent on credit monitoring after the breach. Documented identity theft. A fraudulent account opened in your name. If you can point to a line on a statement or a letter from a collections agency, you have the kind of injury courts recognize.
Intangible harms are harder. The Supreme Court has said they can qualify, but only when they bear a “close relationship” to harms traditionally recognized in American law, such as defamation or the public disclosure of private information.1Supreme Court of the United States. TransUnion LLC v. Ramirez Federal circuits remain split on whether the risk of future identity theft counts, and on whether spending money to protect yourself after a breach is enough. Where your case gets filed can matter as much as what happened to you.
Be honest with yourself here. If all you know is that your email showed up in a breach notification and nothing else has gone wrong, you likely don’t have a case a court will take. If you’ve got charges you didn’t make, accounts you didn’t open, or receipts for money you spent cleaning this up, you’re in a different position.
What You Have to Prove
Clearing standing gets you in the door. To win, you have to prove three things: the company owed you a duty to protect your data, the company failed to meet that duty, and that failure caused your specific harm.
The duty piece is usually the easiest. When you hand over personal information to a company, the law generally expects reasonable care in return. That duty can come from the relationship itself, from a federal or state statute, or from the company’s own privacy policy, which creates binding promises about how your data will be handled.
Showing the company fell short means pointing to inadequate security: unencrypted sensitive data, outdated software with known vulnerabilities, ignored industry-standard practices, employees with access they didn’t need. The standard isn’t perfection. Courts ask whether the company acted reasonably given what was foreseeable. A sophisticated attack that defeated current defenses is treated very differently from passwords stored in plain text.
Causation is where many cases stall. You need a line from the security failure to your specific injury. A credit card number appearing in a breach and fraudulent charges on that card weeks later is a strong connection. If your data has been in several breaches and identity theft surfaces months later, proving which breach caused it gets much harder. Courts want more than timing and suspicion.
Worth knowing about the big federal privacy statutes: most of them do not let you sue directly. HIPAA governs healthcare providers and their partners2U.S. Department of Health and Human Services. The Security Rule but is enforced by the government, not by individuals. The Gramm-Leach-Bliley Act covers financial institutions3Federal Trade Commission. Gramm-Leach-Bliley Act with the same limitation. Violations of these laws can serve as powerful evidence that a company was negligent, but your lawsuit has to be built on another theory. State laws are a different story: all 50 states have data breach notification requirements, and some create a private right to sue, with a handful setting statutory damages per consumer per incident. Where you live changes what’s available.
Check for an Arbitration Clause Before Anything Else
This is the part that catches most people off guard. Many companies include mandatory arbitration clauses and class action waivers in their terms of service, and these provisions can prevent you from ever stepping into a courtroom. Under the Federal Arbitration Act, courts have broadly upheld companies’ ability to funnel disputes into private arbitration and block class actions entirely.
Arbitration is a private process where a neutral arbitrator, not a judge or jury, decides the case. Proceedings are usually confidential, discovery is more limited, and there is no right to appeal in most situations. When the clause includes a class action waiver, you’re forced to pursue your claim alone. For most data breach losses, that makes the case economically impractical. A lawyer is unlikely to take a matter worth a few hundred dollars.
These clauses are not always enforceable. Courts have struck them down when they were buried in fine print without adequate notice, when the company failed to obtain meaningful consent, or when enforcing the waiver would conflict with a state law that specifically preserves class action rights. An attempt by the Consumer Financial Protection Bureau to restrict arbitration in financial services contracts was overturned by Congress in 2017, so no federal rule currently limits them.4Consumer Financial Protection Bureau. New Protections Against Mandatory Arbitration
Pull up the terms of service you agreed to when you signed up. Some agreements include opt-out windows, often 30 days after signing up, that let you reject the arbitration provision by sending written notice in time. If that window has passed, challenging the clause gets significantly harder. One more thing to watch: when a company offers free credit monitoring after a breach, read the enrollment terms before accepting. Most don’t require you to waive legal rights, but some have included language funneling claims into arbitration.
What You Can Actually Recover
If a data breach lawsuit succeeds or settles, compensation generally falls into three categories.
- Economic damages cover documented out-of-pocket losses. Money spent fixing fraudulent charges, credit monitoring costs, lost wages from time dealing with the problem, and fees paid to accountants or identity restoration services. These are the most straightforward to prove because they come with receipts.
- Non-economic damages compensate for emotional distress, anxiety, or loss of privacy. Courts are skeptical without strong evidence. A formal diagnosis from a mental health professional carries far more weight than testimony that you felt stressed or worried.
- Statutory damages are set amounts specified by certain privacy laws, available regardless of whether you can prove financial loss. When available, they often range from $100 to $750 or more per consumer per incident, depending on the statute and the court’s assessment of the company’s conduct.
Keep expectations grounded. The Equifax settlement reached up to $425 million for affected consumers, covering out-of-pocket losses, time spent dealing with the breach, and other benefits.5Federal Trade Commission. Equifax Data Breach Settlement Spread across roughly 147 million affected people, individual payouts were modest. FTC enforcement actions, including the agency’s $5 billion penalty against Facebook6Federal Trade Commission. FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook, don’t put money in your pocket directly, though they sometimes result in settlement funds consumers can claim.
Individual Lawsuit or Join a Class Action
An individual suit makes sense when your damages are substantial and clearly traceable to the breach. If someone opened accounts in your name, drained a bank account, or caused damage that took months to untangle, filing on your own lets you pursue the full value of your losses without sharing a settlement fund with thousands of other people. You also control the strategy and the timeline.
Class actions are far more common in data breach cases. A few named plaintiffs file on behalf of everyone similarly affected, and the court resolves thousands of claims in one proceeding. Most individual data breach losses are too small to justify the cost of a solo lawsuit, so a class action is often the only practical route. The tradeoff is that per-person payouts tend to be small: a few dollars, free credit monitoring, or a modest cash payment. One settlement offered class members up to $300 each, with up to $3,000 for those who could prove extraordinary losses.
If a class action is filed after a breach that affected you, a notice will arrive explaining your options. You can participate and receive whatever the settlement offers, or you can opt out and preserve your right to file your own lawsuit. Opting out only makes sense if your individual damages are large enough to justify separate litigation.
Don’t Miss the Filing Deadline
Every lawsuit has a statute of limitations, and data breach claims are no exception. The specific window depends on the legal theory and the state. Negligence, contract, and statutory privacy claims each carry their own deadlines, typically running two to four years but varying by jurisdiction.
When the clock starts matters as much as how long it runs. Many states follow a “discovery rule,” meaning the period begins when you learn about the breach or reasonably should have, not when the breach actually happened. Since companies sometimes take months or years to discover and disclose breaches, this distinction can save or sink a case. The notification letter you received from the company establishes a clear date you became aware. Keep it.
Evidence to Start Gathering Now
Strong documentation separates viable claims from ones that go nowhere. Start collecting as soon as you learn about the breach.
- The breach notification letter. This confirms your information was compromised, identifies what data was involved, and establishes the timeline.7U.S. Department of Health and Human Services. Breach Notification Rule
- Financial records showing fraud. Bank and credit card statements with unauthorized charges flagged, collection notices for accounts you didn’t open, and credit report entries you don’t recognize. Pull reports from all three bureaus.
- Receipts for breach-related expenses. Credit monitoring, identity theft protection, postage for dispute letters, notary fees, professional services you hired to help resolve the problem.
- A time log. Courts recognize the value of time spent on breach cleanup. Keep a running record of hours spent on phone calls, dispute letters, bank visits, and police reports, with dates and what you accomplished.
- Communications with the company. Save every email, chat transcript, and letter. For phone calls, note the date, time, representative’s name, and what was discussed.
If the pieces are there — concrete harm, a traceable connection to the company’s failure, and no enforceable arbitration clause standing in the way — a lawsuit or class claim can be worth pursuing. Talk to a lawyer before the limitations clock runs out, and bring your documentation with you.