Yes, you can sue a company for selling your personal information, but only in a narrow set of circumstances: when a specific statute gives you a private right to sue, when the company sold data in a way that contradicts its own privacy policy, or when a security failure let your unprotected data get out. In most other situations, selling your data is legal because you agreed to it when you accepted the company’s terms, and enforcement runs through government agencies rather than individual lawsuits.
Why the Sale Was Probably Legal
When you sign up for a service, download an app, or click “I agree” on a terms of service page, you are typically authorizing the company to collect, use, and share your data in the ways described in its privacy policy. Courts treat that click as a binding contract. If the policy discloses that the company sells data to third parties for marketing or analytics, the sale is legal because you consented to it.
The ground shifts when a company exceeds what it disclosed. A policy that buries data-selling practices in misleading language, or a company that sells categories of data its policy never mentioned, is on weaker footing. That kind of mismatch can support claims under both contract law and consumer protection statutes.
When You Actually Have the Right to Sue
A “private right of action” is the legal term for your personal ability to file a lawsuit. Most privacy statutes limit it severely, and this is where expectations most often collide with reality.
Data Breaches of Unprotected Information
Under the most prominent state privacy law, individuals can sue when a company fails to implement reasonable security measures and that failure results in the unauthorized access, theft, or disclosure of nonencrypted and nonredacted personal information. In plain terms: if a breach exposes your unprotected data because the company skipped basic security, you have a claim. If the company simply sold your information to a marketing firm after ignoring your opt-out request, most state privacy laws do not let you sue over that. You file a complaint with the enforcement agency instead.
Credit Data Under the FCRA
The Fair Credit Reporting Act is the strongest federal tool for an individual plaintiff. Companies that sell credit data, credit scores, debt payment histories, or income information are generally treated as consumer reporting agencies and must follow strict rules about who can access that data and why. The FCRA includes a private right of action, so you can sue a data broker that sold your credit information to someone without a permissible purpose, with no breach required.1Federal Register. Protecting Americans From Harmful Data Broker Practices
Policy Violations as Contract or Deception Claims
If a company’s privacy policy promised not to sell your data and then sold it anyway, that mismatch can support a breach of contract claim and, separately, a deceptive practices claim under state consumer protection law. These are the claims most likely to succeed when there is no breach and no FCRA angle.
When You Can’t Sue but Can Still Act
Several important privacy laws do not give consumers the right to file their own lawsuit. Knowing which agency handles the complaint matters as much as knowing you cannot sue.
- Children’s Online Privacy Protection Act (COPPA): websites and apps directed at children under 13 must obtain verifiable parental consent before collecting personal information. Parents cannot sue; the FTC and state attorneys general enforce it.
- HIPAA: hospitals, insurers, and their business associates cannot sell health information without authorization. There is no private right of action. The Department of Health and Human Services enforces it, and state attorneys general can bring actions.
- Protecting Americans’ Data from Foreign Adversaries Act: enacted in 2024, this law bars data brokers from selling sensitive personal data to foreign adversary countries including China, Russia, North Korea, and Iran. Enforcement is through the FTC, not private lawsuits.2Office of the Law Revision Counsel. United States Code Title 15 Chapter 123 – Protecting Americans Data From Foreign Adversaries
Where no private right of action exists, the FTC uses Section 5 of the FTC Act, which prohibits unfair and deceptive practices, to pursue companies that mishandle consumer data. If a privacy policy promised one thing and the company did another, that is a deceptive practice the FTC can prosecute. Companies found to have committed penalty offenses can face civil penalties of up to $50,120 per violation.3Federal Trade Commission. Notices of Penalty Offenses The FTC does not sue on behalf of individuals, but a complaint filed at ftc.gov is free and can trigger an investigation that leads to settlements, injunctions, and penalties.4Federal Trade Commission. Privacy and Security Enforcement
If your state has a comprehensive privacy law without a private right of action, your route is a complaint to the state attorney general or a dedicated privacy agency. Before assuming you can sue, check whether your state’s law actually permits private lawsuits and under what conditions.
What You Have to Prove
Winning a data privacy case takes more than showing a sale happened. Three elements have to line up.
A legal duty. The duty has to come from somewhere: a specific statute, a regulation, or the company’s own privacy policy. A business that promised not to sell your data and did so has breached a contractual duty. A business that ignored a valid opt-out request under a state privacy law has breached a statutory duty.
An actual breach. This is often the hardest part. The sale happens between the company and the buyer, and you aren’t part of it. Practical ways to build evidence include submitting a data access request under your state’s privacy law to see what the company disclosed to third parties, checking data broker websites to see whether your information appears there, and documenting marketing contacts that started right after you shared data with a particular company. None of these are conclusive on their own, but together they build a circumstantial case.
Concrete harm. Courts have become skeptical of claims based on general anxiety about data exposure. Harms that count include identity theft, fraudulent charges, money spent on credit monitoring, and documented lost time. Where a statute provides statutory damages, you can recover a set amount without proving a specific financial loss, but you still have to satisfy the other elements of the claim.
What You Can Realistically Recover
State privacy laws that allow private lawsuits typically provide for statutory damages between $100 and $750 per consumer per incident, or actual damages, whichever is greater. Courts consider the seriousness of the violation, how long it lasted, and whether the company acted deliberately when setting the amount within that range.
Individual recoveries tend to be modest. Class action settlements involving millions of affected consumers frequently produce per-person payments in the $20 to $40 range after attorney fees and administrative costs come out. A 2025 class action settlement against a major healthcare organization over unauthorized data sharing totaled $46 million, but with millions of class members, per-person payouts landed in that range.
The calculus changes if you suffered substantial individual harm. If your identity was stolen and you can document thousands of dollars in fraudulent charges, lost wages, and credit repair costs, an individual lawsuit for actual damages may be worth pursuing. For most people whose data was sold without dramatic consequences, a class action or a regulatory complaint is the more realistic path.
Steps to Take Before You Sue
Some of these steps strengthen your case; some are legally required before you can file.
Exercise your rights under whatever privacy law applies to you. Submit an opt-out request through the company’s website. Request a copy of all personal information the company holds about you. Request deletion. Do all of it in writing and save everything: the request, the response, and screenshots of the opt-out process. If the company ignores the request or keeps selling your data afterward, that documented trail is your evidence.
Check for a notice-and-cure requirement. Many state privacy laws require you to give the company written notice of the specific violation and a window to fix it before you can sue for statutory damages. Under the most widely cited state law, that window is 30 days. If the company cures the violation within that period and provides written confirmation, you cannot sue for statutory damages tied to that issue. Tightening security after a breach has already happened does not count as curing the breach. The notice period also doesn’t apply if you’re suing only for actual financial losses you’ve already suffered.
Gather evidence while it still exists. Save the privacy policy (it will change), screenshot relevant web pages, preserve emails, and keep records of any harm. If your information appears on a data broker site, screenshot that too. Organize everything chronologically so an attorney can assess the claim quickly.
How Long You Have to File
Every lawsuit has a deadline. Most state privacy statutes don’t include their own statute of limitations, so general state rules for civil claims apply. For statutory violations, that window is typically two to four years from the date you discovered or should have discovered the violation. Miss it and your right to sue is gone regardless of how strong the underlying claim was.
The clock usually starts when the violation occurred or when you became aware of it, not when the company first collected your data. If you find out in 2026 that a company sold your information in 2024, the deadline runs from 2024. A required cure period pauses the clock; waiting to see if the company fixes things on its own does not.