The statute of limitations for invasion of privacy runs one to three years in most states, with federal electronic privacy statutes generally allowing two years from the date you discovered the violation. The exact deadline depends on where the invasion happened, which type of privacy claim you’re bringing, and whether a government entity is involved. Miss the deadline and the claim is almost always dead, no matter how strong the underlying facts.
State Deadlines Run One to Three Years
There is no single federal statute of limitations for invasion of privacy. Each state sets its own, and the range runs from one year to as long as six years in a few jurisdictions, with most falling between one and three years from the date the claim arises.1Justia. Civil Statutes of Limitations: 50-State Survey The deadline that applies to your case is set by the state where the invasion occurred, not necessarily where you live.
That cross-border point matters. If someone in one state secretly records a phone call with you in another state, the applicable deadline could be one year or three years depending on which state’s law governs. Conflict-of-law rules vary, and getting this wrong can be fatal to a claim.
Why the Type of Claim Changes the Deadline
Invasion of privacy isn’t a single legal theory. It covers four distinct torts: intrusion upon seclusion (hidden cameras, eavesdropping, unauthorized access to private accounts), public disclosure of private facts, false light, and appropriation of your name or likeness for commercial use. Most states treat the first three under their general personal injury statute of limitations, but false light is the frequent exception. A majority of jurisdictions now treat false light claims like defamation for limitations purposes, which often means a one-year deadline instead of two or three. A handful of states don’t recognize false light at all.
Even within a single state, different privacy torts may carry different deadlines. Recording someone’s private conversation might fall under a specific wiretapping statute with its own limitation period, while physically intruding on their private space falls under the general tort deadline. Check the specific statute that covers your situation rather than relying on a state’s general personal injury deadline.
Federal Privacy Statutes Generally Give You Two Years
When an invasion of privacy involves electronic surveillance, unauthorized computer access, or mishandled government records, federal law often applies alongside or instead of state tort law. The main federal privacy statutes all run on a two-year clock, and all incorporate a version of the discovery rule.
Wiretap Act and Stored Communications Act
The federal Wiretap Act covers the illegal interception of phone calls, emails, and other electronic communications. If someone secretly records your calls or intercepts your messages, you have two years to file a civil lawsuit from the date you first had a reasonable opportunity to discover the violation.2Office of the Law Revision Counsel. 18 USC 2520 – Recovery of Civil Damages Authorized The Stored Communications Act, which covers unauthorized access to stored emails, text messages, and cloud-based data, applies the same two-year deadline measured from the date of discovery.3Office of the Law Revision Counsel. 18 USC 2707 – Civil Action
Computer Fraud and Abuse Act
The CFAA covers unauthorized access to computers and networks. If someone hacks your accounts, installs spyware on your devices, or accesses your files without permission, you generally have two years from either the date of the unauthorized access or the date you discovered the damage, whichever gives you more time.4Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
Federal Privacy Act of 1974
If a federal agency mishandles your personal records, the Privacy Act gives you two years from when the cause of action arises. One wrinkle: if the agency willfully misrepresented information it was required to disclose, you get two years from the date you discover the misrepresentation instead.5Office of the Law Revision Counsel. 5 USC 552a – Records Maintained on Individuals
Suing the Government Comes With Shorter Deadlines
Government defendants trigger a separate set of pre-suit deadlines that catch people off guard. Under the Federal Tort Claims Act, you must file a written administrative claim with the responsible federal agency within two years of when the claim accrues. If the agency denies your claim, you then have just six months from the date of that denial to file a lawsuit in federal court.6Office of the Law Revision Counsel. 28 USC 2401 – Time for Commencing Action Against United States Miss the administrative claim deadline and the courthouse door is permanently shut.
State and local governments impose similar pre-suit notice requirements, often with even tighter windows. Many states require you to file a tort claim notice within six months of the incident before you can file a lawsuit at all. This notice requirement runs on its own clock, separate from the statute of limitations. Failing to file the notice on time bars the claim even if the underlying statute of limitations hasn’t expired.
When Does the Clock Start Running?
The start date is often not the moment the wrongful act happens. Privacy violations are uniquely suited to delayed discovery because, by their nature, they often happen in secret.
The Discovery Rule
Most states apply the discovery rule to privacy claims, which delays the start of the limitation period until you knew or reasonably should have known about the violation. If someone installs a hidden camera in your rental unit, the clock doesn’t start on the day the camera was placed. It starts when you find it, or when circumstances were such that a reasonable person in your position would have investigated and found it.
The federal electronic privacy statutes build this concept directly into the text. The Wiretap Act starts the two-year clock on the date you “first had a reasonable opportunity to discover the violation.”2Office of the Law Revision Counsel. 18 USC 2520 – Recovery of Civil Damages Authorized The CFAA measures from the date of the act or the date of discovery, whichever comes later.4Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
The discovery rule has limits. You can’t stick your head in the sand. If you receive information that should make a reasonable person suspicious, the clock may start running even if you choose not to investigate.
Published Content and the Single Publication Rule
For privacy claims involving published material, whether online posts, articles, or broadcasts, most states follow the single publication rule. The statute of limitations starts when the material is first published, not each time a new person views it. A blog post that violates your privacy triggers the clock on the day it goes live, even if it gets shared widely months later. Republication to a new audience, like reposting on a different platform, may restart the clock in some jurisdictions, but simply leaving content accessible online does not.
Ongoing Invasions
When an invasion of privacy is continuous rather than a single event, the continuing violation doctrine may apply. If a neighbor runs a surveillance camera pointed at your bedroom window every day for two years, each day of surveillance could constitute a separate violation, and the clock would run from the most recent one. This matters most for stalking, ongoing surveillance, and repeated unauthorized access to private information.
What Can Pause the Clock
Several doctrines can temporarily pause, or “toll,” the statute of limitations, effectively giving you more time to file.
In most states, the clock does not run against someone who was under 18 when the privacy violation occurred. It starts when the person turns 18, and the full limitation period runs from there. If a state has a two-year statute and a child’s privacy is violated at age 12, that person would generally have until age 20 to file.
Many states also toll the clock for individuals who lack the mental capacity to understand their legal rights at the time the claim arises. The specifics vary. Some states pause the clock entirely until the disability is removed; others impose an outer limit beyond which no tolling is allowed, regardless of the person’s condition.
Fraudulent concealment is a third pause button. If the person who invaded your privacy took affirmative steps to hide what they did, courts may toll the statute until the concealment is uncovered. This goes beyond the discovery rule. The defendant must have done something deliberate to cover their tracks; simply staying quiet is usually not enough.
Missing the Deadline Ends the Case
The statute of limitations is an affirmative defense, meaning the defendant has to raise it, and in practice every competent defense attorney does so immediately. Once the defendant shows the filing was late, the burden shifts to you to prove that tolling, the discovery rule, or another exception applies. If you can’t, the court dismisses the case, and the strength of the underlying facts stops mattering. Because the deadlines are short and the exceptions are narrow, dating the violation and the moment of discovery, then checking both the state tort deadline and any applicable federal statute, is the first thing to do before anything else.