Violation of Privacy: Torts, Federal Statutes, and Remedies

A violation of privacy happens when someone intrudes on your private affairs or misuses your personal information without authorization. It can be a landlord with a hidden camera, a hospital employee leaking your records, a company collecting your child’s data without consent, or someone recording your phone call in secret. U.S. law treats these harms through a mix of common law torts you can sue over, federal statutes that regulate specific industries, and state data privacy laws. Which one applies, and what you can recover, depends on who violated your privacy and how.

What Counts as a Violation of Privacy

Most private disputes over privacy are handled through four common law torts, drawn from the Restatement (Second) of Torts and recognized in most states. A single incident can trigger more than one.

Intrusion Upon Seclusion

Someone intentionally intrudes on your private space or affairs in a way a reasonable person would find highly offensive. A peeping Tom, an unauthorized wiretap, a hacker in your email, a GPS tracker planted on your car. You don’t have to show anyone published or shared what they found. The invasion itself is the violation.

Public Disclosure of Private Facts

Someone widely shares truthful but deeply personal information about you that isn’t already public, and the disclosure would deeply offend a reasonable person. Revealing a medical condition or sexual history without consent is the classic example. The information doesn’t have to be false, but courts balance these claims against the First Amendment, and matters of legitimate public concern are often shielded.

False Light

Someone publicly portrays you in a misleading way that would be highly offensive to a reasonable person. The portrayal doesn’t have to be an outright lie. Running your photo next to an unrelated story in a way that implies you were part of it can create a false impression without any single statement being untrue. Not every state recognizes this tort, and those that do usually require proof the defendant acted with reckless disregard for the truth.

Appropriation of Name or Likeness

Someone uses your name, photo, or identity for commercial purposes without permission. Putting your image in an advertisement you never agreed to is the textbook case. Sometimes called the “right of publicity,” this applies whether you’re a celebrity whose endorsement has market value or an ordinary person who never consented to being on a billboard.

When a Federal Statute Has Been Broken

Congress has passed targeted laws for industries that handle sensitive data. These statutes define specific violations, and breaking them can trigger government enforcement, civil suits, and sometimes criminal charges.

Health Records (HIPAA)

The Health Insurance Portability and Accountability Act applies to healthcare providers, health plans, healthcare clearinghouses, and their business associates. They must safeguard your health information and limit how it’s disclosed.¹ Common violations: disclosing records to the wrong person, failing to encrypt electronic health data, not training employees on privacy procedures.

Civil penalties scale with fault, from $145 per violation at the low end up to $73,011 for willful neglect left uncorrected, with a calendar-year cap of $2,190,294 for repeated identical violations. Criminal penalties apply to anyone who knowingly obtains or discloses health information in violation of the law: up to $50,000 and a year in prison for a basic knowing violation, rising to $250,000 and 10 years when the information was taken for commercial advantage, personal gain, or to cause harm.²

One important limit: HIPAA doesn’t let you sue the covered entity directly. You file a complaint with the Office for Civil Rights at the Department of Health and Human Services, which investigates and can impose penalties.³

Financial Information (GLBA)

The Gramm-Leach-Bliley Act requires financial institutions to disclose their information-sharing practices and safeguard your data.⁴ Before sharing nonpublic personal information with an unaffiliated third party, the institution has to tell you, explain how to opt out, and give you the chance to do so.⁵ The law also makes it a federal violation to obtain someone’s financial information through deception, including false statements, fraudulent documents, or impersonating a customer.⁶

Phone Calls, Emails, and Texts (ECPA)

The Electronic Communications Privacy Act has two main pieces. The Wiretap Act makes it a crime to intentionally intercept a wire, oral, or electronic communication in transit.⁷ That covers phone wiretaps, software that captures texts in transit, and hidden recording devices. Under federal law, one party to the conversation can consent, which is why you can record your own calls. But roughly a dozen states require every party to consent. If you and the other person are in different states, the stricter rule often controls.

The Stored Communications Act protects messages already in storage. Breaking into someone’s email or accessing their voicemails without authorization violates it. If the unauthorized access was for commercial gain, to cause harm, or to further another crime, a first offense carries up to five years in prison, with up to ten for repeat offenders. Otherwise, the maximum is one year for a first offense.⁸

ECPA also lets victims sue. You can recover the greater of actual damages (plus the violator’s profits) or statutory damages of $100 per day or $10,000, whichever is more, along with attorney’s fees.⁹

Children Under 13 (COPPA)

The Children’s Online Privacy Protection Act applies to websites and online services that collect personal information from children under 13. Operators must post clear privacy policies and get verifiable parental consent before collecting, using, or disclosing a child’s data.¹⁰ “Verifiable” means real confirmation that a parent actually consented, not a checkbox buried in terms of service. The FTC enforces COPPA and can impose civil penalties of up to $53,088 per violation, adjusted annually for inflation.

Streaming and Video History (VPPA)

The Video Privacy Protection Act prohibits providers of video content from knowingly disclosing a consumer’s viewing history without written consent. Originally aimed at video rental stores, it now applies to streaming services and apps. A consumer whose viewing data was shared without proper consent can sue and recover at least $2,500 in liquidated damages per violation, plus punitive damages and attorney’s fees.¹¹ The consent must be explicit and standalone, not bundled into a general privacy policy.

State Data Privacy Laws

Roughly 20 states have enacted comprehensive data privacy laws that go beyond federal statutes. Each one differs, but they share common features: the right to know what personal data companies collect about you, the right to have it deleted, and the right to opt out of its sale. Companies that handle data from residents of these states have to comply even if they’re headquartered elsewhere. If you believe a company mishandled your personal information, check whether your state has one of these laws, because it may give you rights and remedies federal law doesn’t.

Privacy at Work

Workplace privacy is narrower than many employees expect. Employers have broad authority to monitor company-owned equipment, including work email, internet activity, and files on work computers. The Wiretap Act’s business extension exception allows monitoring when the device is part of the employer’s own communication system and used in the ordinary course of business. If you signed an acknowledgment of a computer usage policy, courts often treat that as implied consent.

Limits do exist. Hidden cameras in changing areas, recording in restrooms or private break areas, and monitoring personal devices on a private network can cross the line. Surveillance targeting union activity can violate federal labor law. Employers who track productivity through GPS or cameras on company vehicles have to tell employees in advance. The more notice the employer gives and the more directly the monitoring serves a legitimate business purpose, the more likely it’s legal. Personal spaces and off-duty conduct receive the strongest protection.

What You Have to Prove

Winning a common law privacy claim takes more than feeling violated. Courts look for specific elements.

The defendant’s conduct must have been intentional or reckless. Accidentally stumbling across private information doesn’t create liability.

Most of these torts require that the intrusion or disclosure would be “highly offensive to a reasonable person.” This is an objective standard. A neighbor glancing over the fence isn’t actionable; a neighbor pointing a hidden camera at your bedroom window is. Courts weigh the nature of the intrusion, how it was carried out, and what someone of ordinary sensibilities would think. Information you’ve already made public, or that concerns a matter of legitimate public interest, is far less likely to support a claim.

Statutory claims work differently. A HIPAA violation doesn’t require proof that a disclosure was “highly offensive.” Any impermissible disclosure of protected health information can trigger penalties. ECPA claims turn on whether the interception or access was unauthorized, not whether the content was embarrassing. Each statute defines its own elements, so what you have to prove depends on which law was broken.

What You Can Recover

A successful common law tort claim can produce several kinds of damages:

Compensatory damages for actual financial losses like medical bills, lost wages, or costs tied to the violation.
General damages for non-economic harm, including emotional distress.
Punitive damages when the defendant’s conduct was especially egregious.
Injunctive relief, meaning a court order to stop the behavior, remove published material, or end the surveillance.

Several federal statutes come with built-in damage floors because privacy harms are hard to quantify in dollars. ECPA sets statutory damages of at least $10,000 even when actual losses are smaller.⁹ The VPPA floor is $2,500 per violation.¹¹

Where to File

You often have more than one option. For a common law tort, the path is a civil lawsuit in state court. For ECPA and VPPA violations, you can sue in federal court under those statutes directly.

If a company deceived you about its privacy practices or mishandled your personal data, the Federal Trade Commission brings enforcement actions under Section 5 of the FTC Act, which prohibits unfair and deceptive commercial practices.¹² For HIPAA, you file with the Office for Civil Rights at HHS.¹³ These agencies can impose substantial fines and force companies to change how they handle data going forward.

Deadlines

Every privacy claim has one. Common law tort claims typically carry a two-to-five-year statute of limitations depending on the state, running from when the violation happened or when you reasonably discovered it. ECPA lawsuits have to be filed within two years of the date you discovered the violation or reasonably should have.⁹ HIPAA complaints to the Office for Civil Rights are generally due within 180 days of when you knew or should have known about the violation, though extensions are sometimes granted. Miss the deadline and the claim is gone, so identify the right one early.

1
U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule
2
Office of the Law Revision Counsel. 42 US Code 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
3
U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint
4
Federal Trade Commission. Gramm-Leach-Bliley Act
5
Office of the Law Revision Counsel. 15 US Code 6802 – Obligations With Respect to Disclosures of Personal Information
6
Office of the Law Revision Counsel. 15 US Code 6821 – Privacy Protection for Customer Information of Financial Institutions
7
Office of the Law Revision Counsel. 18 US Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited
8
Office of the Law Revision Counsel. 18 US Code 2701 – Unlawful Access to Stored Communications
9
Office of the Law Revision Counsel. 18 US Code 2520 – Recovery of Civil Damages Authorized
10
GovInfo. 15 US Code Chapter 91 – Childrens Online Privacy Protection
11
Office of the Law Revision Counsel. 18 US Code 2710 – Wrongful Disclosure of Video Tape Rental or Sale Records
12
Office of the Law Revision Counsel. 15 US Code 45 – Unfair Methods of Competition Unlawful
13
U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint