There is no reliable average settlement for an invasion of privacy claim, and anyone quoting one number is guessing. Payouts run from roughly $25 per person in large data-breach class actions to tens or hundreds of thousands of dollars for an individual who can document serious harm, and up into the millions in the rare case that goes to a jury and sticks. Federal statutes set hard minimums for specific types of violations: $100 to $1,000 per violation under the Fair Credit Reporting Act, $1,000 under the Stored Communications Act, and $2,500 under both the Video Privacy Protection Act and the Driver’s Privacy Protection Act. Where your case lands within that enormous spread depends on the type of claim, the sensitivity of what was exposed, how widely it spread, and the evidence you can put on the table.
Why No One Can Quote You a Real Average
Most individual privacy settlements include confidentiality clauses that keep the dollar amount out of the public record. The cases you can read about tend to be outliers: massive class actions covered in the news or unusually large jury verdicts that get appealed. Averaging those extremes would produce a number that misleads more than it informs.
A more useful approach is to look at three things: the statutory floors Congress has built into specific privacy laws, what publicly reported cases have actually paid, and the factors that push a given settlement up or down. Together, those give you a realistic bracket for your own situation.
Statutory Minimums That Set the Floor
Several federal privacy statutes include minimum damages that apply whether or not you can prove you lost money. These matter in negotiations because the defendant knows a court could impose them regardless of actual harm.
- Fair Credit Reporting Act (FCRA): Willful misuse of your credit report or failure to follow FCRA requirements carries $100 to $1,000 per violation in statutory damages, plus any actual damages and discretionary punitive damages.1Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance
- Video Privacy Protection Act (VPPA): Wrongful disclosure of your video viewing records triggers liquidated damages of at least $2,500 per violation, plus punitive damages and attorney’s fees.2Office of the Law Revision Counsel. 18 U.S. Code 2710 – Wrongful Disclosure of Video Tape Rental or Sale Records
- Driver’s Privacy Protection Act (DPPA): Unauthorized access to or disclosure of motor vehicle records carries a minimum of $2,500 per violation in liquidated damages.
- Stored Communications Act (SCA): Unauthorized access to stored electronic communications exposes the violator to minimum damages of $1,000, with punitive damages available on top.
When a case involves one of these laws and the defendant’s conduct affected thousands of people, the aggregate exposure climbs fast. That math is why class action attorneys actively pursue these claims, and why defendants frequently settle rather than roll the dice at trial.
What Public Settlements Have Actually Paid
The largest reported privacy payouts come from class actions against companies that exposed consumer data or collected biometric information without consent. The total figures are big; the per-person share is usually modest once the fund is divided.
- Equifax data breach (2017): Up to $425 million in a consumer fund for credit monitoring and cash claims, one of the largest privacy-related settlements in U.S. history.3Federal Trade Commission. Equifax Data Breach Settlement
- Facebook biometric data (2020): A $650 million fund for Illinois users whose facial recognition data was collected without consent under that state’s biometric privacy law.
- T-Mobile data breach (2021): A $350 million settlement in which affected customers without documented losses received $25 to $100, while those who proved fraud-related expenses could recover up to $25,000.
- Google location tracking (2025): A $135 million class action settlement, followed by a separate jury verdict exceeding $314 million for secretly transmitting user data over cellular networks.
Individual lawsuits that go to trial can produce dramatically larger awards for a single plaintiff. In the most famous example, a Florida jury awarded Hulk Hogan $115 million in compensatory damages and $25 million in punitive damages against Gawker Media for publishing a private video without consent. The verdict ultimately bankrupted the media company. Cases like that are rare, but they mark the ceiling when a jury finds the invasion especially egregious.
For more typical individual cases involving a neighbor, an employer, or a smaller company, settlements rarely become public. Attorneys who handle these matters generally describe a range from a few thousand dollars for minor intrusions with limited proof of harm up to six figures when the plaintiff can document serious emotional distress, lost income, or reputational damage.
Factors That Move Your Number Up or Down
Because there is no formula, these are the variables that matter in practice.
Sensitivity of the information exposed. A leaked Social Security number or medical diagnosis drives a higher settlement than an unauthorized photograph taken in a semi-public place. Courts and juries respond to how intimate the information is and how much damage its exposure could do over time.
How widely it spread. A violation seen by one person carries less weight than one broadcast to thousands. Social media posts, published articles, and large-scale breaches produce bigger settlements because the harm is harder to undo.
Strength of your evidence. This is where most claims either gain traction or fall apart. Plaintiffs who arrive with therapy records, documented financial losses, employer correspondence about job consequences, and witness statements negotiate from a fundamentally different position than someone relying on their own testimony about feeling upset.
The defendant’s intent. Deliberate, malicious invasions attract higher settlements than negligent ones, partly because they open the door to punitive damages. A defendant with a pattern of similar conduct faces even greater exposure, because juries tend to punish repeat offenders more harshly.
The defendant’s financial resources. A corporate or celebrity defendant typically settles for more than an individual with limited assets, both because they can pay and because a larger award is needed to serve as a meaningful deterrent. The defendant’s insurance situation matters too. A commercial general liability policy usually covers invasion of privacy claims under its personal and advertising injury section, which can put real money on the table even when the defendant alone could not. Standard homeowners policies generally do not cover these claims unless the policyholder bought a personal offense endorsement.
Statutory damages. When a federal or state statute provides a per-violation minimum, the floor rises automatically. A defendant facing $2,500 per violation across 10,000 affected people has $25 million in exposure before actual or punitive damages are even discussed.
What the Settlement Is Actually Paying You For
Privacy settlements compensate three broad categories of harm. Knowing which ones apply to you gives you a realistic sense of what the claim is worth.
Economic Damages
These cover out-of-pocket costs you can trace to the violation. If unauthorized disclosure of your personal data led to identity theft, economic damages might include credit monitoring services, fees for freezing and unfreezing credit, lost wages from time spent cleaning up the mess, and any professional fees you paid. Courts expect receipts, bank statements, or similar documentation for every dollar claimed. The stronger your paper trail, the harder it is for the defendant to argue the number down.
Non-Economic Damages
Non-economic damages compensate harms that don’t come with a receipt: emotional distress, humiliation, anxiety, damage to your reputation, and the loss of personal relationships. These are often the largest component of an individual privacy settlement and also the hardest to prove. Courts look for concrete evidence beyond your own testimony. Therapy records, prescriptions for anxiety or depression medication, statements from people who witnessed the impact on your daily life, and documentation of how the invasion disrupted your work or social functioning all strengthen the claim. Without that kind of support, defendants will argue the distress was minor or speculative.
Punitive Damages
Punitive damages exist to punish conduct that was especially malicious, reckless, or outrageous. Not every privacy case qualifies; the defendant’s behavior generally needs to cross from careless into willful. When awarded, they can dwarf the compensatory amount, but the Supreme Court has put constitutional limits in place. In State Farm v. Campbell, the Court indicated that punitive awards exceeding a single-digit ratio to compensatory damages will rarely survive due process review, and that a 4-to-1 ratio may approach the constitutional boundary.4Justia. State Farm Mut. Automobile Ins. Co. v. Campbell, 538 U.S. 408 Judges use those guideposts when reviewing jury awards and during settlement discussions.
What You Keep After Taxes and Attorney Fees
The sticker price on a settlement is not what lands in your account. Two deductions matter: taxes and your attorney’s cut.
Settlement money received for emotional distress that does not stem from a physical injury is taxable as ordinary income.5Internal Revenue Service. Publication 4345, Settlements – Taxability The federal tax code excludes damages received on account of personal physical injuries or physical sickness, but the statute explicitly says emotional distress alone does not count as a physical injury.6Office of the Law Revision Counsel. 26 USC 104 – Compensation for Injuries or Sickness Since most privacy claims involve emotional harm rather than physical injury, most privacy settlements are at least partially taxable. You can reduce the taxable amount by medical expenses you paid to treat the emotional distress, as long as you did not already deduct those expenses on a prior return. Punitive damages are nearly always taxable regardless of the underlying claim.
If your settlement includes both compensatory and punitive components, how those amounts are allocated in the written agreement affects your tax bill. Negotiate the allocation before you sign; a well-drafted agreement specifies how the total payment breaks down and can save you a meaningful amount at tax time.
Most privacy attorneys work on contingency, taking a percentage of the recovery rather than charging hourly. That percentage typically falls between one-third and 40 percent.7American Bar Association. Fees and Expenses The rate often depends on whether the case settles before a lawsuit is filed, after filing but before trial, or after trial begins. Get the fee structure in writing, and confirm whether litigation costs such as filing fees, expert witnesses, and deposition expenses come out of your share or the attorney’s share. That detail can shift your net recovery noticeably.
Confidentiality: The Price of a Bigger Check
Most individual privacy settlements include a confidentiality clause, which is one reason reliable settlement data is so scarce. Defendants, especially corporations and public figures, pay more to keep the terms private, because a public settlement can invite copycat claims. Plaintiffs who agree to confidentiality often receive a higher payout in exchange.
These clauses typically prohibit you from disclosing the settlement amount, the terms, and sometimes even the fact that a settlement was reached. Violating the clause can trigger penalties that claw back part or all of the settlement. If you are offered a confidentiality clause, you are trading transparency for money; make sure the premium is worth it.
Where You File Changes the Math
Privacy law is not uniform across the country. Some states have constitutional provisions explicitly recognizing a right to privacy, giving courts a broader basis for awarding damages. Others rely entirely on common law or a patchwork of statutes that may limit the types of claims available or cap certain damages.
The biggest jurisdictional variable right now is biometric privacy. A growing number of states have enacted laws requiring companies to obtain consent before collecting fingerprints, facial geometry, or other biometric identifiers, with statutory damages for violations. The resulting litigation has produced some of the largest privacy settlements in recent years. If your claim involves biometric data, the state where the collection occurred matters enormously.
A quick boundary worth knowing: HIPAA does not give individual patients a direct right to sue for a medical privacy breach. Enforcement runs through the Department of Health and Human Services, and the penalties flow to the government rather than to you.8U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule A HIPAA violation often accompanies a state-law privacy claim that does support a private lawsuit, but the HIPAA piece alone will not get you a settlement.
Don’t Miss the Filing Deadline
Statutes of limitations for privacy torts generally run between one and three years from the date of the invasion, depending on the state and the type of claim. Missing the deadline almost always kills the claim regardless of its merits. Identify the right limitations period early; it matters more than most people realize, and running out the clock is the one mistake no settlement number can fix.