Data Privacy & Security Class Actions: Breaches, Tracking & Consumer Rights

Last reviewed: October 13, 2026

What privacy and security issues typically generate class action litigation?

Data breach litigation is one of the most active areas of consumer class actions. A data breach occurs when unauthorized individuals gain access to, acquire, or disclose personal information maintained by a company. Common breach types include hacking and cyberattacks (such as ransomware, phishing, or exploitation of unpatched software vulnerabilities), insider theft or misuse, loss or theft of unencrypted devices containing customer data, and accidental public exposure through misconfigured databases or cloud storage.

Breach victims typically allege that the company failed to implement reasonable security measures to protect personal information, breached an implied contract to safeguard data, violated state data breach notification statutes, and engaged in unfair or deceptive practices by misrepresenting its data security in privacy policies or marketing materials. When breaches expose Social Security numbers, financial account information, health records, or login credentials, plaintiffs often claim increased risk of identity theft and may seek damages for time and money spent monitoring credit, freezing accounts, and addressing fraudulent activity.

Privacy violations beyond breaches also generate substantial litigation. These include tracking technologies—cookies, pixels, session replay scripts—that collect browsing behavior, keystrokes, or form inputs without adequate disclosure or consent; sharing personal information with third-party advertisers, data brokers, or analytics companies in ways not disclosed in the privacy policy; biometric data collection, such as facial recognition, fingerprint scanning, or voiceprints, without informed consent or proper disclosures; and failure to honor opt-out requests, unsubscribe mechanisms, or Do Not Track signals.

State privacy statutes increasingly provide private rights of action. The Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/, allows individuals to sue for statutory damages when companies collect biometric identifiers without written consent and mandated disclosures. The California Consumer Privacy Act (CCPA), Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act (CPRA), grants California residents the right to sue for data breaches involving specified categories of personal information. Other states, including Virginia, Colorado, Connecticut, and Utah, have enacted comprehensive privacy laws with varying enforcement mechanisms.

What federal and state laws govern data privacy and security?

Federal Trade Commission Act Section 5 (15 U.S.C. § 45) prohibits unfair or deceptive acts or practices in commerce. The FTC has brought hundreds of enforcement actions against companies for inadequate data security, misrepresentations in privacy policies, and failure to honor consumer privacy choices. Under FTC precedent, a company's failure to implement reasonable security measures to protect sensitive consumer data can constitute an unfair practice, and false or misleading privacy policy statements are deceptive.

The Gramm-Leach-Bliley Act (GLBA) (15 U.S.C. § 6801 et seq.) requires financial institutions to safeguard nonpublic personal information and provide privacy notices explaining information-sharing practices. The Health Insurance Portability and Accountability Act (HIPAA) (42 U.S.C. § 1320d et seq.) and its Privacy and Security Rules protect individually identifiable health information held by covered entities (health plans, healthcare clearinghouses, and certain providers) and their business associates. HIPAA requires breach notification to affected individuals and to the Department of Health and Human Services.

The Children's Online Privacy Protection Act (COPPA) (15 U.S.C. § 6501 et seq.) regulates the collection of personal information from children under 13, requiring verifiable parental consent. Sector-specific statutes protect video rental history (Video Privacy Protection Act, 18 U.S.C. § 2710), education records (Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g), and telecommunications subscriber information (Telecommunications Act Section 222, 47 U.S.C. § 222).

State data breach notification laws exist in all 50 states, the District of Columbia, and U.S. territories. While details vary, these laws generally require companies to notify affected residents when personal information—typically including Social Security numbers, driver's license numbers, financial account numbers, and health or biometric data—is acquired by an unauthorized person. Notification must typically occur without unreasonable delay, often within 30 to 90 days of discovering the breach. Many states also require notification to the state attorney general when breaches exceed a certain threshold number of residents.

State comprehensive privacy laws, beginning with California's CCPA in 2020, grant consumers rights to access, delete, correct, and opt out of the sale or sharing of their personal information. The CCPA applies to for-profit businesses that meet revenue or data-processing thresholds and do business in California. It includes a limited private right of action for data breaches involving unencrypted or un-redacted personal information, allowing consumers to recover statutory damages of $100 to $750 per incident or actual damages, whichever is greater. Other states, including Virginia (Consumer Data Protection Act), Colorado (Colorado Privacy Act), Connecticut (Data Privacy Act), and Utah (Consumer Privacy Act), have enacted similar laws, most without private rights of action, relying instead on enforcement by state attorneys general.

The Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/, is one of the most stringent state privacy laws and has generated substantial litigation. BIPA requires private entities that collect biometric identifiers—fingerprints, retina or iris scans, voiceprints, face geometry—to inform individuals in writing of the purpose and duration of collection, obtain written consent, publish retention schedules and destruction guidelines, and protect biometric data with the same or greater care as other confidential information. BIPA provides a private right of action, allowing individuals to sue for negligent violations ($1,000 per violation) or intentional or reckless violations ($5,000 per violation), plus injunctive relief and attorney's fees.

How do regulators enforce data privacy laws?

The Federal Trade Commission is the primary federal enforcer of consumer privacy. The FTC investigates complaints, conducts its own investigations, and brings administrative and federal court actions under Section 5 of the FTC Act. Consent orders resulting from FTC enforcement actions often require companies to implement comprehensive information security programs, submit to third-party audits for up to 20 years, provide notice of future breaches, and pay civil penalties. The FTC publishes enforcement actions, business guidance, and consumer education resources at ftc.gov/privacy-security.

The Department of Health and Human Services Office for Civil Rights (OCR) enforces HIPAA. OCR investigates complaints, conducts compliance reviews, and can impose civil monetary penalties for violations. Penalties range from $100 to $50,000 per violation, with an annual cap of $1.5 million per violation category. Breach reports and resolution agreements are published at hhs.gov/hipaa.

State attorneys general enforce state breach notification laws, unfair and deceptive practices statutes, and state privacy laws. Many states have dedicated privacy or data security units within the attorney general's office. AGs can bring civil actions seeking injunctive relief, civil penalties, and consumer restitution. Multi-state settlements, where attorneys general from several states coordinate enforcement, are common in major breach cases.

The California Privacy Protection Agency (CPPA), established by the CPRA, has rulemaking and enforcement authority over the CCPA. The CPPA can impose administrative fines of up to $2,500 per violation or $7,500 per intentional violation or violation involving minors' data.

How do data breach class action settlements typically work?

Data breach settlements generally fall into two categories: those requiring documented harm and those compensating exposure risk. Settlements requiring proof of harm allow claims for out-of-pocket expenses—credit monitoring services purchased by the claimant, bank fees for new accounts or cards, postage and notary costs, fraud losses not reimbursed by financial institutions—and lost time, often valued at a fixed hourly rate (such as $15 to $25 per hour), supported by a log of time spent addressing the breach.

Many settlements also include an alternative compensation track for class members who cannot document specific losses but whose information was compromised. These claimants may receive a nominal cash payment (often $25 to $100) or free credit monitoring or identity theft protection services for a term of years, such as two or three years of triple-bureau credit monitoring.

Claims typically require the breach notification letter, account statements or other proof that the claimant's information was included in the breach, receipts for reimbursable expenses, and a signed declaration or claim form. Some settlements use simplified claims for small amounts, requiring only the breach notice reference number and claimant contact information.

Settlement administrators send notice by direct mail to individuals whose addresses are in the breached data or the company's records, by email if the settlement class includes email addresses, and through publication (newspaper ads, banner ads, or dedicated settlement websites). Notice includes the case name and number, a summary of the settlement, the claim deadline (typically 60 to 120 days from initial notice), and instructions for filing online or by mail.

How can I verify that a data breach notice or settlement is legitimate?

Authentic data breach notifications and class action settlement notices are often the target of phishing attacks. Scammers send fake notices hoping recipients will click malicious links or provide personal information. Verify any breach notice by visiting the company's official website directly (do not click links in the email) and looking for a security or breach notification page. Legitimate companies post breach information prominently and provide contact details for questions.

For settlement notices, verify the case number on PACER at pacer.uscourts.gov for federal cases, or contact the court clerk's office for state cases. Check the settlement administrator's website; legitimate administrators use professional domains and do not request sensitive information beyond what is necessary to process the claim (such as mailing address or, if electronic payment is offered, account information submitted on a secure form).

State attorneys general maintain lists of data breaches reported under state notification laws. Many publish this information on their websites. For example, the California Attorney General posts a data breach report list at oag.ca.gov/privacy/databreach. The Identity Theft Resource Center (idtheftcenter.org) and Privacy Rights Clearinghouse track publicly reported breaches.

Never provide payment, wire money, or share login credentials in response to a breach notice or settlement claim form. Legitimate settlements do not require upfront fees, and claim forms never ask for passwords or full account numbers beyond what is necessary to identify your account or issue payment.

Frequently Asked Questions

Learn more

To understand class actions generally, read What is a class action? and Settlements and claims. Browse other consumer categories at Categories, including Banking & Finance and Telecom & Internet.