If a company exposes, sells, misuses, or refuses to delete your personal information, this guide helps you document what happened, contact the company, choose a complaint route, and preserve options for further action. Use the checklist whenever you receive a breach notice, discover suspicious data use, or obtain a new response from the business.
Overview
A privacy complaint is a structured account of what happened, what information was involved, why you believe the company handled it improperly, and what resolution you want. It may concern a confirmed data breach, an unexplained account takeover, targeted advertising, data sharing, a refusal to honor a deletion request, inaccurate personal information, or a failure to respond to a privacy inquiry.
Start with the company because it may be able to secure the account, correct a record, explain its practices, or provide information about an incident. A regulator complaint can create an official record and may help identify a broader compliance issue, but it does not always provide individual compensation or resolve an urgent security problem. If you have suffered financial loss, identity theft, employment harm, stalking, or another serious consequence, consider legal advice in addition to a regulatory complaint.
Privacy rules depend on facts such as your location, the company's location, the type of information involved, the company's role, and the service's terms. Do not assume that a breach notice automatically proves a legal violation. Instead, describe verifiable facts, separate them from conclusions, and ask focused questions.
Checklist by scenario
After a data breach or security incident
- Save the breach notice, email headers if available, account alerts, and relevant screenshots.
- Record when you learned of the incident, what information the notice says may be involved, and which account or service is affected.
- Change the affected password and any reused passwords. Turn on multifactor authentication where available.
- Check account activity, payment accounts, credit files, and identity documents for signs of misuse. Contact the relevant provider through an official channel if you see suspicious activity.
- Ask the company what happened, when it discovered the incident, what information was involved, and what protective steps it recommends. Avoid sending unnecessary identity documents by email.
When a company may be selling, sharing, or misusing data
- Capture the privacy notice, consent screen, marketing message, cookie settings, or account settings that describe the practice.
- Record the date, product, device, account, and precise observation. For example, identify the unexpected message or disclosure rather than writing only “the company misused my data.”
- Review the company's privacy-request process and submit the request through the listed channel. Keep a copy of the request and any verification steps.
- State whether you are asking for access, correction, deletion, withdrawal of consent, an explanation, or an opt-out where that option applies.
When the company refuses to delete or correct information
- Save your original request, the company's acknowledgment, and its final response or lack of response.
- Ask the company to identify the information it retained, the reason for retention, and the specific policy or legal basis it relies on, if applicable.
- Do not repeatedly submit identical requests without organizing the timeline. A clear record is more useful than a long chain of frustrated messages.
- Check whether an appeal or review process is available before escalating outside the company.
Choosing a complaint route
| Situation | Possible route | What to prepare |
|---|---|---|
| General deceptive or unfair privacy conduct in the United States | A consumer-protection regulator or relevant state office | Company identity, timeline, representations made, evidence, and requested remedy |
| State-specific privacy rights or a local breach concern | The appropriate state privacy, consumer-protection, or attorney general complaint channel | Your state, company location if known, request history, notice, and supporting records |
| Personal data processing connected to the European Economic Area or another GDPR-style regime | The data protection authority with responsibility for your circumstances | Proof of residence or connection where requested, your company correspondence, and the relevant processing concern |
| Identity theft, account takeover, or payment fraud | Your bank, payment provider, account provider, and appropriate fraud-reporting channel | Transaction records, alerts, dates, unauthorized activity, and steps already taken |
This table is a starting point, not a jurisdiction determination. Use the regulator's official website to confirm its authority, online form, mailing address, language requirements, identity-verification rules, and document limits before submitting.
What to double-check before filing
Your incident timeline: Put events in date order: account creation, consent or request, discovery, notice, company contact, response, and any harm. Include time zones when they matter. Mark unknown dates as unknown rather than guessing.
The information involved: Distinguish contact details, login credentials, financial information, government identifiers, health information, location data, messages, photographs, or inferred profiles. Include only information you can support.
The company's identity: Confirm the legal or trading name, website, app, address, and any parent or processor named in the privacy notice. A regulator may need the correct entity to route the complaint.
Your requested outcome: Ask for a practical remedy, such as account security assistance, correction, deletion where available, an explanation of data sharing, confirmation that a request was processed, or instructions for obtaining relevant records. If you seek money for losses, list the loss and supporting documentation separately.
Evidence hygiene: Redact passwords, full payment-card numbers, authentication codes, and unrelated personal information. Keep original files in a secure folder and submit copies. Do not alter screenshots in a way that removes dates, URLs, or surrounding context.
Company notice template
You can adapt this short message:
Subject: Privacy concern and request for review
On [date], I learned that [brief description of the breach, disclosure, processing, or unanswered request]. The account or service involved is [service and account identifier, using only partial information]. The information potentially involved is [categories]. I previously contacted you on [dates], if applicable.
Please confirm what occurred, what information was involved, whether my request has been processed, and what steps are available to secure or correct my account. I request [specific remedy]. Please provide your written response through [secure channel] and identify any review or appeal process available.
Keep the message factual and avoid threats. A separate demand letter may be appropriate if you are pursuing a defined financial loss or pre-lawsuit remedy; see the complaint letter guide for a clear demand for resolution.
Common mistakes
- Using an unverified contact channel: Find the privacy contact through the company's official website or account settings. Be cautious with links in unexpected breach emails.
- Sending excessive sensitive data: Regulators and companies generally need enough information to identify the issue, not your complete identity file.
- Confusing a privacy complaint with an urgent security response: A complaint will not replace password changes, payment-provider contact, device checks, or account recovery.
- Filing everywhere at once: Multiple submissions can create inconsistent timelines. Start with the most relevant route, record the submission number, and add material updates.
- Assuming a regulator is your lawyer: A regulator may review conduct under its authority, but it may not represent you or recover your individual losses.
- Missing a deadline: Complaint and legal deadlines vary. If the issue involves substantial loss, discrimination, employment consequences, identity theft, or threatened litigation, obtain advice promptly.
For a broader escalation workflow, review how to file a complaint against a company and use the consumer complaint tracker to organize dates, evidence, and responses. If the incident began with a fraudulent seller or marketplace, the scam and online marketplace guide covers related reporting steps.
When to revisit
Return to this checklist whenever you receive a new breach notice, discover an additional affected account, receive a company response, or learn that the relevant privacy-request process has changed. Revisit it before submitting a regulator form so that your timeline, attachments, and requested remedy match.
It is also sensible to review your records after changing passwords, closing an account, moving to a new jurisdiction, or finding new suspicious activity. Update your incident log rather than replacing earlier notes. Keep copies of submission confirmations and follow-up messages in the same secure folder.
Your next action should be concrete: secure the account if risk is active, preserve the notice and timeline, send a focused company request, verify the correct complaint route, and calendar a follow-up date. If the company does not respond or the consequences are serious, consider affordable legal help or an attorney referral. A lawyer or qualified legal-aid provider can assess jurisdiction, deadlines, available remedies, and whether a privacy complaint should accompany a formal claim.
