Privacy & Data Questions
Privacy law decides who is allowed to see, keep, share, or record information about you — your medical records, your communications, your online accounts, and images of your body — and what you can actually do when someone crosses that line.
The problems in this area look different from each other but share a shape: information about you moved somewhere you never agreed it could go. A clinic discusses your condition where other patients can hear. A prescription you specifically asked be routed elsewhere is sent to the pharmacy where you work. A police department repeats an old incident to your employer. An ex posts an intimate video and the platform does nothing. Someone gets into your email account, or a call appears to have come from your number when it did not.
The first thing to sort out is who enforces the rule you think was broken, because most privacy statutes are not something you can personally sue over. HIPAA is the clearest example. It is enforced by the federal Office for Civil Rights through complaints and penalties against the provider, and it gives individuals no right to bring their own lawsuit. It also reaches only covered entities — health care providers, health plans, clearinghouses, and their business associates. Your employer, a school, or the person who repeated what they overheard is usually outside it entirely. The federal student-records law works much the same way.
That does not leave you without options. The claims you personally own are almost always state-law claims: intrusion upon seclusion, public disclosure of private facts, breach of a medical provider's duty of confidentiality, negligence, and in many states a specific statute covering HIV status, mental health treatment, substance use records, or genetic information that carries its own remedy. The useful question is not "was that a HIPAA violation" but "which claim do I actually own, and against whom."
Recording and account access sit in their own layer. Federal wiretap law permits recording a conversation you are part of, but a significant minority of states require every participant to consent, and in those states the act of recording can itself be a crime. Getting into someone else's email or cloud account without authorization implicates federal computer-fraud and stored-communications law as well as state computer crime statutes, some of which give the account holder a civil remedy rather than leaving the matter to prosecutors. Claims built on spoofed calls or unauthorized logins usually rise or fall on carrier and provider records, which are retained only for limited periods — preserve them early.
Intimate images shared without consent are the area that has changed most recently, and it now works differently from the rest: there is a federal civil action against the person who disclosed the image, a federal criminal prohibition, a federal duty on platforms to remove reported images quickly, and separate laws in nearly every state. Elsewhere, state law diverges on which privacy torts a state recognizes at all, on recording consent, and on whether the state has a comprehensive consumer privacy statute giving you access, correction, and deletion rights against businesses holding your data — a growing but still incomplete list.
What to know
HIPAA gives you no lawsuit, and the complaint window is 180 days
You cannot sue a provider under HIPAA. You file a complaint with the HHS Office for Civil Rights, which investigates and can penalize the provider. The regulation requires the complaint be filed within 180 days of when the complainant knew or should have known the act or omission occurred, unless that limit is waived by the Secretary for good cause. That is short relative to most state-law deadlines, so file the complaint while you are still evaluating whether you also have a lawsuit. Remember the scope limit too: a clinic misrouting your prescriptions or discussing you in a hallway is within HIPAA; a coworker repeating what they heard is not.
45 C.F.R. § 160.306(b) (HIPAA complaint procedure) — source
The claim you can actually bring is a state-law claim
Because the federal health and student privacy laws give you no private lawsuit, the practical route is a state cause of action — invasion of privacy, breach of confidentiality by a provider, or a state statute protecting a specific category of information. These generally require that the information was genuinely private, that it went to someone with no legitimate need to know, and, for the public-disclosure branch in most states, that it reached more than a single listener. Not every state recognizes every branch of the privacy tort. Information about HIV status, mental health treatment, substance use, and sexual orientation is frequently protected more strictly than ordinary medical information, sometimes with damages that do not require proof of financial loss.
Recording rules are set by your state, not by the internet
Federal law does not bar recording a conversation you are a participant in, or one where a party has consented, so long as the recording is not made in order to commit a crime or a tort. But a number of states require every party to consent, and in those states recording your own phone call can be a criminal offense and can support a civil suit against you. Audio and silent video are commonly treated under different rules, and location matters — what is lawful on a public sidewalk is not lawful in a bathroom, a locker room, or a bedroom. Confirm the rule for your state and for the specific medium before you press record.
18 U.S.C. § 2511(2)(d) — source
A platform now has a legal duty to take down a nonconsensual intimate image
Under the TAKE IT DOWN Act, covered platforms — services that primarily provide a forum for user-generated content — must maintain a notice-and-removal process, and on receiving a valid request from the depicted person or an authorized representative must remove the depiction as soon as possible and no later than 48 hours, plus make reasonable efforts to identify and remove known identical copies. Platforms had one year from the May 19, 2025 enactment to have that process in place, and the Federal Trade Commission enforces it. The law covers digitally created and AI-altered images, not only real photographs. A valid request generally needs your signature, information sufficient to locate the material, a good-faith statement that it was not consensual, and your contact information — so "the platform won't do anything" is no longer the end of the road.
TAKE IT DOWN Act, Pub. L. No. 119-12, § 3 (May 19, 2025) — source
You can also sue the person who shared it
Separate from any platform obligation, federal law gives the depicted person a civil action against someone who discloses an intimate visual depiction knowing, or recklessly disregarding, that the person did not consent. The statute permits recovery of actual damages or liquidated damages of $150,000, plus the cost of the action and reasonable attorney's fees, and a guardian or representative may sue on behalf of a minor or an incapacitated or deceased person. There are exceptions, including good-faith disclosures to law enforcement or in legal proceedings. Most states have their own criminal and civil laws covering the same conduct, and the routes can be pursued together.
15 U.S.C. § 6851 — source
12 answered questions
Filter by state: