Unauthorized Access to My Private Google Account and Stolen Data

Attorney Answer

You do have a claim you can file yourself — federal law gives you a private lawsuit against whoever got into your accounts. What you don't have yet is one unified case: the record mixes several distinct issues (being blocked from seeing your own account activity, repeated PUK-code phone lockouts, past "legal takedowns" you couldn't view, and ongoing harassment), and each needs its own track.

Unauthorized access to your email and Google accounts is not something you can only report to the police. Under the Stored Communications Act, 18 U.S.C. § 2701(a), it is unlawful to intentionally access without authorization a facility through which an electronic communication service is provided and thereby obtain a communication in electronic storage — which is what happens when someone gets into your email. 18 U.S.C. § 2707(a) then lets any "subscriber, or other person aggrieved" bring a civil action against the person who did it, and § 2707(b)–(c) allows equitable relief, attorney's fees, and damages of no less than $1,000. The Computer Fraud and Abuse Act, 18 U.S.C. § 1030(g), gives you a second private action, though only if the conduct meets one of the thresholds in 18 U.S.C. § 1030(c)(4)(A)(i) — most commonly at least $5,000 in loss over a one-year period. A police report is still worth filing; it is just not your only route.

Watch the deadlines, because the federal ones are the short ones. Both 18 U.S.C. § 2707(f) and 18 U.S.C. § 1030(g) require suit within two years — under the Stored Communications Act, two years from when you first discovered or had a reasonable opportunity to discover the violation. Separately, Washington's general three-year limitations period for injury to personal property (RCW 4.16.080) applies to state-law civil claims arising from this kind of ongoing interference with your accounts and data.

What you can do:

1. Request your account activity and security logs directly from the account provider (through its security checkup and account activity tools) to build a documented timeline.

2. File a formal Trust & Safety/abuse report with the account provider describing the unauthorized access and harassment, and ask what records they can release to you.

3. If you suspect identity theft, file a report at identitytheft.gov (FTC) — this creates an official record and a recovery plan.

4. Consult a privacy or cyber-law attorney about a Stored Communications Act claim under 18 U.S.C. § 2707 and a Computer Fraud and Abuse Act claim under 18 U.S.C. § 1030(g) once you have documentation.

⏱ Time limits apply. The federal claims are the short ones: 18 U.S.C. § 2707(f) and 18 U.S.C. § 1030(g) each give you two years, while Washington's general tort statute of limitations is three years (RCW 4.16.080). Since these incidents span roughly six years, older incidents may already be time-barred, while recent, ongoing unauthorized access remains actionable — prioritize gathering evidence from the recent period, and have a local attorney confirm the exact deadlines for your situation promptly. Periods stated as of publication.