Your Privacy Rights
Can You Sue a Data Broker? Your Real Options in 2026
The short version
Sometimes. There is no general right to sue a data broker for listing you, and 22 of the 23 state privacy laws are enforced only by attorneys general. You can sue under a few specific laws: the FCRA when a broker acts like a credit bureau and gets facts wrong, the CCPA after a breach, state right-of-publicity laws that power the class actions against people-search sites, and New Jersey's Daniel's Law if you are a covered public servant. Real payouts have been about $82 to $1,058 per person through class actions. For most people, opting out is faster than a lawsuit.
The short answer: yes, but only under specific laws
You can sue a data broker, but only when a specific statute hands you a "private right of action" - the legal term for the right to file your own lawsuit instead of waiting for a regulator to act. No law gives you a general right to sue a broker just for publishing your name, address, and relatives.
A people-search site can list your home address next to your children's names, and in most of the country that alone is not something you can take to court. The harm has to fit inside one of a handful of laws, each with its own rules about who qualifies, what you must prove, and what you can collect.
Why most privacy laws will not let you sue
As of June 2026, 23 states have enacted comprehensive consumer privacy laws by the IAPP's count, and every one of them except California's is enforced solely by the state attorney general. Even California's private right of action is limited to data breaches - not to a broker that ignores your deletion request.
The pattern held through 2026: Oklahoma, Alabama, Louisiana and Vermont all enacted privacy laws this year, and each expressly excludes a private right of action. Oregon's Department of Justice puts it plainly: "the privacy law does not include a private right of action."
The same goes for laws written specifically for data brokers. California's Delete Act, which created the DROP platform, fines a broker $200 per day for failing to register and $200 per deletion request per day for failing to delete. Those are administrative fines collected by the California Privacy Protection Agency, not damages paid to you. Vermont's and Texas's broker-registration laws are attorney-general-only as well.
If a broker ignores a request under one of these laws, your move is a complaint, not a lawsuit. See where to file a privacy complaint and our state-by-state deletion rights post.
The laws that do give you a right to sue
Five laws matter most for suing a data broker: the federal Fair Credit Reporting Act, the CCPA's breach provision, Illinois's biometric privacy act, state right-of-publicity statutes, and New Jersey's Daniel's Law. Each covers a narrow situation, but each sets fixed statutory damages, which is what makes a lawsuit possible without proving a dollar loss.
| Law | Who can sue | When | Damages per person |
|---|---|---|---|
| FCRA (15 U.S.C. 1681n, 1681o) | Anyone in the US | A consumer reporting agency reports you inaccurately or shares your file without a permissible purpose | Actual damages; $100 to $1,000 statutory for willful violations, plus punitive damages and attorney fees |
| CCPA (Cal. Civ. Code 1798.150) | California residents | Your unencrypted data is stolen because the business failed to keep reasonable security | $107 to $799 per incident or actual damages, whichever is greater |
| Illinois BIPA | Illinois residents | Your face, fingerprint or voiceprint is collected without written consent | $1,000 per negligent violation, $5,000 per intentional one, plus fees |
| Illinois Right of Publicity Act | Illinois residents (Ohio, California, Indiana and others have similar laws) | Your name or likeness is used to sell something without written consent | $1,000 or actual damages, whichever is greater |
| New Jersey Daniel's Law | Judges, prosecutors, police, child-protection investigators and household family | A site still shows your home address 10 business days after written notice | At least $1,000 per violation, plus fees; punitive damages if willful |
Sources: statute text via the Cornell Legal Information Institute, leginfo.legislature.ca.gov, ilga.gov, and N.J.S.A. 56:8-166.1 as quoted in the New Jersey Supreme Court's August 12, 2026 opinion. CCPA figures reflect the CPPA's inflation adjustment effective January 1, 2025.
Notice what is missing. None of these lets you sue simply because a broker compiled a profile of you from public records. The claim always needs a hook beyond "they have my data."
The FCRA: the strongest federal route, with a catch
The Fair Credit Reporting Act is the most powerful tool because it is federal, makes the loser pay attorney fees, and allows $100 to $1,000 in statutory damages per willful violation without proof of loss. The catch is that it only applies to a "consumer reporting agency," and nearly every people-search site says it is not one.
The most famous data-broker lawsuit in America was an FCRA case. Thomas Robins sued Spokeo after its profile listed the wrong age, marital status, wealth, education and profession, with a photo of someone else, while he was job hunting. In 2016 the Supreme Court used his case to rule that a plaintiff needs a "concrete" injury, not "a bare procedural violation" - a wrong zip code, the Court said, harms no one. On remand in 2017, the Ninth Circuit held that false statements about education and employment could do real harm and let the case proceed, though it only assumed Spokeo was covered by the FCRA.
The Supreme Court tightened the rule in TransUnion v. Ramirez (2021). TransUnion had flagged 8,185 people as possible matches to a terrorist watchlist. Only the 1,853 whose reports were actually sent to a business could collect; the rest got nothing, and a jury verdict of about $60 million was wiped out.
The lesson: an FCRA claim works when a wrong report was actually used against you. Those cases still settle - LexisNexis Risk Solutions agreed to a $13.5 million FCRA settlement, approved in March 2026, over reports that listed living people as deceased, with estimated payments of $150 to $1,000 per person. Our explainer on what the FCRA means for background checks covers which companies fall under the law.
How people actually won against people-search sites
The lawsuits that have paid real money to ordinary people were not privacy cases at all. They were right-of-publicity class actions arguing that when Whitepages or TruthFinder shows your name and details in a free "teaser" to sell a subscription, it is using your identity in an advertisement without your consent.
| Case | Sites | Settlement | Estimated payout per person |
|---|---|---|---|
| Butler v. Whitepages (N.D. Ill., 2022) | Whitepages.com | $4.07 million (Illinois and Ohio funds) | $125 to $245 in Illinois; $315 to $630 in Ohio |
| Fischer v. Instant Checkmate (N.D. Ill., approved 2024) | TruthFinder, Instant Checkmate, Intelius, US Search | $10.1 million across seven state funds | $82 to $1,058 depending on state; Illinois highest |
| Kellman v. Spokeo (N.D. Cal., proposed July 2026) | Spokeo.com | $10 million, pending court approval | Not yet published |
Sources: the court-filed settlement motion in Fischer v. Instant Checkmate and the official settlement sites whitepagesrightofpublicity.com and peopleconnectrightofpublicity.com; Spokeo figure per plaintiffs' counsel Morgan & Morgan, July 21, 2026.
Two details shape those numbers. The payment classes were narrow: in the PeopleConnect case you only qualified if someone searched your name and then bought a report. And Illinois residents received the most because each state's fund was sized as a share of its statutory damages, and Illinois sets $1,000 per violation.
The sites also agreed to change how previews display names and addresses, which arguably matters more than the checks. Our Spokeo profile and the wider data broker directory track what each site still shows.
Daniel's Law: the New Jersey experiment
Daniel's Law is the only US statute that lets individuals sue a data broker for at least $1,000 per violation simply for refusing to remove a home address. But only New Jersey judges, prosecutors, police officers, child-protection investigators and their household families can use it, and its fate is being decided in federal court right now.
In February 2024 a company called Atlas Data Privacy filed more than 140 lawsuits against data brokers on behalf of roughly 19,000 covered people who had assigned it their claims. The brokers argued the law violates the First Amendment. In late November 2024 Judge Harvey Bartle III refused to dismiss the cases, and the brokers appealed to the Third Circuit.
On August 12, 2026 the New Jersey Supreme Court answered a question the Third Circuit had sent it, holding unanimously that Daniel's Law "does not contain a mental state requirement" - a broker is liable even if it did not act carelessly. Whether that strict version survives the First Amendment is now back before the Third Circuit, and no damages award to Atlas has been made public.
It matters even if you are not a police officer, because Daniel's Law is the template other states are watching. If it survives, expect copies.
When the government sues instead
Regulators have hit data brokers harder than any individual ever has, but a government case rarely puts money in your pocket. The FTC's biggest people-search penalties - $21 million from MyLife in 2021, $5.8 million from TruthFinder and Instant Checkmate in 2023, $800,000 from Spokeo in 2012 - came through federal orders, and its recent location-data cases carried no fine.
The FTC sued the location broker Kochava in August 2022 and settled in May 2026 for a ten-year order restricting sales of sensitive location data, with no monetary penalty. Its 2024 orders against X-Mode (Outlogic) and InMarket were the same: bans, no money. That is partly by design - in 2021 the Supreme Court ruled in AMG Capital v. FTC that the agency's main litigation statute allows injunctions, not restitution.
The FTC only sends refunds when a case actually collects money, and none of those location orders included a redress fund. A complaint to the FTC, the CFPB or your state attorney general is still worth filing because it builds the record behind cases like MyLife. Just treat it as reporting, not a claim.
The honest odds for one person
For a single individual acting alone, the odds of collecting meaningful money from a data broker are poor. Statutory damages of $1,000 sound attractive until you weigh standing rules, deadlines, arbitration clauses, filing costs, and the chance that the company has no money. The realistic wins are class-action checks and, far more often, removal.
- Standing. After TransUnion, you generally need to show the data was actually shared or used against you.
- Deadlines. FCRA claims must be filed within two years of discovery and never more than five years after the violation. A federal court in Illinois held in 2022 that right-of-publicity claims against Ancestry had a one-year limit.
- Collectability. After the 2024 National Public Data breach, roughly 20 class actions were filed. The operator filed for Chapter 11 in October 2024 listing $39,225 in the bank and shut down that December. No one has been paid.
- Wins can unravel. The Clearview AI biometric settlement, valued at about $51.75 million in company equity, was approved in March 2025 and vacated by the Seventh Circuit in July 2026 for inadequate class representation.
The picture changes when you have concrete harm. If you lost a job over a false report, or were stalked using a broker listing, talk to a consumer-protection lawyer; the FCRA and Daniel's Law shift attorney fees, so many take strong cases on contingency. Brokers have owed a legal duty of care since 2003, when the New Hampshire Supreme Court ruled against Docusearch in a wrongful-death case that settled for $85,000. Our post on data brokers and stalking safety covers what to document.
The arbitration trap
Most people-search sites' terms require individual arbitration and waive class actions, and you can accept those terms simply by creating an account to see what the site says about you. Neither Spokeo's nor PeopleConnect's terms claim to bind people who never used the site, but the account trap has already changed the course of one case.
Spokeo's terms say you accept them "by creating an account or by accessing or using Spokeo.com in any manner" and that both sides "waive the right to sue in court, to trial by jury, and to bring or participate in class actions." PeopleConnect's terms, covering TruthFinder, Instant Checkmate, Intelius and US Search, require "final and binding arbitration on an individual basis."
In Knapke v. PeopleConnect (2022), a plaintiff's lawyer created a Classmates.com account to gather evidence and accepted the arbitration clause in the process; the Ninth Circuit sent the case back to decide whether that click bound the client. The practical rule: do not sign up for a broker's service to investigate it. Search yourself logged out and use the free opt-out flows.
What to do instead of (or before) suing
For almost everyone, the fastest way to reduce harm from a data broker is to remove the listing, not to litigate it. Every major people-search site has a free opt-out, California residents can reach more than 500 registered brokers with one DROP request, and documenting what you find preserves any claim you might later have.
- Find where you are listed. Search your name and city on the major sites, or run RedactZero's free exposure scan to see which brokers likely list you. Nothing you type is stored.
- Screenshot before you remove. Capture the listing with a visible date and URL. That is what a lawyer or a claim form will ask for.
- Opt out, site by site. Use the free, dated opt-out guides for the big people-search sites, and the opt-out directory for the marketing, credit and risk databases behind them.
- Use DROP if you live in California. Brokers have had to process requests since August 1, 2026; our California DROP guide walks through it.
- File a complaint. The CPPA for Delete Act violations, your state attorney general for state privacy laws, the CFPB or FTC for FCRA problems.
- Watch the open cases. If Spokeo's proposed settlement is approved, a claim window will open for residents of nine states. Check the official settlement website, not emails.
Then keep checking. Listings come back within months as brokers re-ingest public records, so removal is maintenance, and an optional monthly re-check can email you only when new exposure appears.
See what a search of you turns up
Run a free exposure scan to see which people-search sites and data brokers likely list you, plus any breaches tied to your email - no account, nothing stored.
Frequently asked questions
Can I sue a data broker just for publishing my address?
In most of the US, no. No federal law and no state privacy law gives you a general right to sue a broker for compiling and publishing a profile built from public records. You need a specific hook: a wrong report used against you (FCRA), a breach (CCPA in California), your name used in an ad (right of publicity), or protected status under New Jersey's Daniel's Law.
What is a private right of action?
It is the legal term for your right to file your own lawsuit under a statute, instead of waiting for a regulator such as a state attorney general to act. Most US privacy laws do not include one. Where a law does, it usually sets fixed statutory damages so you can sue without proving a dollar loss.
Can I sue a people-search site under the CCPA?
Only after a data breach. The CCPA's private right of action covers California residents whose unencrypted personal information is stolen because a business failed to keep reasonable security, with statutory damages of $107 to $799 per incident after the 2025 inflation adjustment. A broker that ignores your deletion request cannot be sued under the CCPA; that is enforced by the California Privacy Protection Agency.
How much money can you get from suing a data broker?
Statutory damages range from $100 to $1,000 per willful FCRA violation, $1,000 under Illinois's right-of-publicity law, and at least $1,000 per violation under Daniel's Law. In practice, class-action checks from people-search settlements have run from about $82 to $1,058 per person depending on the state, after attorney fees and administration costs.
Is there a class action against Spokeo or Whitepages I can join?
Whitepages settled Illinois and Ohio claims for about $4.07 million in 2022, and PeopleConnect (TruthFinder, Instant Checkmate, Intelius, US Search) paid $10.1 million across seven states in 2024; both claim periods have closed. Spokeo agreed to a proposed $10 million settlement in July 2026 covering nine states, which still needs court approval before any claim process opens.
Can I sue under the FCRA if a people-search site got my information wrong?
Possibly, but the site will argue it is not a consumer reporting agency and the FCRA does not apply. In Robins v. Spokeo, the Ninth Circuit let a claim proceed over a profile with the wrong age, education and job history, but the court only assumed Spokeo was covered by the FCRA without deciding it. You will also need to show the wrong report was actually used or shared, not just stored.
Does Daniel's Law apply to me?
Only if you are an active, former or retired judge, prosecutor, law enforcement officer, or child-protection investigator in New Jersey, or an immediate family member living in their household. Covered people can demand removal of their home address and unpublished phone number and sue for at least $1,000 per violation if a site keeps publishing it more than 10 business days after notice.
Will complaining to the FTC get me money?
Almost never directly. The FTC only issues refunds when a case actually collects money from the company, and its recent data-broker orders against Kochava, X-Mode and InMarket carried no monetary penalty at all. Complaints still matter because they build the record behind cases like the $21 million MyLife order, but treat them as reporting, not as a claim.
Sources: 15 U.S.C. 1681n-p (Cornell LII); Cal. Civ. Code 1798.150 and 1798.99.82 plus the CPPA's January 2025 CPI adjustment; 740 ILCS 14/20 and 765 ILCS 1075/40 (ilga.gov); Oregon DOJ privacy-law FAQ; IAPP (June 17, 2026) on the 23rd state privacy law; Spokeo v. Robins (2016) and Robins v. Spokeo (9th Cir. 2017); TransUnion v. Ramirez (2021); Knapke v. PeopleConnect (9th Cir. 2022); Atlas Data Privacy v. We Inform, N.J. Supreme Court (August 12, 2026) and the Third Circuit's September 2025 certification order; the Fischer v. Instant Checkmate settlement motion and the Whitepages and PeopleConnect settlement sites; Morgan & Morgan on the proposed Spokeo settlement (July 21, 2026); FTC releases on Spokeo, MyLife, TruthFinder / Instant Checkmate, X-Mode, InMarket and Kochava; AMG Capital v. FTC (2021); the Seventh Circuit's July 2026 Clearview AI ruling; The Record on National Public Data; Stanford CIS on Docusearch; Spokeo and PeopleConnect terms of use.