Unauthorized Data Collection Lawyer

Websites, mobile apps, connected devices, employers, online platforms, and other businesses can collect significant amounts of information about the people who interact with them. Some of that collection is obvious, such as information a person enters into an online form. Other collection can occur quietly in the background through tracking software, device permissions, location services, analytics tools, and other technologies.

The fact that a company can technically collect information does not necessarily mean it has an unrestricted right to do so. Depending on the information involved, how it was obtained, what the individual was told, and the law that applies, collecting personal data without proper authorization, notice, or consent may raise significant privacy concerns and, in some circumstances, provide grounds for legal action.

Net Law Advocates represents individuals nationwide in matters involving the improper collection and use of personal information. Unauthorized data collection is one type of conduct addressed through the firm’s broader cyber law practice.

What Is Unauthorized Data Collection?

Unauthorized data collection generally refers to obtaining or recording information about an individual in a manner that may exceed the permission the person provided or violate applicable privacy protections.

Whether data collection is actually unauthorized is highly dependent on the circumstances. Some laws require specific forms of notice or consent before particular information can be collected. Others give consumers rights over certain categories of data or restrict how companies can obtain and process sensitive information.

An organization’s own representations can also matter. A company may tell users that it collects certain information for a particular purpose while its technology collects additional information or uses that data in ways users would not reasonably expect.

The central questions often include what information was collected, how the collection occurred, what the individual was told, what permission was provided, and what the organization subsequently did with the data.

Personal Information Can Be Collected Without a User Entering It

People commonly associate data collection with information they knowingly provide, such as a name, telephone number, email address, Social Security number, or payment information.

Digital technology makes it possible to collect much more.

Depending on the website, app, service, or device involved, companies may be able to collect or derive information concerning:

• Browsing and search activity
• Precise or approximate location
• IP addresses and device identifiers
• Pages viewed and links clicked
• Information entered into website forms
• Purchase and transaction activity
• App usage and device activity
• Health-related interests or information
• Communications and account activity
• Employment and workplace activity
• Biometric identifiers
• Behavioral information and user preferences

Some of this collection may occur automatically and without an individual realizing that the information is being recorded or transmitted.

The broader legal issues created by these practices are part of the firm’s work involving digital privacy violations, while this page focuses specifically on whether the initial collection of information was properly authorized.

How Websites and Apps Collect Data in the Background

A website does not need to ask a visitor to type information into a form to gather data about that person’s activity.

Cookies, tracking pixels, analytics scripts, software development kits, session-recording tools, advertising technology, and other code can automatically collect or transmit information when someone visits a website or uses an application.

Some technologies perform ordinary functions that users expect, such as keeping someone logged into an account or remembering items in a shopping cart. Others can be used to analyze behavior, measure advertising, build consumer profiles, or transmit information to outside companies.

The legal significance depends on the technology, the information collected, the disclosures provided to the user, the parties receiving the information, and applicable law.

The technical operation of cookies, pixels, session replay, and similar tools is addressed separately in the firm’s discussion of website tracking technologies. Broader collection of browsing behavior and activity across digital services may also implicate issues involving online tracking and privacy.

Consent Is More Complicated Than Clicking “Accept”

Many businesses use privacy policies, cookie banners, terms of service, app permissions, consent screens, and other disclosures to obtain permission for data collection.

Whether those measures establish legally sufficient consent can depend on what was disclosed and what actually occurred.

A consumer might agree to one type of collection without necessarily agreeing to every subsequent use of the information. Similarly, a disclosure that is vague, incomplete, misleading, or presented after collection has already occurred may raise different questions from a clear disclosure presented before data is collected.

Relevant issues can include:

• Whether the individual received notice before collection occurred
• Whether the notice accurately described the information being collected
• Whether affirmative consent was required
• Whether the person had a meaningful opportunity to make a choice
• Whether more information was collected than the individual authorized
• Whether data was collected for purposes different from those disclosed
• Whether consent could legally be obtained in the manner the company used

Consent requirements vary significantly depending on the type of information and the governing law. The presence of an “I agree” button therefore does not necessarily answer every question about the legality of the underlying data collection.

Sensitive Data Can Be Subject to Greater Protections

The type of information being collected can materially change the legal analysis.

Precise location data, health information, financial information, biometric identifiers, children’s information, and other sensitive categories can implicate protections beyond those applicable to ordinary consumer information.

Recent federal privacy enforcement demonstrates the significance of this distinction. In 2026, the Federal Trade Commission finalized an order resolving allegations that General Motors and OnStar collected precise geolocation and driving-behavior data without adequately notifying consumers or obtaining affirmative consent. The order includes requirements concerning consent, access, deletion, and certain data collection and sharing practices. The FTC has also pursued data brokers over the collection and sale of sensitive location information.

Biometric information raises additional concerns because fingerprints, facial geometry, voiceprints, and similar identifiers can be subject to specific statutory requirements. Net Law Advocates addresses those issues separately through its biometric privacy practice.

Data Collection and Data Sharing Are Different Issues

It is important to distinguish between collecting information and disclosing it.

A company might improperly collect information even if it never sends that information to another organization. Conversely, information may have been collected lawfully but later disclosed, sold, or transferred in a manner that raises separate privacy concerns.

That distinction matters when evaluating what happened to someone’s data.

For example, an investigation may need to determine whether a company had authority to collect a user’s location information in the first place and, separately, whether it was permitted to provide that information to advertisers, data brokers, analytics providers, or other third parties.

Potentially improper disclosure of information is addressed more specifically through the firm’s coverage of data sharing without consent.

Unauthorized Collection in the Workplace

Employees can also be subject to extensive digital data collection.

Employers may use software and connected devices to record computer activity, internet use, location, communications, productivity measurements, access logs, or other workplace behavior. Some employers also collect fingerprints or other biometric information for timekeeping and access-control systems.

Workplace monitoring is not automatically unlawful. The legal analysis can depend on the type of technology, information being collected, state law, employer disclosures, employee consent, and whether personal devices or accounts are involved.

Because monitoring itself presents issues beyond the initial collection of information, the firm’s employee electronic monitoring content addresses workplace surveillance in greater detail.

Mobile Devices Can Reveal Particularly Sensitive Information

Smartphones and mobile applications can generate information about an individual throughout the day.

Depending on permissions and app functionality, this can include precise location, device identifiers, contacts, photographs, microphone or camera access, browsing behavior, purchasing activity, and interactions within an application.

Location information can be particularly revealing because a history of someone’s movements may disclose visits to medical facilities, religious institutions, workplaces, residences, and other sensitive locations. In a 2026 settlement, the FTC moved to prohibit data broker Kochava and a subsidiary from selling or sharing sensitive location data without affirmative express consent after alleging that location data from mobile devices could reveal consumers’ movements to sensitive places.

Issues involving information collected through smartphones and applications are examined more specifically in the firm’s app and mobile privacy content.

Does Unauthorized Data Collection Give You the Right to Sue?

Not necessarily.

The United States has a patchwork of federal and state privacy laws rather than a single law governing all collection of personal information. States continue to enact and consider laws regulating how businesses collect, use, and disclose consumer data, and the protections and enforcement mechanisms vary considerably.

One particularly important distinction is whether the applicable law gives an individual the right to bring a lawsuit.

Many privacy requirements are enforced primarily by government agencies rather than through private lawsuits. Even among comprehensive state consumer privacy laws, private rights of action are limited; NCSL notes that California’s comprehensive law provides a private right of action only in specified security-incident circumstances.

Other statutes governing particular categories of information or conduct may provide different remedies.

Determining whether someone has a viable claim therefore requires identifying the applicable law and examining the specific collection practice, information involved, consent or disclosures provided, jurisdiction, and any legally recognized harm.

How Can You Tell What Information a Company Collected?

One of the difficulties with unauthorized data collection is that the individual may not be able to see what is happening behind a website, app, device, or online service.

Sometimes a privacy concern becomes apparent after receiving a notice, reviewing account settings, seeing an unexpected permission request, discovering information held by a company, or learning that a business has been investigated for its data practices.

Other situations require a more technical examination.

Useful evidence can include:

• Privacy policies and terms that applied when the information was collected
• Consent screens and cookie notices
• Screenshots of websites or applications
• App permissions and privacy settings
• Emails or other communications from the company
• Requests to access or delete personal information
• Account records
• Employment policies or monitoring notices
• Information identifying third-party tracking or analytics providers

In litigation, additional technical and corporate evidence may help establish what information was collected, how it was collected, and what happened to it afterward.

Unauthorized Collection Can Lead to Other Privacy Problems

Collection is often only the beginning of the data lifecycle.

Once an organization possesses personal information, that information may be analyzed, combined with other datasets, used to create profiles, shared with vendors, sold to third parties, retained for long periods, or exposed during a security incident.

Those later events can create separate legal questions.

If personal information is exposed because of inadequate security, the incident may fall within the firm’s data breach litigation practice. If compromised information is then used to impersonate someone, access financial accounts, or commit fraud, the resulting harm may also involve identity theft.

Understanding how the information was originally obtained can therefore be an important part of determining how a larger privacy or cybersecurity incident developed.

Speak With Net Law Advocates About Unauthorized Data Collection

Individuals often have little visibility into the technologies companies use to collect information about them. Discovering that an organization obtained sensitive information without expected notice or authorization can raise legitimate questions about how the data was collected, why it was collected, and what happened to it afterward.

Net Law Advocates represents plaintiffs nationwide in cyber and privacy matters. If you believe a company, employer, website, app, or other organization collected your personal information without proper authorization or consent, the firm can review the circumstances and help determine whether applicable law may provide a legal remedy.

Contact Net Law Advocates at 888-913-2318 for a free, confidential consultation.