Consumer Data Privacy Rights Lawyer

Companies collect enormous amounts of information about consumers. A single business may possess a person’s name, contact information, purchase history, browsing activity, device identifiers, location information, financial details, and other data generated through everyday interactions.

Consumers increasingly have legal rights concerning what happens to that information.

Depending on where a person lives and which law applies, those rights may include the ability to learn what information a company has collected, obtain a copy, request deletion or correction, limit certain uses of sensitive information, or opt out of the sale or sharing of personal data.

Those protections are not uniform across the United States. Privacy laws vary significantly by state, and the existence of a privacy right does not necessarily mean an individual can file a lawsuit when that right is violated.

Net Law Advocates represents individuals nationwide in matters involving consumer privacy and other areas of cyber law.

What Are Consumer Data Privacy Rights?

Consumer data privacy rights give individuals a degree of control over personal information collected and used by businesses and other covered organizations.

Traditionally, consumers often had limited visibility into what happened to their information after providing it to a company. Modern privacy laws increasingly require qualifying businesses to disclose their data practices and provide consumers with specific rights concerning their information.

The exact rights depend on the applicable law, but they can include the ability to:

• Know whether a company is processing personal information
• Access personal information a company maintains
• Obtain a copy of certain information
• Request correction of inaccurate information
• Request deletion in qualifying circumstances
• Opt out of certain sales or sharing of personal information
• Limit certain uses of sensitive personal information
• Opt out of some forms of targeted advertising or profiling
• Appeal certain decisions involving privacy requests

Not every law provides every one of these rights, and exemptions can apply based on the business, consumer, type of information, or reason the information was collected.

The National Conference of State Legislatures tracks comprehensive consumer privacy legislation across the country and notes substantial differences among states in the rights provided and obligations imposed.

What Counts as Personal Data?

Privacy laws frequently define personal information broadly.

The concept is not limited to information such as a Social Security number or bank account number. Depending on the law, personal data can include information that identifies, relates to, describes, or can reasonably be linked with an individual or household.

That may encompass:

• Names and contact information
• Online identifiers
• IP addresses
• Device identifiers
• Browsing and search activity
• Purchase history
• Location information
• Financial information
• Employment information
• Certain health information
• Biometric information
• Information about interests or preferences
• Inferences created from other personal data

Definitions vary among laws, so information protected in one jurisdiction or context may be treated differently in another.

Digital activity can be particularly important because consumers may generate personal information without actively typing it into a form. Website tracking technologies and other digital tools can collect information as people browse websites and interact with online services.

The Right to Know What Information a Company Has Collected

One of the central principles of modern privacy law is transparency.

Depending on applicable law, consumers may have a right to ask a covered business what categories or specific pieces of personal information it maintains and how that information is being used.

For example, California’s Consumer Privacy Act, as amended by the California Privacy Rights Act, provides qualifying consumers with rights that include knowing about personal information businesses collect and how it is used and shared.

Access rights can help reveal information consumers otherwise might never know a company possessed.

A consumer might intentionally provide a retailer with an email address and shipping address but be unaware that the company also associates the account with browsing activity, device information, advertising data, or information received from outside sources.

Access rights can make some of those data relationships more visible.

Consumers May Have a Right to Delete Personal Information

Many comprehensive state privacy laws provide some form of deletion right.

That does not necessarily mean a consumer can require a company to erase every piece of information it possesses.

Businesses may be permitted to retain information for legally recognized reasons. Depending on the applicable law, exceptions can involve completing transactions, maintaining security, complying with legal obligations, exercising legal rights, or other permitted purposes.

The scope of deletion rights can also depend on where the information came from and why it is being retained.

A valid deletion request therefore may result in substantial information being removed without necessarily requiring the company to eliminate every record associated with the individual.

The Right to Correct Inaccurate Personal Data

Incorrect information can create consequences of its own.

Some state privacy laws allow consumers to request correction of inaccurate personal information maintained by covered businesses.

Accuracy can become particularly important when information is used to create profiles or make decisions affecting an individual. An incorrect address or contact detail may be relatively easy to identify, while inaccurate inferences or information received from another data source can be harder for a consumer to discover.

Correction rights provide one mechanism for addressing inaccurate information before it continues to be used or distributed.

Consumers May Be Able to Opt Out of Data Sales or Sharing

A person’s information can move through a complicated network of companies.

Businesses may interact with advertising platforms, analytics providers, data brokers, technology vendors, and other third parties. Depending on the applicable law and the nature of the transaction, consumers may have rights to opt out of certain sales, sharing, targeted advertising, or profiling.

California, for example, provides consumers with rights to opt out of the sale or sharing of personal information in circumstances covered by the CCPA.

Other state laws use different terminology and definitions.

This distinction matters because “selling” personal information does not always mean a company literally handed over a customer list in exchange for cash. Some privacy statutes define regulated transfers more broadly.

The underlying transfer of information may also raise separate concerns involving data sharing without consent.

Sensitive Personal Information Can Receive Additional Protection

Some information presents greater privacy risks because of what it can reveal about a person.

Depending on the applicable law, categories of sensitive information can include precise geolocation, racial or ethnic origin, religious beliefs, health information, sexual orientation, citizenship or immigration status, genetic information, biometric data, and certain financial or account information.

State laws differ considerably in how they define and regulate sensitive data.

Some require consent before certain processing occurs. Others provide consumers with rights to limit particular uses.

Biometric information presents its own legal issues because states have enacted laws specifically governing the collection and handling of fingerprints, facial geometry, voiceprints, and other biometric identifiers. Net Law Advocates addresses those protections separately through its biometric privacy practice.

Online Tracking Can Implicate Consumer Privacy Rights

Consumer privacy rights increasingly intersect with online advertising and tracking.

Websites and applications can use identifiers and tracking tools to observe user activity. Information from those interactions may then be used for analytics, advertising, profiling, personalization, or other purposes.

Some state privacy laws provide consumers with rights to opt out of certain targeted advertising or profiling practices.

This does not mean all online tracking violates consumer privacy laws. The analysis depends on the technology, information involved, applicable law, disclosures, consent mechanisms, and how the resulting information is used.

The broader practice of following consumer behavior across digital services is addressed in Net Law Advocates’ discussion of online tracking and privacy.

Privacy Rights Differ From State to State

The United States does not currently have one comprehensive federal consumer privacy law governing all personal data in the same way nationwide.

Instead, consumer privacy protections come from a combination of federal sector-specific laws, state comprehensive privacy statutes, state laws regulating particular technologies or information, consumer-protection laws, and other legal frameworks.

The state landscape has expanded substantially in recent years. According to NCSL’s consumer privacy legislation database, states have continued enacting comprehensive privacy legislation that gives consumers various rights concerning personal data while imposing obligations on covered businesses.

But those statutes are not interchangeable.

They can differ in:

• Which businesses are covered
• Which consumers receive protection
• What qualifies as personal or sensitive information
• Whether consent is required
• Which opt-out rights exist
• Whether businesses receive a period to cure violations
• Which government agency enforces the law
• Whether individuals can bring lawsuits

For consumers, where they live and which law applies can therefore be critical.

California Provides Some of the Country’s Broadest Consumer Privacy Rights

California is one of the most prominent examples of comprehensive state privacy regulation.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, provides qualifying California residents with rights that include knowing about personal information collected by businesses, deleting certain information, correcting inaccurate information, opting out of sale or sharing, and limiting certain uses of sensitive personal information.

California also established the California Privacy Protection Agency, which implements and enforces the state’s consumer privacy laws alongside enforcement authority held by the California Attorney General.

California is important to the national privacy landscape, but its law should not be treated as the rule for every consumer in the country. Other states have adopted different frameworks, definitions, exemptions, and enforcement provisions.

Having a Privacy Right Does Not Always Mean You Can Sue

This is one of the most important distinctions for consumers.

A law can give an individual a right while assigning enforcement authority primarily or entirely to a state attorney general or another government agency.

Many comprehensive state consumer privacy laws do not provide a broad private right of action allowing individuals to sue over every violation.

California illustrates the distinction. Although the CCPA gives consumers extensive privacy rights, its private right of action is much narrower and applies to certain security breaches involving specified categories of personal information under particular circumstances. The California Attorney General explains that consumers cannot sue businesses for most CCPA violations.

Other legal theories or statutes may sometimes apply even when a comprehensive privacy statute itself does not authorize an individual lawsuit.

Whether a person can bring a claim therefore requires more than identifying a privacy right. It requires determining what law applies, how that law is enforced, what conduct occurred, and whether the individual has a legally recognized cause of action.

Privacy Rights and Data Breach Rights Are Not the Same

A privacy violation does not require hackers to steal information.

A company might intentionally collect, use, track, or disclose personal information in a way that creates privacy concerns even though its computer systems were never breached.

A data breach generally involves unauthorized access to or exposure of information resulting from a security incident.

Privacy claims can instead arise from a company’s own practices.

The distinction matters because different laws, legal standards, and remedies may apply depending on whether the issue involves unauthorized collection, improper disclosure, digital tracking, inadequate security, or another form of data handling.

What Can Consumers Do to Exercise Their Privacy Rights?

The process depends on the company and applicable law.

Covered businesses may provide privacy-request forms, email addresses, account settings, toll-free numbers, or other methods for submitting requests.

Consumers making a privacy request may want to preserve documentation showing:

• When the request was submitted
• Which right was exercised
• Confirmation that the company received it
• The company’s response
• Any explanation for denying the request
• Follow-up communications
• Screenshots of relevant privacy controls or account settings

Businesses may need to verify the identity of someone making certain requests before releasing or deleting personal information.

Consumers should also distinguish between a company’s voluntary privacy options and rights specifically provided by law. A company may allow users to change a preference even when no statute requires it, while other controls may exist specifically because of state privacy requirements.

What If a Company Ignores or Denies a Privacy Request?

A denial does not automatically mean the company violated the law.

The business may not be covered by the relevant statute. The requested information may fall within an exemption. The company may need additional information to verify the consumer’s identity, or the particular right may not apply under the circumstances.

Some state laws also provide mechanisms for consumers to appeal denied privacy requests.

When a company appears to have failed to honor a legally required privacy right, available remedies depend on the law involved. A consumer may be able to submit a complaint to a state attorney general, privacy regulator, or another government agency even when the statute does not permit an individual lawsuit.

If the underlying conduct also involves unauthorized collection, disclosure, interception, a data breach, biometric information, or another independently regulated practice, additional legal issues may exist.

Consumer Privacy Rights Continue to Evolve

Consumer privacy law is developing rapidly.

New state laws continue to take effect, existing laws are amended, regulators issue new rules and guidance, and courts interpret how older laws apply to newer technologies.

That makes privacy rights highly dependent on both location and timing.

A practice that is subject to one set of requirements today may be governed differently after a new statute or regulation takes effect. Consumers evaluating a potential privacy issue should therefore rely on current law rather than assuming protections are identical nationwide.

For Net Law Advocates’ clients, this evolving landscape also means that identifying what happened to the information is only part of the analysis. The next question is which legal protections apply to that particular person and conduct.

Speak With Net Law Advocates About Your Data Privacy Rights

Consumer privacy disputes can involve several layers of law. The existence of a privacy right, the company’s obligation to honor it, and an individual’s ability to bring a lawsuit are separate questions.

Net Law Advocates represents plaintiffs nationwide in cyber and privacy matters. If you believe a company improperly collected, used, shared, or failed to protect your personal information, contact Net Law Advocates at 888-913-2318 to schedule a free, confidential consultation.