If a company's privacy policy doesn't match how it collects or shares your data, you can report that mismatch to the business and then to a U.S. regulator. The right office depends on the data.

Health records follow a different path than a shopping app. Treat a bank login as a financial issue, not a California deletion request. A complaint is a consumer report, not a court case, and this page isn't legal advice.

So which office should you actually use?

What a privacy policy complaint can cover

A privacy policy is the company's own public statement about data. If that statement misleads people, federal consumer protection law can treat it as a deceptive practice.

California privacy rules sit in another bucket. They track rights such as access, deletion, and opting out of sale or sharing.

HIPAA is narrower still. It applies to protected health information held by health plans, most providers that bill electronically, and many of their vendors. The circle of covered entities is small. Your fight with a social app isn't a HIPAA case just because a post mentioned a clinic.

Thing is, one copied letter sent to five agencies often dies as the wrong office. Match the data type first.

This kind of filing doesn't guarantee you a refund or a fine paid to you. Some offices look for patterns across thousands of reports. Some may never contact you again.

Ask the company before you file

California's privacy office tells you to contact the business, contractor, third party, or service provider tied to the problem. Other agencies don't always require that first letter. Send it anyway. You'll want dates and a written reply.

Here's a simple order of work:

1. Copy the privacy policy language you relied on, and note the date you saw it.
2. Save screenshots, emails, cookie banners, account pages, and any deletion or opt-out request.
3. Write the company's privacy or support address. Name the product, what the policy said, and what actually happened.
4. Ask for a specific fix: stop the sharing, delete the data, correct the record, or explain the practice in writing.
5. Keep every reply, including auto-acks. If they go quiet, that silence is part of your file.

You end up with a folder of screenshots that includes the policy as it looked that Tuesday, the email where support said they "don't sell data," the ad that showed up anyway, and maybe a second screenshot because the first one cut off the date, which is the messy packet a reviewer can actually use.

You don't need fancy legal phrasing. Plain facts travel better.

You can borrow this structure:

Subject: Privacy policy problem - [account or order ID]

I used [product] on [date]. Your privacy policy said [quote the line].
What happened instead: [short facts].
I already asked for [deletion / opt-out / access] on [date].
Please fix this and confirm in writing.

Don't attach your Social Security number or extra medical detail unless a health complaint truly needs it.

Pick the office that matches the data

Use the row that fits.

A HIPAA packet sent to the FTC can waste a deadline. A shopping-app fight sent to HHS gets screened out.

How the main U.S. filings actually work

The FTC wants a clear story of deception: the promise in the policy versus the practice you saw. You file through the FTC's ReportFraud site. Staff use those reports to see whether a company is harming a lot of people. They don't promise you a personal case manager or a check.

CalPrivacy asks for the business name, dates, what happened, and which California privacy right you think was ignored. You can describe screenshots and emails. Contact information is optional. The office says it isn't required to act on every complaint.

Write like a chronology, not a rant.

Health information has a tighter clock. Under HHS complaint rules, anyone can file about the HIPAA Privacy, Security, and Breach Notification Rules, or about 42 CFR Part 2 substance use records. You generally need to file within 180 days of when you knew, or should have known, about the problem. Mark that date on your notes.

Use the OCR portal. You can also email completed forms to [email protected]. Unencrypted email can be intercepted. Name the covered entity or the vendor that handled the records. Stick to what happened, when, who was involved, and what information was affected.

Turns out the financial side is more of a two-way mailbox. A CFPB complaint is routed to the company. Companies generally respond in 15 days. You can review that response, and you have 60 days to leave feedback.

You get email updates and a status page. That process fits credit reports, cards, accounts, and similar products. It's a poor fit for a random mobile game.

State attorneys general run consumer protection shops. Many will take an online form at no fee. Some try to mediate, while others wait until a pile of similar reports shows a pattern. If your state has its own privacy statute, that office may be cleaner than a federal form.

After you click submit

Save the confirmation number. Watch the email you listed, including spam.

Don't expect a same-week verdict. HIPAA acknowledgments and CFPB routing are more structured than an FTC report. CalPrivacy may never say what it did.

Answer on the same thread if they ask for documents. Mixing new accusations into an old case just muddies it.

To be honest, many files go quiet after the confirmation email.

If the company retaliates after a HIPAA complaint, federal rules address intimidation against people who file. For other agencies, keep your own records. Talk to a lawyer if the dispute turns into a lawsuit. This page can't tell you whether to sue.

A second filing in the wrong place won't help.

What to do today

Open the policy page you actually saw and export the proof. Send the company a dated note, then use the matching row in the table above.

If the data is medical, start with the HHS complaint process and that 180-day window. California privacy rights go through CalPrivacy, while a national promised-one-thing story belongs at the FTC, and at the CFPB when the product is financial. Use those portals on purpose, not at random.