Have you ever clicked an opt-out link only to watch a broken page spin forever? It happens all the time. You do have options when a company ignores its own posted privacy promises.
The United States has no broad federal statute that lets you automatically sue a website over a busted opt-out toggle. Still, a published policy remains a legal pledge. If a business promises never to sell your data but quietly offloads it to brokers anyway, federal and state regulators consider that an unfair or deceptive practice. You can hold them accountable.
Start with the Company's Privacy Point of Contact
Give the merchant a chance to fix the error before you contact government agencies. Regulators want to see that step first.
- Find the privacy contact. Head down to the site footer and open their privacy terms. Search for an email address designated for legal, compliance, or privacy requests.
- Quote the broken clause. Pull the exact line where they made the promise. Tell the team which section contains that language.
- Verify who you are safely. Provide your account handle or email address so they can pull your profile. Do not paste unencrypted passwords, identity card photos, or Social Security numbers into basic contact forms.
- Demand a written answer within a set window. Ask for a reply within 30 to 45 days. The California Consumer Privacy Act gives businesses 45 days to resolve verified consumer requests.
What to Do If You Get No Response
Thing is, customer service teams regularly misplace privacy emails or brush them off as everyday tech errors, which means your message can easily sit unread in some giant helpdesk queue while the days tick away, honestly going nowhere until you raise the stakes.
Wait until 30 days elapse, then send a formal escalation note. Keep strict records on your computer. Save a clean PDF of the privacy policy, write down the date of every outgoing message, and take full screenshots of any malfunctioning settings or broken links. Investigators need solid paper trails. Without clear timestamps and screenshots, state and federal staff cannot do much with your grievance.
Where to File Your Regulatory Complaint
| Agency | Jurisdiction | What It Investigates | Where to Submit |
|---|---|---|---|
| California Privacy Protection Agency (CPPA) | California consumers and businesses handling California resident data | Violations of CCPA rights, including failed opt-outs, missing disclosures, and refusal to delete data | CalPrivacy complaint portal |
| Federal Trade Commission (FTC) | Nationwide | Unfair or deceptive trade practices under Section 5 of the FTC Act | FTC privacy portal |
| State Attorney General | Your home state | Violations of state-specific consumer protection statutes or state privacy acts | Your state Attorney General consumer protection division |
Regulators do not act as personal lawyers for your individual account. They track recurring misconduct. When an organization promises strict data controls and quietly shares information with third parties anyway, the FTC can penalize them under Section 5.
The agency has previously penalized Facebook and GoodRx for misleading consumers over sensitive user and health data sharing. State attorneys general rely on local consumer fraud laws to pursue matching penalties. Your report adds to that enforcement pile.
Can You File a Lawsuit Over a Privacy Policy Breach?
Turns out, filing a private lawsuit over an unhonored privacy policy promise rarely works in court. Most opt-out glitches do not meet statutory requirements for civil litigation. You cannot sue under California law simply because a website ignored an opt-out toggle.
The CCPA reserves private lawsuits almost exclusively for security breaches where unencrypted sensitive personal data was stolen due to deficient safeguards. Ordinary policy failures do not qualify. Even when a real breach occurs, California AG CCPA guidance explains that you must give the company written notice and a 30-day window to cure the problem before filing. Agency complaints remain your strongest leverage.
Copy-and-Paste Complaint Template
Customize the template below and send it through email or certified postal mail.
To: [Company Privacy Team or Legal Department]
Subject: Formal Privacy Policy Grievance - [Your Full Name or Account ID]
I am writing to formally report a failure to comply with your published Privacy Policy.
1. Account Details:
Name: [Your Full Name]
Associated Email or Username: [Your Account Identifier]
2. The Policy Promise:
Your Privacy Policy dated [Policy Date or Version] states in Section [Number]: "[Quote the exact sentence from their policy]."
3. The Violation:
On [Date], I discovered that [explain exactly what happened, such as unpermitted data sharing, refusal of an opt-out, or failure to honor a deletion request within the statutory window].
4. Supporting Evidence:
I have attached records documenting this issue, including [list screenshots, timestamps, or previous email threads].
5. Requested Resolution:
Please confirm within 30 days that you have investigated this matter, updated my account records according to your policy, and ceased any unauthorized processing of my personal information.
If this matter is not addressed within 30 days, I intend to submit a formal complaint to the appropriate state and federal regulatory bodies, including the California Privacy Protection Agency and the FTC.
Sincerely,
[Your Name]
[Your Contact Information]What to Do Next
Save a copy of the company's active privacy policy right now. Websites frequently update their legal terms without notice during an active consumer dispute. Print a fresh PDF directly from your browser, making sure the current URL and timestamp appear across the header.
Deliver your written grievance immediately. Put a reminder on your calendar for 35 days out to verify their response. Do not wait on gathering screenshots.