Privacy policy disputes are proved by comparing a promise with an action. For a U.S. consumer, the most useful packet usually contains the exact notice version, a dated record of your interaction, and evidence connecting the business to the alleged collection or sharing.
A screenshot alone rarely settles the issue. You need context: which account or device was involved, what notice you saw, what permission you gave, and what happened afterward. This guide focuses on documenting that mismatch and choosing a complaint route. It isn't legal advice.
What a privacy policy dispute actually involves
A privacy policy is only one piece of the record. A cookie banner, app permission screen, account setting, marketing promise, terms of service, or contract may also matter.
Start by matching each question to the document that can answer it:
| Question | Useful record | What it may show |
|---|---|---|
| What did the business promise? | Privacy policy, cookie notice, app screen | The stated collection, use, or sharing practice |
| What did you choose? | Consent box, settings page, opt-out confirmation | The notice you saw and the action you took |
| What happened afterward? | Account export, company email, disclosure notice, device record | A possible collection, use, or disclosure event |
| Which terms applied? | Dated policy, change email, in-app notice | The version in effect at the relevant time |
| How should the dispute proceed? | Terms of service or contract | Possible notice, arbitration, or forum provisions |
The current policy may not be the relevant one. Businesses change notices, sometimes after the conduct being challenged.
A procedural clause can affect where a dispute is handled. It doesn't prove that the underlying privacy statement was true or false.
Build a dated evidence record
Don't wait for the business to replace the page or close your account. Save what you can while the details are fresh.
-
Save the exact notice. Capture the relevant text, page address, account context, and date. A PDF plus a screenshot is better than memory alone.
-
Preserve change notices. Keep emails, in-app messages, account alerts, and settings screens that show a policy or consent change. Save the older version if you have it.
-
Record your choices. Note whether you accepted, declined, changed a setting, opted out, or sent a Global Privacy Control signal. Keep confirmation pages and ticket numbers.
-
Document the event itself. Save the email, message, account notice, data export, or other record that made you suspect misuse. If you use technical records from your own device, obtain them lawfully.
-
Connect the evidence to your account. Keep an order number, account identifier, or relevant email address, but redact unrelated personal information before sending documents to anyone.
-
Write a simple timeline. List the date, event, source file, and unanswered question. Keep original files unchanged, then make a separate redacted copy for sharing.
Some records will be controlled by the business. Say that plainly in a complaint. Don't invent server logs or technical conclusions you can't support.
What different evidence can establish
Evidence answers different questions. A policy can show a promise, but it usually can't prove how the company implemented that promise.
| Evidence | What it can support | What it cannot prove by itself |
|---|---|---|
| Dated policy or notice | The wording shown to you | That the company followed or breached it |
| Consent or preference record | Your stated choice and the notice connected to it | That later data use matched the choice |
| Business response or data export | Categories of data, recipients, or explanations | Every external data transfer |
| Ad, message, or app behavior | A possible sign of targeting or use | Which data source caused it |
| Third-party document | A possible recipient or data flow | That the record relates to your account |
| Harm or impact records | Financial, account, or personal consequences | The underlying privacy violation |
Keep the raw files. Cropped screenshots can hide dates, URLs, or surrounding language.
Turns out, technical proof is often less dramatic than people expect. A dated email, a precise consent record, and a clear company response may be more useful than a guess based on one advertisement.
Seeing an ad after visiting a health or shopping page is a clue, not proof of a sale or named data transfer. Save the observation, but don't state more than the evidence shows.
A verified example: the GoodRx enforcement action
The FTC's action against GoodRx shows how a privacy dispute can be documented. In its GoodRx enforcement release, the FTC said GoodRx had promised since at least 2017 that it would not share personal health information with advertisers or other third parties.
The agency described a specific 2019 practice. GoodRx allegedly compiled lists of users who had purchased certain medications and uploaded email addresses, phone numbers, and mobile advertising IDs to Facebook so profiles could be identified.
The action included a $1.5 million monetary payment and restrictions aimed at stopping the use of health information for advertising. The example matters because it connects several evidence types:
- a written privacy promise;
- a particular data-sharing practice;
- identifiable information sent to a named recipient; and
- a timeline linking the conduct to the promise.
That is a stronger record than simply saying, "I saw a targeted ad." It also shows why consumers should separate an observed fact from a technical assumption.
Which complaint or legal route may apply
The right path depends on your location, the type of data, and what the business actually did. The CCPA, FTC enforcement, state privacy laws, and private lawsuits are not interchangeable.
California consumers
The California Attorney General's CCPA overview says the California Consumer Privacy Act gives consumers more control over personal information, while the CCPA regulations provide implementation guidance. The CPRA amendments have been in effect since January 1, 2023.
If your concern involves an opt-out of the sale or sharing of personal information, save the request and its confirmation. California recognizes a user-enabled Global Privacy Control as an opt-out signal in applicable situations. The Attorney General also says a business must wait at least 12 months before asking you to opt back in.
A policy mismatch isn't automatically a CCPA damages case. The CCPA's private right of action is generally associated with certain data-security breaches, while other conduct may be handled through agency enforcement or another legal theory.
If you are considering a CCPA lawsuit, California Attorney General guidance says you must first give the business written notice identifying the CCPA sections you believe were violated. The business gets 30 days to respond in writing that it cured the violation and will not commit another one. This step does not itself prove that a violation occurred.
You can also use the CalPrivacy complaint page. It asks for details such as the business name, dates, what happened, and the rights involved. The page specifically identifies screenshots and emails as useful supporting proof. CalPrivacy may choose to act, but it isn't required to investigate every complaint.
Federal and other state routes
The FTC can address deceptive or unfair business practices. Its consumer guidance on sharing personal information advises consumers to compare privacy protections, review notices about sharing, and customize the information they provide.
A regulatory complaint is a request for investigation. It isn't a court judgment, a guaranteed refund, or a finding that the business violated the law.
Outside California, use the privacy law and regulator for your own state. Deadlines, required notices, available damages, and private rights can differ. Don't assume California's 30-day process applies everywhere.
Contact the business without weakening your record
A factual written inquiry can produce a useful explanation and preserve a clear paper trail. For a California complaint, the CalPrivacy page also advises contacting the business, contractor, service provider, or other party involved.
Keep the message narrow. Identify the date, quote the relevant promise briefly, describe the event, and ask what happened. A simple version could read:
On [date], I saw a notice stating that [short description]. On [date], I [selected a setting, opted out, or submitted a request]. On [date], I received or observed [specific event]. Please explain what information was collected or shared, which policy version applied, and how my preference was handled. Please preserve records related to this account and request.
Save the sent message and the full response. Don't send a full medical record, government identification document, or unrelated account history unless it is necessary and the recipient has a secure process.
Common evidence mistakes
The current notice doesn't prove what an older notice said. An ad after a search doesn't identify the data source. Customer-service silence isn't an admission. A complaint receipt isn't a legal finding. A later policy rewrite isn't automatically a confession.
Thing is, a complaint can be credible and still contain gaps. Keep the imperfect screenshot, missing email, or partial timeline. Just label what is known, what is inferred, and what the business must supply.
Preserve evidence lawfully. Don't bypass access controls, enter another person's account, or try to obtain private server data.
The practical next step
Create one dated folder with four items: the policy version you saw, the current version, your supporting records, and a short timeline. Then make one clear written request to the business or the appropriate regulator.
Start with the promise that applied to you, not the policy currently displayed on the website.