A privacy complaint letter is a dated record of what went wrong with your data, what you already asked the company to do, and the specific fix you still want. Keep copies of everything you send.
These samples are starting points for U.S. consumers. They aren't legal advice and they don't create a right to payment. Did the company ignore a deletion request or keep sharing after you opted out?
You start with facts, dates, and one clear ask.
What this letter actually does
You put the company on notice in writing so there is a dated trail of the facts and the fix you asked for before a regulator gets involved. Email works.
Save the sent copy. Certified mail helps later if you talk to a regulator.
Thing is, a letter won't force a payout. The FTC and most state offices collect complaints to spot patterns. They may never send you a personal result.
Write the company first in most cases. California still expects you to contact the business first.
What to gather first
Don't start from memory.
Pull the live privacy policy, the email thread, and screenshots that show a date. You need the company's legal name, the date you saw the problem, and a short description of what they did with your data.
If you quoted a policy section, paste that exact line into your notes so you don't paraphrase it later and get it wrong. That's easy to do when you're annoyed.
Save PDFs when you can. Phone photos lose detail.
Tick these off before you type:
- Date you first saw the problem
- Exact website, app, retailer, or clinic
- What you already asked them to do, and when
- Their reply, or a note that they never replied
- The policy line or request confirmation you will quote
- Files you can attach without adding extra personal data
A letter you can send the company
Use this as a draft. Replace every bracket. Stay polite.
The FTC's sample customer complaint letter tells you to be polite, stick to the facts, and say what you want done.
[Your name]
[Mailing address]
[City, State ZIP]
[Email]
[Phone]
[Date]
[Company name]
[Privacy office or customer service address]
Subject: Privacy complaint about [account or order number]
Dear Privacy team:
I am writing about how you handled my personal information.
On [date], I [describe what happened in two or three sentences]. I have attached [screenshots, emails, or portal records].
Your privacy policy dated [date], in the section titled "[section name]", states "[quote the line]". On [date], I [opted out / asked you to delete my data / asked for a copy]. I have not received [a confirmation / a complete response / a stop to the sharing].
Please [delete my data / stop selling or sharing my personal information / send a written explanation of what was disclosed and to whom] by [a date two to four weeks from today]. Please confirm in writing.
If I do not receive a useful response by that date, I may file a complaint with the appropriate regulator. I am keeping a copy of this letter.
Sincerely,
[Your name]Don't attach your full Social Security number. Skip extra IDs you don't need.
Fill it in, then send it
- Use the company's legal name, not the app nickname.
- Write three sentences of facts, with dates first.
- Quote one policy line or one request confirmation, not five.
- Ask for one or two concrete fixes, such as deletion and written confirmation.
- Give them two to four weeks, and put that date on your calendar.
- Attach only the proof that shows the problem.
- Send the email (BCC yourself), and add a paper copy if the problem is serious.
- If the date passes with no real answer, file with the regulator that matches the facts.
Print the sent email or keep the certified-mail receipt. You'll want that packet later.
Deceptive privacy promises
If a company told you it does not sell personal information and then it did, that is the kind of story the FTC reviews as a possible deceptive practice. You can still send the company letter.
File a report if you want it on the federal record. Use the same facts. Skip statute numbers you copied from a forum.
The FTC does not typically pay you. The report still documents the pattern.
A subject line that stays factual:
Subject: Privacy complaint about data practices by [Company]California delete and opt-out requests
If you live in California and a covered business ignored a delete or opt-out request, write them first with the date you asked. Turns out many people skip that and go straight to the state.
CalPrivacy wants the business name, the dates, what happened, and which privacy rights you think were violated. You can describe screenshots. You can leave off your phone number. The office is not required to act on every complaint.
Don't put a dollar figure in the letter because a blog mentioned statutory damages. A lot of that talk is about a narrow security-breach claim, not an ignored banner.
This is enough for email:
Subject: Privacy rights request still open - [date of request]
I submitted a [delete / opt-out] request on [date] through [portal or email]. I have not received a complete response. Please finish the request and confirm in writing by [date].Health records
A clinic letter and an HHS filing are different tools. You can use both.
HHS explains how to file a health information privacy or security complaint, including HIPAA privacy, security, and breach-notification issues, and in some cases substance use disorder records.
The online form is on the OCR complaint portal. Mail is an option. Unencrypted email to the government can expose the same details you are trying to protect.
OCR looks at covered health plans, providers, clearinghouses, and their business associates. It is not a help desk for every wellness app.
If you write the clinic, stick to the date and what was disclosed. Say what you want them to do. Check the HHS page for who can file and how they want the form sent. Don't wait months if the records are still exposed.
When the company is in the EU or the UK
U.S. complaint routes do not become GDPR just because a website has a privacy policy. If an EU or UK organization holds your data, write their listed data protection officer, then use that country's authority.
Where each complaint actually goes
| Your situation | Write the company | Next filing |
|---|---|---|
| Deceptive privacy claim or spam after a promise | Yes | FTC |
| California delete or opt-out request ignored | Yes | CalPrivacy |
| Hospital or health plan mishandled records | Often useful | HHS OCR |
| EU or UK organization holding your data | DPO if listed | That country's data protection authority |
Those offices do not share one deadline. Read the form on the site you use.
The mistakes that stall a complaint
To be honest, the longest letters get ignored first. Staff skim.
Three tight paragraphs beat a five-page recap from a forum, which is how these letters balloon once someone pastes every chat log into the first email. Don't CC a stack of agencies on day one.
Send the company. Wait. Then file in the one office that matches the facts.
Don't put extra medical details or a full SSN in mail you cannot encrypt. If the account was taken over, change the passwords and lock the credit file before you polish the prose. The letter can wait a night. The account can't.
Send it, then wait
Pick one template, fill the brackets with dates you can prove, and send it to the privacy address on the company's site today. If two to four weeks pass with no real answer, open the matching regulator link above and attach the same packet.
That's the whole job.