When a company already holds your information, a privacy policy dispute letter is the dated record you send to that company. You use it if the posted policy does not match what the company actually did. You also use it when you want data deleted, corrected, or pulled out of a sale.
Got a chat transcript that went nowhere?
A letter is harder to shrug off than a ticket number, and it's the trail a regulator may ask for later if you have to escalate. Put the same facts on paper.
These steps are for people in the United States, where health records follow HIPAA and many California residents have extra tools under the CCPA. An EU company may still have to follow the GDPR. Those tracks do not swap.
A letter is not a lawsuit. It won't, by itself, mint a refund.
Sample privacy policy dispute letter
Copy the block below into your own file, replace every bracket, quote the policy line you actually saw, and stick to dates you can prove.
People sometimes paste a five-page legal brief into these letters, citing every statute they found in a late-night search, and then they wonder why a customer-service inbox never replies, because the person reading it needed dates, a screenshot, and one clear ask, not a treatise.
[Your name]
[Street address]
[City, State ZIP]
[Email]
[Phone]
[Date]
[Privacy officer, DPO, or "Privacy Team"]
[Company name]
[Company address]
Subject: Privacy policy dispute and request to access, delete, or stop selling my personal information
Dear [Name or Privacy Team]:
I am writing about personal information [Company] collected or received about me. You can identify my account with [email, member ID, or phone].
On [date], I learned that [plain facts: for example, my email was shared with a partner after I opted out]. Your privacy policy, as posted at [URL] on [date], states: "[short quote]."
That conduct does not match the language I quoted. I want it fixed.
Please:
- Tell me what personal information you hold about me, and the sources and sharing partners you used, if you are required to provide that.
- Delete the personal information you hold about me, except records you must keep.
- Stop selling or sharing my personal information, and honor any opt-out I already sent.
- Confirm in writing what you did, by [date you choose].
Reach me at the email and address above. Do not use this letter to start new marketing mail.
Sincerely,
[Your name]
Keep the tone specific. Insults slow this down.
What to gather before you send it
The emails and the policy screenshot need to be saved. If you don't save the emails and the policy screenshot, you'll be arguing from memory.
Use this list, then send:
- [ ] Full-page screenshot of the privacy policy, with the date or URL visible
- [ ] Account email, member ID, or phone number the company uses
- [ ] Dates of the incident, and how you found out
- [ ] App notices, consent screens, or bounce-back emails
- [ ] One primary ask (access, deletion, correction, or opt-out)
- [ ] A copy of the signed letter you actually sent
Pick a sending method that leaves you a receipt if the stakes are high. Keep the PDF.
Where this letter should go
Turns out the generic privacy@ address is not always the door that matters.
Look at the policy page first, because many companies list a privacy officer, a web form, or a mailing address you should use before you try a catch-all inbox. Use the privacy contact they list. If the policy is silent, the customer-support address is a start, not the whole plan.
| Kind of data | Start with | If that fails |
|---|---|---|
| Ordinary U.S. consumer account data | Privacy contact on the company's policy page | Your state attorney general; a report to the FTC if the policy looks deceptive |
| California resident data, including data-broker listings | The business's request form, then California's DROP tool for brokers | California Privacy Protection Agency or the California Attorney General CCPA page |
| Health information at a provider, health plan, or clearinghouse | That organization's privacy officer | HHS Office for Civil Rights |
Don't mix those inboxes. A clinic complaint does not belong at a data-broker portal.
If you are a California consumer
The California Consumer Privacy Act is a statute, not a courtesy. It can give you a right to know what a covered business collected, to ask for deletion or correction, and to opt out of the sale or sharing of personal information.
A global privacy control in your browser can count as an opt-out request. The business should not ask you to opt back in for at least 12 months.
Covered businesses must confirm they received a request to know, delete, or correct within 10 business days, according to the CPPA FAQ. That confirmation is not the same thing as finishing the job.
Data brokers are a separate mess. California's Delete Request and Opt-out Platform (DROP) is built for residents who want brokers to drop their information. You'll have to verify you are a California resident. Beginning August 1, 2026, those brokers must process deletion requests at least once every 45 days.
Stop and read the attorney general's page before you threaten a lawsuit.
California says you first give the business written notice of the CCPA sections you believe it violated, then allow 30 days for a written response that it has cured the problem. That cure notice is not a generic customer-service rant.
The private right to sue is also narrower than social posts claim. Don't treat the sample letter as a ticket to damages.
Health records and HIPAA complaints
Thing is, a HIPAA fight does not start at the front desk gift shop.
If a provider, health plan, or their vendor mishandled protected health information, you can still write that organization. The enforcement complaint goes to the U.S. Department of Health and Human Services, Office for Civil Rights. Anyone can file. OCR also takes complaints under 42 CFR Part 2, which covers certain substance use disorder records.
Work the file in this order:
- Write the covered entity's name, address, and role (clinic, plan, or clearinghouse). Add any vendor you know handled the records.
- List dates, what was disclosed or left unsecured, and how you learned of it.
- File through the OCR complaint portal, or follow the paper and email instructions on HHS's complaint-process page.
- If you email [email protected], HHS warns that unencrypted email can be intercepted. Do not dump extra medical detail into an open inbox if you can use the portal instead.
File as soon as you can. OCR prints the current filing window on its form. Don't wait for the clinic to "look into it" for months.
If an EU company holds your data
EU rules for individuals say the organization must answer access, correction, and erasure requests without undue delay, and at the latest within one month, or explain in writing why it will not. If that answer never comes, find the data protection authority for the country that supervises the company and lodge a complaint there.
If the company ignores you
To be honest, a lot of these files stall because the first letter named six demands and no evidence.
Give the deadline in your letter a few extra days. Then escalate on the track that matches the data. California consumers use the CPPA or the attorney general path above, health records go to OCR, and deceptive "we never share your data" claims can be reported to the FTC. An EU firm's silence goes to a data protection authority, not to a U.S. clinic form.
One tight follow-up with the original date is enough, then switch to the official form. Print the letter, attach the screenshots, mail or submit it, and put a reminder on your calendar for the date you asked them to answer.