A strong U.S. privacy complaint connects a business promise to a dated event and a document or record. Save the exact policy language, describe what happened, and show why the conduct may conflict with a privacy right or consumer-protection rule.
The aim is clarity, not a giant evidence dump. Agencies decide whether they have jurisdiction and whether to act. They may not recover money or resolve a private dispute for you. This guide focuses on U.S. consumers, where complaint routes and privacy rights vary by state.
Start with the rule that actually applies
A privacy policy is evidence of what a business told customers. It is not, by itself, proof that the business broke a law.
The relevant rule may come from a state privacy law, a company promise, or a consumer-protection rule against misleading conduct. Your first task is to identify which one fits. Do not begin with a dramatic conclusion such as "the company sold my data" unless your records actually support that claim.
| Situation | Sensible starting point | Evidence that helps |
|---|---|---|
| A privacy statement appears inconsistent with what the business did | The business, the FTC, or a state consumer-protection office | The policy text, a dated account of events, and records showing the difference |
| You believe a California business violated a California consumer privacy right | CalPrivacy's complaint instructions | Business name, dates, the right involved, and screenshots or emails |
| A company ignored a privacy request about your own account | The company's privacy or support channel, followed by an agency complaint if appropriate | Your request, delivery record, identity verification, and the response or silence |
| You live in another state with a privacy law | The relevant state privacy office or attorney general | Proof of residence, the request, dates, and the business's response |
The policy quote is your anchor, not your verdict. A company may have changed its policy, used a separate notice, or relied on a consent choice that you missed.
Thing is, a technical trace usually shows that an event occurred. It may not prove intent, a sale, or the legal meaning of the event.
If you are relying on the GDPR or UK GDPR, use the relevant data protection authority instead of assuming a U.S. agency handles the matter. A U.S. complaint form does not automatically create a GDPR case.
Build your evidence file in six steps
Start before contacting an agency. A clean record is easier to review and harder to misunderstand.
- Preserve the policy. Save the policy page as a PDF and take a full-page screenshot. Record the URL, date, time, time zone, and whether you were signed in. If the policy later changes, keep both versions.
- Record the event. Write down what you did, what the business displayed, and what happened next. Include the device, app or website, and any relevant account or transaction reference.
- Capture the consent flow. Save the banner, settings screen, opt-out control, deletion form, or other screen connected to your complaint. Show the choices you made.
- Gather communications. Keep emails, chat transcripts, support tickets, automated replies, and delivery confirmations. Contact the business in writing if you can.
- Preserve technical records carefully. On your own device and account, browser developer tools can show cookies, network requests, and scripts loaded during a session. Save the original capture, then make a redacted copy for sharing.
- Create a short chronology. Number each file and connect it to a date in your timeline. A reviewer should be able to follow the story without opening every attachment.
A one-page timeline often does more work than a long argument. Keep the wording factual.
What to save, and what each item proves
| Evidence | What to capture | What it can establish |
|---|---|---|
| Privacy policy | Full page, URL, version date, and exact quote | What the business represented at the relevant time |
| Consent or settings screen | The choices shown and the choice you made | Whether an opt-in, opt-out, or rejection was available |
| Account records | Request forms, account notices, access or deletion messages | What you asked the business to do |
| Communications | Emails, chats, ticket numbers, and replies | Notice to the business and its response |
| Technical record | Network log, cookie list, or screen recording from your session | What your device observed during a specific interaction |
| Impact record | Unauthorized account activity, unwanted messages, or measurable loss | Why the issue mattered to you |
Turns out, the strongest file is usually a small file with context. Ten cropped screenshots without dates can be weaker than three complete captures tied to a clear timeline.
Keep an untouched original and work from a copy. Note the source, date, time zone, device, browser, and action that produced each file. Do not crop the original. A HAR file or screenshot can also contain cookies, account identifiers, or authentication tokens, so remove sensitive details from the copy before submitting it.
Do not access another person's account or collect data that does not belong to you. Evidence gathering should stay within your own account, device, and ordinary customer interactions.
How to describe technical evidence
Browser tools can help, but they are not magic. A network request may show that a request left your browser; it does not automatically prove that the company stored, sold, or profiled your information.
Describe the observation precisely. For example: "At 10:14 a.m. Eastern time, I selected the site's reject-all option. During the next page load, my browser recorded a request to [domain]." Then attach the relevant capture and explain why it appears inconsistent with the policy.
Avoid claims you cannot verify. Say "I observed a third-party request" rather than "the company sold my data" unless you have direct evidence of a sale.
A screen recording can preserve the sequence of clicks and responses. It should supplement, not replace, the original policy, messages, and technical record.
A complaint template you can adapt
Use a neutral subject line and keep the main explanation short. Put extra detail in a numbered evidence index.
Subject: Privacy concern involving [business name]
Business and website or app:
Account or transaction reference:
Policy URL and date viewed:
What the policy says:
[Quote the relevant language and identify the page.]
What happened:
[Describe your actions and the business's response in date order.]
Dates and times:
[Include the time zone where it matters.]
Privacy right or consumer-protection concern:
[State the concern without claiming more than your evidence shows.]
Steps taken with the business:
[Include contact dates, ticket numbers, and responses.]
Evidence attached:
E01 - Policy screenshot and PDF
E02 - Consent or settings screen
E03 - Email or support record
E04 - Technical capture
E05 - Timeline
What I am asking the recipient to review:
[For example, whether the stated policy matched the observed practice.]
Contact information:
[Provide only what the complaint route requires.]Redact passwords, full payment numbers, government identification numbers, and unrelated personal information. If a form requires identity verification, use its instructions rather than emailing sensitive documents to an unverified address.
Where to report a privacy complaint
Contacting the business first is often useful. It can correct a simple account mistake and creates a record showing when you raised the issue. It is not automatically a prerequisite for every complaint, so check the instructions for the route you choose.
| Route | When it may fit | What to expect |
|---|---|---|
| Business privacy or support channel | You need an explanation, access, deletion, or correction involving your account | The business may ask you to verify your identity and may provide a ticket number |
| FTC | You believe a business used a deceptive or unfair privacy representation | Submit through the FTC's ReportFraud portal. A report can inform enforcement work, but the FTC is not your personal lawyer |
| California privacy complaint | You believe a business violated your California consumer privacy rights | CalPrivacy's submission page asks for clear details, dates, the business, the right involved, and supporting proof |
| State consumer-protection office | The business or conduct falls within a state complaint route | Use USA.gov's state consumer directory to find the appropriate office; forms and powers differ |
CalPrivacy says you can choose whether to provide contact information when submitting a complaint. It also says the agency is not required to act and may choose whether to do so. That limit matters: filing a complaint is a request for review, not a guaranteed investigation, refund, deletion, or fine.
Two illustrative evidence patterns
Cookie-choice example. A policy says the site uses only essential cookies. You reject optional cookies, then save the consent screen and a network capture showing requests to named third-party domains during the next page load. That is a specific issue for review. It is not, by itself, proof that the business sold information or violated a particular law.
Deletion-request example. You submit a deletion request through the company's stated channel, save the confirmation, complete any reasonable identity check, and keep the final response. If the business later says it never received the request, your delivery record and ticket number directly address that explanation.
In both examples, the evidence shows the sequence. It does not ask the reviewer to take a conclusion on trust.
Common mistakes that weaken a complaint
| Mistake | Better approach |
|---|---|
| Using only the current policy | Preserve the version available when the event happened |
| Attaching a cropped screenshot with no context | Keep the full original and label a separate excerpt |
| Calling a network request a data sale | Describe the request and explain what remains unknown |
| Mixing GDPR, CCPA, and general U.S. claims | State your location and identify the specific route you are using |
| Sending every file you have | Number the relevant evidence and explain each item |
| Asking an agency to "make it right" | State the conduct you want reviewed and any remedy you are requesting |
To be honest, a reviewer may ignore a technically impressive file if the basic facts are buried. Put the business name, dates, policy quote, and requested review near the top.
Common questions
Is a screenshot enough to prove a privacy violation?
Usually not. A screenshot can show what appeared on your screen at one moment, but it may not show the policy version, your consent choice, or what happened afterward. Pair it with a timeline and related records.
Should I complain to the company before an agency?
It is usually sensible, especially for an account-specific request. Keep the contact factual and use the business's published privacy or support channel. Some complaint instructions specifically ask consumers to contact the involved business or person.
Can the FTC get my money back?
Do not treat an FTC report as a personal refund request. The FTC uses consumer reports to identify possible enforcement issues, while individual disputes may require a business request, state process, or professional advice.
What if the company never responds?
Keep the sent message, delivery confirmation, ticket number, and any automatic reply. Submit those records with your complaint and state exactly how long you waited. Do not invent a legal deadline if you have not verified one.
Do I need a lawyer to submit a complaint?
No, many complaint forms are designed for consumers to complete themselves. A lawyer may be useful for a large loss, a complicated data incident, or a potential private lawsuit, but the basic evidence-gathering steps remain the same.
Create one folder now. Put the policy snapshot, one-page timeline, business correspondence, and numbered evidence index inside it. Then choose the route that matches your location and claim, and send the shortest accurate version first.