What Is a Breach of Privacy? Understanding U.S. Privacy Rights

The American Privacy Architecture: A Sectoral Patchwork

In the European Union and many common law democracies, data privacy is governed by comprehensive, omnibus legislation—most notably the General Data Protection Regulation (GDPR)—that establishes uniform data rights across all commercial and public sectors.

By contrast, the United States legal framework lacks a single, all-encompassing national data privacy statute. Instead, privacy rights in the United States are defined by a complex, decentralized sectoral model. Different industries, data types, and jurisdictions are governed by distinct federal statutes, targeted state legislation, regulatory enforcement agencies (primarily the Federal Trade Commission), and state common law tort doctrines.

To determine whether an individual's privacy rights have been breached, one must analyze three primary questions:

1. Who committed the intrusion? (A governmental law enforcement actor vs. a private commercial corporation);
2. What category of information was compromised? (Healthcare records, consumer financial data, children's online activity, or general browsing telemetry); and
3. In which state does the affected individual reside?

Constitutional Privacy Rights: The Fourth Amendment Barrier

At the federal constitutional level, privacy rights protect citizens strictly against governmental overreach and state-sponsored surveillance. The Bill of Rights does not contain the literal word 'privacy,' but the United States Supreme Court has repeatedly held that constitutional liberties safeguard a vital sphere of personal autonomy.

The primary constitutional shield is the Fourth Amendment, which guarantees:

In the landmark precedent of Katz v. United States (389 U.S. 347, 1967), Justice John Marshall Harlan established the foundational Reasonable Expectation of Privacy Test:

1. The individual must have exhibited an actual (subjective) expectation of privacy; and
2. The expectation must be one that society is prepared to recognize as objectively reasonable.

In modern digital jurisprudence, the Supreme Court has extended Fourth Amendment protections to cellular location records (Carpenter v. United States, 138 S. Ct. 2206, 2018) and smartphone data (Riley v. California, 573 U.S. 373, 2014), mandating that law enforcement procure a judicial search warrant based on probable cause before searching personal digital devices.

Critical Limitation: The Fourth Amendment restricts only government agents (police officers, federal investigators, public school administrators). It provides zero constitutional protection against private tech corporations, employer monitoring, or commercial data brokers.

Major Federal Sectoral Privacy Statutes

Congress has enacted targeted, industry-specific statutes that establish strict data safeguarding obligations across critical commercial sectors:

1. Healthcare Privacy: HIPAA

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its Privacy and Security Rules strictly govern Protected Health Information (PHI). HIPAA applies exclusively to 'covered entities' (hospitals, doctors, pharmacies, health insurance plans) and their 'business associates.' It mandates administrative, physical, and technical safeguards, and requires patients to be notified of data breaches.

Common Misconception: HIPAA does not apply to consumer fitness tracking apps, direct-to-consumer DNA testing platforms, or general health blogs, as these entities are not covered healthcare providers.

2. Financial Privacy: The Gramm-Leach-Bliley Act (GLBA)

The Gramm-Leach-Bliley Act of 1999 requires financial institutions (banks, credit card lenders, mortgage brokers) to explain their information-sharing practices through annual privacy notices and grant consumers the right to opt-out of data sharing with non-affiliated third parties.

3. Children's Online Privacy: COPPA

The Children's Online Privacy Protection Act of 1998 prohibits commercial websites and online services directed to children from collecting personal information from children under the age of 13 without verifiable parental consent.

The State Consumer Privacy Revolution

In the absence of a comprehensive federal consumer privacy law, individual states have stepped into the regulatory vacuum, fundamentally transforming corporate data governance.

The California Framework (CCPA and CPRA)

Enacted in 2018 and significantly expanded by the California Privacy Rights Act (CPRA) in 2020, the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.) established the nation's premier consumer privacy regime:

• Right to Know: Consumers can demand an accounting of the specific categories of personal information a business collects, uses, and sells.
• Right to Delete: Consumers can compel businesses to permanently erase their personal information from internal records and third-party vendors.
• Right to Opt-Out: Businesses must display a clear, conspicuous link titled 'Do Not Sell or Share My Personal Information,' allowing consumers to halt the commercial sharing of their data.
• Right to Correct: Consumers can compel businesses to correct inaccurate personal data.
• Private Right of Action for Data Breaches: If a business fails to maintain reasonable security practices resulting in the exfiltration or unauthorized access of sensitive personal data, California consumers can sue directly under Cal. Civ. Code § 1798.150 for statutory damages of up to $750 per consumer per incident, creating massive class-action exposure.

Following California's lead, more than fifteen states—including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and Florida (FDBR)—have enacted comprehensive consumer data privacy statutes, establishing a nationwide patchwork of compliance mandates.

Common Law Privacy Torts: Suing for Civil Privacy Invasions

Long before the advent of digital internet tracking, American common law recognized the right to be protected against private intrusions. In his celebrated 1960 California Law Review treatise, Dean William Prosser categorized common law invasion of privacy into four distinct civil torts, adopted in the Restatement (Second) of Torts:

1. Intrusion Upon Seclusion (§ 652B)

An intentional, physical or electronic intrusion into the private affairs or private space of an individual, where the intrusion would be highly offensive to a reasonable person.

• Examples: Installing unauthorized hidden video cameras in a private home, eavesdropping on private telephone calls, or hacking into a private email account.

2. Public Disclosure of Private Facts (§ 652D)

The public dissemination of private, non-newsworthy facts concerning an individual, where the disclosure would be highly offensive to a reasonable person and is not of legitimate public concern.

• Examples: Publishing an individual's private medical history, disclosing confidential intimate photographs (non-consensual imagery), or publicizing private financial insolvency details.

3. False Light Invasion of Privacy (§ 652E)

Publicly attributing to an individual false characteristics, beliefs, or actions that place them in a highly offensive false position in the public eye, even if the statement does not meet the strict technical standards of common law defamation.

4. Commercial Misappropriation of Name or Likeness (§ 652C)

The unauthorized commercial use of an individual's name, photograph, voice, or persona for commercial advantage or advertising purposes without their consent (the foundation of the modern 'Right of Publicity').

What to Do If Your Privacy Has Been Breached

If you discover that your personal records, sensitive communications, or confidential data have been compromised:

1. Document the Intrusion: Capture timestamped screenshots, preserve system audit logs, and download compromised files immediately.
2. Determine the Applicable Legal Channel: If the breach was committed by a healthcare provider, submit an administrative complaint to the HHS Office for Civil Rights; if committed by a financial institution, notify the Consumer Financial Protection Bureau (CFPB).
3. Exercise Statutory Consumer Rights: If you reside in California or an equivalent consumer privacy state, submit a formal verified consumer request demanding the deletion or cessation of data sharing.
4. Evaluate Civil Litigation Options: Consult a personal injury or privacy litigation attorney to determine whether the conduct supports a civil lawsuit for common law intrusion upon seclusion, statutory data breach damages, or breach of contract.

Related Legal Guides

For additional authoritative information regarding related United States legal principles, review our companion guides:

• [What Is the Fair Credit Reporting Act?](/consumer-law/fair-credit-reporting-act): Understand consumer credit privacy, background check rules, and dispute procedures under the FCRA.
• [What Is Probable Cause in U.S. Law?](/criminal-law/probable-cause): Explore Fourth Amendment search warrant requirements for cellular devices and digital records.
• [What Are Civil Rights in the United States?](/civil-rights/what-are-civil-rights): Learn how the Bill of Rights safeguards individual liberty and personal autonomy from state surveillance.
• [What Is the Americans with Disabilities Act?](/civil-rights/americans-with-disabilities-act): Understand statutory medical confidentiality protections in the workplace under the ADA.