What these disputes involve
Data breaches and the question of what was actually exposed rather than what the notice letter summarized. Tracking technologies on websites and apps, including pixels and session recording, and whether visitors were told. Biometric information such as face or fingerprint scans, where several states have created specific rights that do not exist elsewhere. Sharing with advertising partners. And the recurring theme underneath all of it: whether the published privacy policy matched what the systems were actually doing. State privacy statutes differ from one another and do not line up neatly, so where the affected people are located matters as much as where the company is.
If your company received a claim or an inquiry
Suspend routine deletion first, because logs and vendor records are what everything else is reconstructed from. Then assemble the basic picture: what data, about whom, collected how, retained where, and shared with which vendors. Retrieve the privacy policy and terms as they were published over time rather than as they read today, since the version in effect when the data was collected is what gets compared against practice. Add data processing agreements, the incident timeline as recorded contemporaneously, and the cyber policy, which usually requires prompt notice. Keep the investigation organized from the start, because how it was conducted becomes a question of its own.
Two tracks that do not wait for each other
Private claims, often brought on behalf of a group, can proceed while a federal or state agency asks its own questions under its own procedures, and agencies differ considerably in how they open, resolve, and appeal these matters. An answer given quickly to one can complicate the other, which is the most common avoidable problem we see. Individuals who received a breach notice have a shorter list: freeze credit, keep records of anything that actually happened to you, and read class notices rather than discarding them. Time limits apply to all of it, and they are not the same from one state or one claim type to the next.
