1. What Should You Do after Receiving a Privacy Claim?
Identify the document, delivery date, and response deadline before addressing the allegations. Consumer demands, court summonses, and regulatory inquiries require different responses. Settlement discussions do not automatically extend court deadlines or suspend reporting duties.
Check the Allegations before Making Admissions
Determine whether the claim concerns stolen records, website tracking, employee information, or a vendor’s disclosure. Compare the allegations with what the company collected, transmitted, or stored. An attorney can evaluate the response, possible challenges to the complaint, and negotiation options.
Preserve Evidence before Changing Systems
When litigation is reasonably anticipated, take reasonable steps to preserve relevant information. Identify expiring logs, website configurations, consent records, and employee communications. Document security changes while retaining evidence of earlier settings. Electronic discovery planning should include cloud platforms and vendor-held records.
2. Which Privacy Claims Apply to Your Business?
Coverage depends on business activities, affected individuals, data categories, and alleged conduct. This page addresses California state-law claims, with federal law considered where applicable. The law governing liability and the court hearing the case are separate questions.
CCPA Coverage and Private Claims
A qualifying for-profit business generally must meet a revenue, data-volume, or data-sales threshold, alongside other statutory requirements. The adjusted annual revenue threshold is $26,625,000, and the business must exceed it. Alternative thresholds and related-entity provisions mean revenue alone does not resolve coverage.
Civil Code §1798.150 permits private claims for specified security breaches caused by a failure to maintain reasonable security. Protected data categories are narrower than the CCPA’s general definition of personal information. Other CCPA violations generally involve government enforcement rather than private CCPA lawsuits.
Tracking Claims and Industry Rules
Tracking claims require review of the statutory provision, information transmitted, consent, and third-party involvement. Changes affecting certain website and app pen-register claims require attention to operative dates and pending-case provisions. They do not eliminate every tracking claim.
HIPAA applies to covered entities and business associates, not every company handling health-related information. Other federal laws require their own coverage analysis. GDPR warrants review when the matter has an actual European territorial connection.
Court Jurisdiction and Early Challenges
Federal-question jurisdiction, diversity, or the Class Action Fairness Act may support federal jurisdiction if their requirements are met. Federal courts can hear state-law claims; that does not create a nationwide negligence standard.
Article III standing concerns federal jurisdiction. Whether a complaint states a legally sufficient claim is a separate inquiry. Multidistrict litigation coordinates qualifying federal cases for pretrial proceedings rather than creating jurisdiction.
3. Assessing Liability, Damages, and Defense Costs
Separate potential liability, available remedies, and defense expenses before deciding how much to spend on litigation or settlement. A demand amount establishes none of these. The company’s records should drive the assessment.
Match Allegations to Evidence
| Issue | Records to Review | What They Help Establish |
|---|---|---|
| Access or disclosure | Logs, forensic findings, transfer records | Which information was accessed or disclosed |
| Security practices | Risk assessments, patch records, access controls | Whether safeguards matched the data and risks |
| Consent and tracking | Banner versions, consent logs, tag settings | What users encountered before transmission |
| Vendor involvement | Agreements, incident notices, audit records | Contractual duties and possible responsibility |
Access or disclosure
- Records to ReviewLogs, forensic findings, transfer records
- What They Help EstablishWhich information was accessed or disclosed
Security practices
- Records to ReviewRisk assessments, patch records, access controls
- What They Help EstablishWhether safeguards matched the data and risks
Consent and tracking
- Records to ReviewBanner versions, consent logs, tag settings
- What They Help EstablishWhat users encountered before transmission
Vendor involvement
- Records to ReviewAgreements, incident notices, audit records
- What They Help EstablishContractual duties and possible responsibility
Negligence requires analysis of duty, breach, causation, and recoverable harm under the governing law. An incident alone does not establish each element. Class certification also requires proof beyond the complaint’s allegations.
Separate Damages from Settlement Values
For qualifying §1798.150 claims, the adjusted statutory range is $107–$799 per consumer per incident, or actual damages, whichever is greater. This is not a settlement schedule or a universal exposure cap. Government penalties, injunctions, and other claims require separate analysis.
Evaluate settlement against disputed liability, the proposed class, defense costs, and operational commitments. Class settlements generally require court approval.
Plan Costs by Stage
Discovery costs depend on data volume, custodians, inaccessible systems, privilege review, and expert work. Federal Rule 26 limits discovery through relevance and proportionality. Attorneys can propose phased production and challenge excessive requests.
Budget for initial motions, discovery, class certification, and trial preparation separately. Court schedules and disputed evidence affect timing; a fixed completion estimate may overlook substantial work.
4. Practical Pitfalls in Privacy Litigation
Early decisions can affect evidence, coverage, and regulatory exposure before a court decides liability. Coordinate remediation with legal review and required notices. Improving security does not automatically resolve an existing claim.
Understand the CCPA Notice Provision
Section 1798.150 generally requires 30 days’ written notice before a consumer seeks statutory damages. Its limited cure mechanism applies where cure is possible and requires an express written statement. Improving security after a breach does not itself cure that breach. Government enforcement follows different rules.
Review Vendor and Insurance Terms
A vendor’s involvement does not automatically remove the company’s obligations. Preserve the agreement and assess notice, cooperation, liability limits, and indemnification claims.
Review cyber insurance before retaining providers or committing to settlement. Coverage can depend on timely notice, approved professionals, exclusions, and consent requirements.
Avoid Assumptions about Privilege and Reporting
Hiring an attorney does not automatically make an audit or forensic report privileged. Its purpose, preparation, and distribution matter. Review disclosures before sharing investigative findings.
Mandatory breach notification differs from voluntary cooperation. A private settlement does not necessarily resolve an agency inquiry or eliminate notice obligations.
5. Frequently Asked Questions
System changes, customer agreements, and proposed settlement terms can raise additional questions while a privacy claim remains pending.
Potentially, but preserve relevant settings and records first. Document the change and its purpose. Removal does not establish past liability or automatically defeat the claim.
Not automatically. Enforceability depends on factors including notice, assent, scope, governing law, and requested relief. Preserve the terms the claimant encountered and evidence of acceptance.
Court approval, public filings, and class notice can limit confidentiality. Review those requirements before promising that settlement terms will remain private.
6. Discuss Your Data Privacy Litigation Response
Bring the demand or complaint, delivery records, incident timeline, relevant policies, vendor agreements, and insurance documents to the initial review. An attorney can assess deadlines, preservation needs, and defense options, then define the work required for negotiations, discovery, or parallel regulatory proceedings.
09 Feb, 2026
