This article is for informational purposes only and does not constitute legal advice. If you believe a data broker has violated your rights, consult a qualified attorney in your state.
The Short Answer: It Depends
Finding your name, address, phone number, and family members listed on a people-search site feels like a violation. But can you actually sue over it? The honest answer is that it depends on the specific circumstances. Merely publishing information that was legally obtained from public records is generally protected activity in the United States. However, there are several important situations where data brokers do cross legal lines, and those situations can give you real grounds for a lawsuit.
When You Likely Cannot Sue
Data brokers typically collect information from public sources: voter registrations, property records, court filings, social media profiles, and commercially available databases. When a site like Spokeo, BeenVerified, or WhitePages aggregates this publicly available data and displays it, that activity is generally legal. Courts have consistently held that compiling and republishing public records does not, on its own, create liability. There is no broad federal privacy law in the U.S. that prevents companies from collecting and selling this type of information.
When You May Have Legal Grounds
FCRA Violations: Background Reports Used for Decisions About You
The Fair Credit Reporting Act (FCRA) is one of the strongest tools consumers have against data brokers. Under the FCRA, any company that sells reports used to make decisions about employment, housing, credit, or insurance qualifies as a “consumer reporting agency” and must follow strict rules: ensuring accuracy, screening who buys the data, and giving consumers the ability to dispute errors.
When data brokers ignore these requirements, they face serious consequences. In 2023, the FTC fined Instant Checkmate and TruthFinder a combined $5.8 million for selling background reports used in rental and employment screening without following FCRA requirements. These companies were marketing their reports in ways that invited FCRA-covered uses but failed to verify that buyers had a permissible purpose or to maintain reasonable accuracy standards.
If a data broker sold a report about you that was used in a credit, employment, tenant, or insurance decision, and the report contained errors or the broker failed to follow FCRA procedures, you may have grounds for a private lawsuit. The FCRA allows individual consumers to sue, and courts have awarded significant damages in these cases.
False or Inaccurate Information: Defamation Claims
If a data broker publishes materially false information about you, and that false information causes real harm, you may have a defamation claim. For example, if a people-search site incorrectly associates you with a criminal record that belongs to someone else, and this causes you to lose a job opportunity or suffer reputational damage, that could form the basis of a lawsuit. The key requirements are that the information must be provably false, it must have been published to third parties, and you must be able to show actual harm resulted from it.
State Privacy Laws with a Private Right of Action
Several states have enacted laws that give individuals the right to sue data brokers directly. One of the most notable is New Jersey’s Daniel’s Law, which protects judges, law enforcement officers, and their families by requiring data brokers to remove personal information within ten days of a takedown request. The law provides for $1,000 in damages per violation plus attorneys’ fees, and more than 140 lawsuits have been filed under it. A bipartisan group of 42 state attorneys general filed a brief supporting the constitutionality of this law when it was challenged.
Other states are following New Jersey’s lead with similar protections for public officials and, in some cases, broader populations. The legal landscape here is changing rapidly.
State Anti-Doxxing and Harassment Laws
A growing number of states have passed anti-doxxing statutes that can apply when someone’s personal information is published with the intent to harass, threaten, or intimidate. If a data broker’s publication of your information is connected to a pattern of harassment or stalking, these laws may provide both criminal penalties and civil remedies. Some states allow victims to recover statutory damages of up to $30,000 in civil suits related to doxxing.
California: Strong Enforcement, Limited Private Lawsuits
California’s CCPA and Delete Act provide significant protections, but the private right of action under the CCPA is limited to data breach situations. If a data broker ignores your deletion request, you generally cannot sue them yourself under the CCPA. Instead, enforcement falls to the California Privacy Protection Agency (CPPA) and the state Attorney General. The CPPA has been active on this front, fining multiple data brokers for failing to register under the Delete Act and ordering at least one company to stop selling Californians’ personal data entirely. If a data broker ignores your California deletion request, filing a complaint with the CPPA is your best step.
What You Need to Sue Successfully
Across most of these legal theories, courts require you to demonstrate concrete harm. The U.S. Supreme Court has ruled that individuals may sue data brokers over incorrect published information, but plaintiffs must show they suffered, or are likely to suffer, real damage as a result. Vague feelings of unease or general privacy concerns are usually not enough. Concrete harms include losing a job or housing opportunity because of inaccurate data, financial losses tied to identity theft enabled by a broker’s negligence, documented harassment or stalking facilitated by published personal information, and emotional distress supported by medical or therapeutic documentation.
Practical Steps If You Think You Have a Case
- Document everything. Save screenshots of the data broker listing, any inaccurate information, and evidence of harm you have experienced.
- Send a written opt-out or deletion request and keep a copy with the date. If the broker ignores it, that failure becomes part of your evidence.
- Check your state’s specific privacy laws. Protections vary significantly from state to state, and some offer much stronger remedies than others.
- Consult a consumer privacy or FCRA attorney. Many take these cases on contingency, meaning you pay nothing upfront. An attorney can evaluate whether your situation fits under the FCRA, a state law, or a defamation theory.
- File regulatory complaints. Even if you cannot sue directly, complaints to the FTC, your state attorney general, or the CPPA (for California residents) trigger enforcement actions that can result in fines and required changes to the broker’s practices.
The Bottom Line
You generally cannot sue a data broker simply for listing publicly available information about you. But if a broker sold inaccurate reports used in decisions about your employment or housing, published false information that damaged your reputation, ignored legally required deletion requests in states with strong privacy laws, or facilitated harassment through the release of your personal details, you may have a viable legal claim. The law in this area is evolving quickly, with more states passing data broker regulations and courts increasingly willing to hold these companies accountable. If you believe a data broker has crossed the line, talking to an attorney who specializes in privacy or consumer protection law is the best next step.