Security

Your privacy depends on your ability to control and secure your personal information. When organizations fail to adequately protect your data, you may face serious consequences like identity theft or financial harm.

bllue background with magnifying glass and a locked laptop icon with a black woman wearing gray glasses and a black and white striped shirt on top with white words on top of a navy blue background that says do you know where your information goes online?

Protecting Your Information, Protecting Your Rights

Every day, individuals lose control of their data through unauthorized account access, phishing scams, identity theft, and corporate data breaches—often without even realizing it's happening. These incidents threaten your privacy and your ability to control how your data is shared and used.

Our resources and ongoing work aim to help you understand your legal rights, recognize common security threats, and have the ability to take practical steps to protect yourself and hold organizations accountable when breaches occur.

What You Need to Know

Criminals commonly obtain personal information through data breaches, phishing scams, and malware. Data breaches occur when organizations fail to adequately secure databases, exposing sensitive details like Social Security numbers or financial accounts. Attackers also use phishing—deceptive communications—to trick people into providing personal information, or malware to secretly capture data from devices.

The impact of data breaches is intensified because criminals and data brokers often re-identify anonymous or partially anonymized data from multiple leaks. Understanding these risks helps you recognize when your privacy rights are at stake and take prompt action.

This is a difficult question because the best approach depends on your personal circumstances, including your technology usage and comfort level. We avoid overly specific technological advice due to rapidly evolving threats and solutions. However, some universally helpful practices include familiarizing yourself with security settings on apps and services you regularly use.

Enable available security features like multifactor authentication, and use a password manager to create and securely store strong, unique passwords. These foundational practices help you protect your information effectively without relying on advice that quickly becomes outdated.

If your data is exposed, state and federal laws guarantee your right to be notified of the breach. Act quickly—review the notification, change affected passwords, monitor financial and credit accounts, and consider placing fraud alerts or credit freezes to protect yourself against identity theft.

If identity theft or fraud occurs, you have additional rights, such as filing an identity theft report with the Federal Trade Commission at IdentityTheft.gov, and potentially pursuing legal remedies, especially under California law.

It depends. Under California’s CCPA, you have the right to sue a company if sensitive personal information—such as your Social Security number, driver’s license, or financial account details—is compromised due to inadequate security practices. You may be eligible for actual damages or statutory damages up to $750 per breach, even without proving specific financial losses.

In other states, consumer protection laws may similarly allow you to join class-action lawsuits or prompt actions by state Attorneys General against negligent companies responsible for data breaches.

If you experience identity theft, you have specific rights and resources available. Report identity theft to the FTC through IdentityTheft.gov, which will help you document the incident and develop a personalized recovery plan. You also have the right to place free fraud alerts or credit freezes on your credit reports to prevent further misuse.

California residents have additional rights to file police reports specifically for identity theft, assisting with the removal of fraudulent accounts and charges from credit reports. Victim service organizations can also provide further assistance.

Understand your rights under the California Consumer Privacy Act

Report identity theft with the Federal Trade Commission

What is a credit freeze?

More Resources

Q&A

What data privacy protections exist for survivors of domestic violence?

If you're a survivor of domestic violence, both federal and state laws offer important privacy protections to help keep you safe in your housing.

Law Overviews

California Invasion of Privacy Act (CIPA)

The California Invasion of Privacy Act (CIPA) protects Californians against unauthorized interception, recording, and eavesdropping on private communications, conversations, or telephone calls. It provides individuals with robust privacy protections for electronic and oral communications.

News & Press

KQED: California Privacy Agency Fines American Honda Over Consumer Data Violations

light blue background of a book shelf with a picket sign on the right that says amplify your voice and a hand holding a bullhorn at the bottom right and another hand holding a magnifying glass on the bottom left with the work law in the glass

Advocacy

Privacy Rights Clearinghouse and Coalition support A.B. 566 to make it easier to exercise your privacy rights

Exercising your privacy rights can unfortunately be an unnecessarily arduous task. That's why we're proud to stand with a coalition of civil society, consumer protection and privacy advocates supporting Assembly Bill 566, a bill that would require browsers and mobile operating systems to include a setting that enables a consumer to send an opt-out preference signal.