Yes, you can sue a company for selling your data without consent in limited cases. Most data sales do not give you a private lawsuit and must go through regulators instead. Sale here means a business selling or sharing personal information for money or another benefit. Your options depend on your state and the type of data involved.
Table of Contents
- When California law allows a lawsuit
- What California opt-out rights cover
- When Illinois law allows a lawsuit over biometric sales
- When regulators act instead of consumers
- What you can do next
When California law allows a lawsuit
California residents have a narrow right to sue over personal information. According to Thomson Reuters, consumers may sue only after certain breaches of nonencrypted personal information caused by a failure to maintain reasonable security, for $100-$750 per consumer per incident or actual damages if greater, in its California privacy overview.
That breach path is the exception. Other violations, such as ignoring an opt-out of sale or share request, do not create a private lawsuit. Those claims belong to the California Attorney General and Privacy Protection Agency for penalties and injunctions.
What California opt-out rights cover
California gives residents rights to know, delete, and correct personal information. Residents can also opt out of the sale or sharing of personal information.
Businesses must offer a "Do Not Sell or Share" link and honor opt-out preference signals like Global Privacy Control, according to Usercentrics in its CCPA overview. Use that link or signal first when a company keeps selling or sharing your data. Save the confirmation screen, date, and account details.
When Illinois law allows a lawsuit over biometric sales
Illinois has a stronger private-suit rule for biometric data. The state's 2008 Biometric Information Privacy Act bars private companies from selling, leasing, trading, or otherwise profiting from biometric identifiers. It also requires written notice and a written release before collection.
Any aggrieved person may sue in state court or as a supplemental federal claim for $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus fees and injunctive relief, without pleading separate injury, according to the Privacy Law Network in its Illinois privacy summary. This path matters for fingerprint, face-geometry, voiceprint, and similar identifier sales. Keep copies of notices, consent forms, and app or employer disclosures.
When regulators act instead of consumers
Many location-data cases have been brought by the Federal Trade Commission, not by consumers. In May 2026 the agency announced a proposed settlement barring data broker Kochava and its subsidiary from selling, sharing, or disclosing sensitive location data without affirmative express consent, after alleging sales covering hundreds of millions of devices, as summarized by Proskauer in its account of the May 2026 action.
That pattern explains why you may see a settlement fund without filing your own suit. Regulator action can ban future sales, require deletion, and set consent rules. Consumer payment, if any, depends on the separate settlement or court order.
What you can do next
Start with the company's opt-out process, then preserve proof. A clear paper trail helps a regulator complaint and helps a lawyer assess a California breach claim or Illinois biometric claim. Stop further sharing before you pursue compensation, because continued collection can widen the harm and complicate proof.
- Use the "Do Not Sell or Share" link and confirm the opt-out.
- Turn on Global Privacy Control and keep proof it is active.
- Save policies, receipts, consent screens, and denial messages.
- File a complaint with the state attorney general or privacy agency.
- Ask a consumer lawyer whether your facts fit a permitted private claim.