Actual Damages in Privacy Law: Wiretapping, CIPA & Privacy Act

Actual damages in privacy law are the concrete losses you can prove flowed from a specific violation, and what counts depends entirely on which statute you sue under. The federal Wiretap Act lets you recover economic losses, emotional harm, the violator’s profits, or a statutory floor, whichever is greater. California’s Invasion of Privacy Act trebles your actual damages or gives you $5,000 per violation. The federal Privacy Act of 1974 is the strictest of the three: only out-of-pocket economic harm qualifies, and you must prove some before you can recover anything at all.

What Actual Damages Cover

Actual damages fall into two categories. Economic losses are the documented ones: money you spent on credit monitoring after a breach, lost wages, business revenue that disappeared because a competitor intercepted your communications, fees paid to repair compromised records. These need receipts, bank statements, pay stubs, invoices.

Non-economic losses cover emotional distress, reputational harm, and similar intangible injuries. Courts routinely award them in privacy cases under most statutes, with one large exception under the federal Privacy Act. Whichever category you claim, you have to show a direct causal link between the defendant’s conduct and the specific harm. A generalized sense of violation is not enough.

You Need Concrete Harm to Get Into Federal Court

In TransUnion LLC v. Ramirez (2021), the Supreme Court held that a bare statutory violation, without concrete harm, does not give you standing to sue in federal court.¹ Intangible harms like reputational injury or disclosure of private information can count as concrete, but only when they resemble harms traditionally recognized in American courts. If a company technically broke a privacy statute and you cannot point to any real-world consequence, your federal case may be dismissed before it reaches the merits.

Damages Under the Federal Wiretap Act

The federal Wiretap Act, 18 U.S.C. § 2520, gives you a private right of action when someone intercepts your wire, oral, or electronic communications without authorization — phone calls, emails, text messages, and other digital traffic.²

What You Can Recover

A successful plaintiff recovers the greater of two amounts: your actual damages plus any profits the violator made from the interception, or statutory damages of $100 per day of violation or $10,000, whichever is larger.² The statutory floor protects plaintiffs who can prove a violation but cannot quantify exact dollar losses. In cases involving intercepted trade secrets or business communications, actual damages often exceed the statutory minimum by a wide margin.

The Act also authorizes punitive damages “in appropriate cases” and preliminary, equitable, or declaratory relief.² Equitable relief matters when surveillance is ongoing: a court can order the defendant to stop. A prevailing plaintiff also recovers reasonable attorney’s fees and litigation costs.

The Good-Faith Defense

Not every interception produces liability. The statute provides a complete defense when the defendant relied in good faith on a court warrant, grand jury subpoena, legislative or statutory authorization, or a law enforcement request.² Many claims against law enforcement fall apart here: if officers had a facially valid warrant, the defense applies even if the warrant was later found defective.

Damages Under the California Invasion of Privacy Act

California Penal Code § 637.2 provides some of the strongest civil remedies for unauthorized surveillance in the country. A plaintiff who proves a CIPA violation recovers the greater of $5,000 per violation or three times the actual damages sustained.³ That treble damages provision is what gives CIPA claims their leverage.

Where actual damages are modest, the $5,000 statutory floor per violation still adds up. Each separate act of interception or recording can count as its own violation, so a sustained monitoring campaign can produce a much larger number than the underlying financial harm suggests. CIPA also authorizes injunctive relief, so you can seek a court order stopping ongoing surveillance in the same lawsuit where you pursue damages.⁴

Damages Under the Privacy Act of 1974

Suing a federal agency under the Privacy Act is considerably harder. Two Supreme Court decisions have narrowed what plaintiffs can recover, and the result is that many valid-looking claims produce no money at all.

Some Actual Damages Are a Prerequisite

In Doe v. Chao (2004), the Supreme Court held that a plaintiff must prove some actual damages to qualify for even the minimum statutory award of $1,000 under 5 U.S.C. § 552a(g)(4).⁵ The $1,000 floor works only for plaintiffs who can show at least some real damage. Without that showing, the case ends at zero.

Only Pecuniary Harm Counts

In FAA v. Cooper (2012), the Court held that “actual damages” under the Privacy Act means proven pecuniary or economic harm only.⁶ The plaintiff alleged humiliation, embarrassment, and severe emotional distress after the FAA improperly disclosed his HIV status, but because he did not allege economic loss, the Court ruled the Privacy Act’s waiver of sovereign immunity did not extend to his claims.⁷

What you need, in practice: out-of-pocket costs. Money spent on credit monitoring. Fees paid to fix compromised records. Lost income traceable to the agency’s failure. Emotional distress alone, however severe or well documented, does not satisfy the standard. This is where most Privacy Act damage claims die.

The Agency Must Have Acted Intentionally or Willfully

Even with proven pecuniary harm, recovery requires showing the agency acted intentionally or willfully.⁸ Negligence is not enough. The agency must have known its conduct violated the Act or acted with reckless disregard. Combined with the pecuniary harm requirement, this creates a double hurdle that filters out most claims. Attorney’s fees and costs are available to prevailing plaintiffs, but if you fail on damages, there is no fee recovery either.

Filing Deadlines

Missing a statute of limitations ends the case regardless of how strong the underlying facts are. Each of these statutes has a discovery-based trigger that can extend the window in limited circumstances.

Federal Wiretap Act. Two years from the date you first had a reasonable opportunity to discover the violation. Because surveillance is often covert, the clock starts when you could reasonably have learned about the interception, not when it occurred.⁹
Privacy Act of 1974. Generally two years from when your cause of action arises. If the agency made a material and willful misrepresentation about information it was required to disclose, the deadline extends to two years after you discover the misrepresentation.⁸
California Invasion of Privacy Act. Courts have generally applied a one-year statute of limitations to CIPA civil claims. The short window means delays in filing after discovery can be fatal.

Documenting Your Losses

The strength of a privacy damage claim lives in the paperwork. Courts do not presume actual damages. You have to specify each loss and trace it back to the violation through a connected chain of events. Every dollar you claim needs a receipt, invoice, or financial record behind it.

For economic losses, gather invoices for security measures purchased after the breach — encryption software, replacement devices, monitoring services — plus pay records showing lost wages or termination, and any communications from clients or business partners documenting lost revenue. Where the statute allows emotional distress claims, receipts from counseling, therapy, or medical treatment provide the corroboration courts look for. Contemporaneous notes or a journal describing how the violation affected daily life can supplement professional treatment records.

Organize the material chronologically so the timeline reads clearly: the violation happened, then these specific harms followed. Under the Privacy Act, where only pecuniary losses count, this documentation is the whole case. Under the Wiretap Act and CIPA, thorough records also raise the baseline for statutory multipliers and punitive damages, because the higher your proven actual damages, the higher the floor for enhanced awards.

Tax Treatment of Privacy Damage Awards

Most privacy damage awards are taxable income. The exception is narrow. Under 26 U.S.C. § 104(a)(2), damages received on account of personal physical injuries or physical sickness are excluded from gross income.¹⁰ Damages for everything else — including emotional distress, reputational harm, and economic losses from privacy violations — are generally taxable.¹¹

Privacy cases rarely involve physical injuries, so nearly the entire award — actual, statutory, treble, and punitive damages — is reported as income. One narrow carveout: if emotional distress from a privacy violation caused you to seek medical treatment, the portion of your recovery that reimburses those specific medical expenses (and that you did not previously deduct) can be excluded.¹¹ Attorney’s fees add another wrinkle, since in many cases you owe tax on the gross award before fees are subtracted. Building the tax hit into settlement discussions is worth a conversation with a tax professional before you accept.

1
Supreme Court of the United States. TransUnion LLC v. Ramirez
2
Office of the Law Revision Counsel. 18 USC 2520 – Recovery of Civil Damages Authorized
3
California Legislative Information. California Penal Code 637.2 – Invasion of Privacy
4
California Legislative Information. California Penal Code 637.2
5
Justia. Doe v. Chao, 540 US 614 (2004)
6
Justia. FAA v. Cooper, 566 US 284 (2012)
7
U.S. Department of Justice. Overview of the Privacy Act 1974 2020 Edition – Remedies
8
Office of the Law Revision Counsel. 5 US Code 552a – Records Maintained on Individuals
9
Office of the Law Revision Counsel. 18 US Code 2520 – Recovery of Civil Damages Authorized
10
Office of the Law Revision Counsel. 26 USC 104 – Compensation for Injuries or Sickness
11
Internal Revenue Service. Tax Implications of Settlements and Judgments