Rights, in real situations
Digital safety
161 stored questions · 17 topics · No account needed
Choose where it happened. Read the rule, the exceptions and what you can do next. No chat needed.
Choose a state for local guides. The guides below cover specific federal rules.
Digital safety
What should I do if my email account is hacked?Background reading
Background reading
Use the provider’s official recovery process. If you can sign in, change your password and check account recovery and forwarding settings.
Secure the email account first if other services send password-reset links there. Let contacts know if someone sent messages pretending to be you.
This is background information, not a state-specific answer. Legal review pending.
What is one simple way to protect my accounts?Background reading
Background reading
Turn on two-step sign-in in your account settings. It adds a second check, so a stolen password alone is less useful to someone trying to get in.
Start with email, banking and other sensitive accounts. Keep recovery codes somewhere safe and separate.
This is background information, not a state-specific answer. Legal review pending.
Can I ask a children’s app to show me and delete the information it collected from my 10-year-old?Federal rule · specific setting
Federal rule · specific setting
For this situationA parent of a child under 13 using a commercial app or site directed to children, or an operator with actual knowledge it collects children’s information.
Yes, when COPPA covers the operator. Parents can review their child’s collected personal information, ask for deletion and refuse further collection or use.
What to do next
- Find the operator’s privacy policy and the contact or procedure for parental access requests. Save a copy.
- Identify the child’s account and request access, deletion and a stop to future collection as desired. Complete reasonable parent-verification steps.
- Retain the request and response. Report a suspected COPPA violation to the FTC if the operator does not address it.
What could change this answer?
- Deleting information may mean the child can no longer use features that require it.
- If information was already deleted, the operator cannot provide records it no longer holds. Ask what remains rather than assuming all past activity is retained.
Links open the named service. REYETS does not send or file anything.
Federal rule. State or local protections may add to it. Legal review pending.
Someone opened a loan in my name. Can I block it from my credit report?Federal rule · specific setting
Federal rule · specific setting
For this situationCredit-report information caused by identity theft, rather than an ordinary disagreement over a debt you incurred.
Yes. A qualifying identity-theft block request requires the reporting company to block fraudulent information within four business days after receiving the required material.
What to do next
- Create an identity-theft report at IdentityTheft.gov and save it securely. Identify every affected account on your reports.
- Send each affected reporting company the report, identity proof and a letter identifying the entries, stating you did not authorize those transactions and requesting a block.
- Keep delivery evidence, review the updated reports and contact the company if the fraudulent entry remains after a complete request.
What could change this answer?
- An ordinary reporting error uses the standard dispute process instead.
- Blocking the report is one recovery step. Contact affected creditors and secure compromised accounts as well; a block does not itself close them.
Links open the named service. REYETS does not send or file anything.
Federal rule. State or local protections may add to it. Legal review pending.
I suspect identity theft. Must I contact all three credit bureaus to place a fraud alert?Federal rule · specific setting
Federal rule · specific setting
For this situationSomeone who is, or reasonably suspects they may be, affected by identity theft and wants an initial fraud alert.
No. Contact one nationwide credit bureau for a free initial fraud alert; it must notify the other two. The alert lasts one year and can be renewed.
What to do next
- Use the FTC’s links to reach one of Equifax, Experian or TransUnion and request an initial fraud alert.
- Provide accurate contact information so a lender can verify that a new credit request is really yours. Save confirmation.
- Review your reports for unfamiliar accounts and note the alert’s expiration date so you can renew it if needed.
What could change this answer?
- An extended alert lasts seven years and requires an identity-theft report or police report.
- If you want a credit freeze, contact each bureau separately. Placing one fraud alert is not a request for three freezes.
Links open the named service. REYETS does not send or file anything.
Federal rule. State or local protections may add to it. Legal review pending.
A retailer keeps emailing ads after I unsubscribe. How long does it have to stop?Federal rule · specific setting
Federal rule · specific setting
For this situationEmail whose primary purpose is commercial advertising or promotion, covered by the federal CAN-SPAM Act.
Under CAN-SPAM, a covered commercial sender must honor an opt-out request within 10 business days. It cannot charge a fee or require personal information beyond your email address to process the request.
What to do next
- For a legitimate retailer, use its stated unsubscribe method and save the confirmation or a screenshot with the date.
- Keep examples of advertising emails received more than 10 business days later, including sender details.
- Report continued commercial messages or a missing opt-out method to the FTC, and use your email provider’s spam controls.
What could change this answer?
- A sender can offer topic preferences, but must also let you opt out of all its marketing messages.
- Unsubscribing from marketing does not cancel a purchase, subscription contract or necessary account-security notices.
Links open the named service. REYETS does not send or file anything.
Federal rule. State or local protections may add to it. Legal review pending.
A Department of Justice record about me has the wrong facts. Can I request a correction?Federal rule · specific setting
Federal rule · specific setting
For this situationA US citizen or lawful permanent resident seeking correction of their own DOJ record in a covered Privacy Act system of records.
The Privacy Act permits requests to amend covered DOJ records about yourself, subject to exemptions. Identify the record, the correction you want and why it is inaccurate, irrelevant, outdated or incomplete.
What to do next
- Identify the DOJ component that holds the record and review its identity-verification and amendment instructions.
- Label the request “Privacy Act Amendment Request,” identify each disputed entry and supply the replacement facts with supporting copies.
- Send it to the component’s Privacy Act office and retain the request, delivery evidence and written determination.
What could change this answer?
- If the record is in several systems, identify them and direct requests to the components maintaining each one.
- DOJ’s Office of Privacy and Civil Liberties must receive a written amendment appeal within 60 days of the denial letter’s date. Follow the letter’s appeal instructions.
Links open the named service. REYETS does not send or file anything.
Federal rule. State or local protections may add to it. Legal review pending.
My clinic discovered a breach of my unsecured medical information. When must it tell me?Federal rule · specific setting
Federal rule · specific setting
For this situationA breach of unsecured protected health information for which a HIPAA-covered provider or health plan owes individual notice.
For a reportable HIPAA breach, the covered organization generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery.
What to do next
- Keep the notice and its envelope or email timestamp. Read what information was involved and the protective steps offered.
- Use a verified contact for the organization’s privacy office to ask about missing details or whether your records were affected.
- If you believe required notice was withheld or improperly delayed, use HHS’s privacy complaint process and retain supporting dates.
What could change this answer?
- Individual notice is usually mailed, or emailed if you agreed. Substitute notice can apply when contact information is unavailable.
- A small breach can follow different timing for reporting to HHS; that does not generally postpone notice to affected individuals.
Links open the named service. REYETS does not send or file anything.
Federal rule. State or local protections may add to it. Legal review pending.
How do I keep a record of online harassment?Background reading
Background reading
Start with full message context and timestamps; profile URLs and report references; original screenshots.
Keep your own observations separate from what someone told you. These are preparation steps, not a finding about your rights or eligibility.
This is background information, not a state-specific answer. Legal review pending.
No detailed guide matches yet. Try another topic or include background questions. We will not substitute another state’s rule.
These guides cover the situations they name. They are source-checked drafts, not a complete state law library or a lawyer’s review. County rules are not inferred from your state.
See sources and coverage →Get help applying a guide to your situation →