Section 2520 of title 18 is the part of the federal Wiretap Act that gives a person whose communications were intercepted a civil claim. Counsel, insurers, and finance teams reading a privacy letter usually want to know what it allows. This guide walks through it subsection by subsection, quoting the statute.
Who can sue, and whom
Section 2520(a) gives the claim to "any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of this chapter." That person may recover "from the person or entity, other than the United States, which engaged in that violation such relief as may be appropriate."
The claim belongs to the person whose communication was intercepted. Each visitor whose visit was intercepted has their own.
What relief is available
Section 2520(b) lists three kinds of relief:
- "such preliminary and other equitable or declaratory relief as may be appropriate";
- "damages under subsection (c) and punitive damages in appropriate cases"; and
- "a reasonable attorney's fee and other litigation costs reasonably incurred."
How damages are measured
Section 2520(c)(2) applies to website claims. It says the court "may assess as damages whichever is the greater of":
- "(A) the sum of the actual damages suffered by the plaintiff and any profits made by the violator as a result of the violation; or"
- "(B) statutory damages of whichever is the greater of $100 a day for each day of violation or $10,000."
So there are three figures to compare: actual damages plus the violator's profits from the violation, the daily figure, and $10,000. The statutory figure is the larger of the last two, and at $100 a day the daily figure is the larger once the days of violation pass 100.
The count of days matters. In Pyankovska v. Abid, 65 F.4th 1067 (9th Cir. 2023), the Ninth Circuit vacated a Wiretap Act statutory-damages award because the district court had not considered how many days the defendant violated the statute, and it remanded for the calculation to be redone on that footing.
Section 2520(c)(1) sets lower amounts for a narrow set of cases about unscrambled private satellite video and certain radio communications. It does not apply to website claims, which fall under (c)(2).
Punitive damages
Section 2520(b)(2) allows "punitive damages in appropriate cases," separate from the damages in (c). In Quigley v. Rosenthal, 327 F.3d 1044 (10th Cir. 2003), the Tenth Circuit affirmed a jury's award to one individual plaintiff of $5,000,000 in punitive damages under § 2520(b)(2), against an organization that intercepted nothing itself but was liable for its agents' use of communications others had intercepted.
Attorney's fees and costs
Section 2520(b)(3) allows "a reasonable attorney's fee and other litigation costs reasonably incurred." In Boehner v. McDermott, 541 F. Supp. 2d 310 (D.D.C. 2008), one plaintiff already awarded $50,000 in punitive damages under § 2520(b)(2) was awarded $1,053,181.78 in fees and costs under § 2520(b)(3).
The filing period
Section 2520(e): "A civil action under this section may not be commenced later than two years after the date upon which the claimant first has a reasonable opportunity to discover the violation."
What this means for a company that received a letter
- Each visitor has their own claim.
- The statutory measure for each claimant is "the greater of $100 a day for each day of violation or $10,000."
- Punitive damages and attorney's fees are available in addition to damages.
See Federal Wiretap Act for Websites for how liability works, and What to Do After a Privacy Demand Letter for next steps.
Sources
Links checked on October 22, 2026. Statute text is quoted from the Legal Information Institute's copy of the U.S. Code, read that day.