By Dohyun Park, J.D. Candidate, Harvard Law School
STUDENT VOICES: The views expressed below are those of the student author and do not necessarily reflect the position of the Access to Justice Lab.
In 2025, a hacker sold 15.8 million email–password pairs associated with PayPal on the dark web for $750. More recently, in 2026, cybersecurity firm Malwarebytes reported that cybercriminals stole private information from 17.5 million Instagram accounts, including usernames, addresses, phone numbers, and email addresses.
From banking to healthcare services, people’s sensitive information online continues to expand. Corporate data protection practices have not kept pace with that growth. Between 2021 and 2024, reported data breaches increased by approximately 70 percent. More than 100 million individuals were affected in 2024 alone. Some breaches appeared preventable through basic technological safeguards, such as multi-factor authentication. For example, a megabreach involving Change Healthcare, one of the largest U.S. health information companies, exposed data relating to roughly one-third of U.S. consumers. The absence of multi-factor authentication may have facilitated the intrusion.
Data breaches are not new. In 2004, attackers compromised approximately 92 million records. In many subsequent years, breaches involving more than 50 million records have occurred. This recurring pattern raises a structural question: why have corporate actors not adopted preventive measures sufficient to reduce large-scale breaches?
One explanation lies in the limits of access to justice in data-breach disputes. Most digital services operate through standard-form contracts structured under a “notice and consent” model. Because the United States lacks a comprehensive federal data privacy statute, many corporate actors need to respond only to Federal Trade Commission oversight. In 2000, the FTC articulated four fair information practice principles: notice, choice, access, and security. Under this framework, businesses may collect and use personal information if they disclose their practices and provide users with options. Daniel Susser, a professor of information science at Cornell University, has described this model as one in which companies may use personal data so long as they disclose their practices and users choose to proceed. Ubiquitous website pop-up disclosures and multi-page user agreements illustrate the operation of this notice-and-consent framework.
Although the model appears administratively efficient, scholars question whether the resulting consent is meaningful where consumers lack alternatives to essential digital services such as healthcare portals, banking platforms, and social networks. This contractual structure generates at least four barriers to effective access to justice.
1. Contractual Limits on Legal Remedies
Standard-form agreements frequently include mandatory arbitration clauses, class action waivers, and liability limitations. Research suggests that most consumers remain unaware that they agree to arbitration when subscribing to services. Liability clauses may narrow recoverable damages. For example, Oracle’s cloud services agreement limits liability for data loss to the expenses incurred if routine backups were properly maintained.
Mandatory arbitration redirects disputes away from public courts (and thus from public view). Class waivers prevent aggregation of low-value claims. Liability caps reduce potential recovery. These contractual provisions decrease expected exposure for corporate defendants and may correspondingly reduce incentives to invest in preventive cybersecurity safeguards.
2. Standing Doctrine and Pleading Barriers
Even when litigation proceeds, plaintiffs face doctrinal hurdles. In TransUnion LLC v. Ramirez, the Supreme Court held that exposure to a risk of future harm does not suffice to establish standing for damages. As Article III requires injury-in-fact that is concrete and particularized and actual or imminent, plaintiffs must demonstrate a concrete injury that bears a close relationship to harms traditionally recognized at common law. Federal courts have continued to wrestle with what constitutes sufficiently concrete injury in data breach litigation. In Greenstein v. Noblr, the Ninth Circuit held that a general notice of possible data exposure, without allegations that the plaintiff’s specific information was accessed, failed to establish standing.
Data-breach claims typically sound in negligence, negligence per se, breach of implied contract, unjust enrichment, and state consumer protection statutes. These claims require plaintiffs to show duty, breach, causation, and injury. Professor Andrew D. Selbst has argued that negligence, rather than strict liability, reflects the reality that an absence of risk is unattainable. However, when courts dismiss negligence claims on standing grounds or for failure to plead concrete injury, litigation may not deter underinvestment in data protection.
3. Negative-Expected-Value Claims and Attorney Incentives
Broad contractual terms and stringent standing requirements often necessitate expensive information generation techniques, such as forensic analyses in discovery. At the same time, individual recovery remains limited. In the Equifax settlement, eligible consumers could receive up to $125 in cash payments plus reimbursement for documented losses. When expected recovery remains modest and litigation costs remain high, attorneys may decline representation unless the breach affects millions of individuals and supports class aggregation. This economic structure reduces private enforcement in smaller breaches.
4. Pro Se Litigants and Post-Breach Vulnerability
Structural barriers disproportionately affect pro se litigants. Without counsel, plaintiffs must draft pleadings that satisfy standing doctrine, navigate arbitration provisions, and request discovery from sophisticated corporate defendants. Pro se litigants often lack access to expert witnesses, and few would expect lawyerless parties to compel discovery of technical evidence.
The vulnerability of breach victims compounds these challenges. Identity theft may impose financial strain, credit disruption, and time burdens. Individuals addressing fraudulent transactions may lack the resources to fund filing fees or arbitration costs. As a result, the cost-benefit calculus of litigation often becomes negative for unrepresented individuals.
Taken together, contractual waivers, standing doctrine, evidentiary asymmetry, and economic disincentives may reduce litigation frequency. Reduced litigation frequency weakens deterrence incentives for preventive cybersecurity investment. The interaction between limited access to justice and recurring breaches forms a vicious cycle.
Potential Solutions
A. Congressional action
Courts confront structural limits, especially when addressing mandatory arbitration clauses. The Federal Arbitration Act (“FAA”) protects the enforceability of arbitration agreements by providing that such agreements are “valid, irrevocable, and enforceable.” The Supreme Court’s interpretation of the FAA has preempted state doctrines that invalidate arbitration clauses as unconscionable when those doctrines interfere with the FAA’s objectives.
Meaningful structural reform of arbitration enforcement likely requires congressional action. Congress has introduced legislation aimed at limiting mandatory arbitration in consumer contexts. In the 119th Congress, Senators introduced the Forced Arbitration Injustice Repeal Act. The act proposes to amend the FAA to prohibit arbitration agreements covering future employment, consumer, antitrust, or civil rights disputes and agreements that interfere with the right to participate in joint, class, or collective actions. Such a proposal reflects legislative efforts as a potential solution to protect individuals’ access to justice.
B. Direct Access-to-Justice Innovations
Online Dispute Resolution (“ODR”) platforms may lower transaction costs. ODR systems conduct proceedings through electronic communication, including automated negotiation tools that generate settlements when parties’ proposed figures fall within predefined ranges. For mitigation-only claims involving limited financial loss, such systems may provide efficient resolution.
Regulatory safeguards should accompany such innovation because individualized digital claims may exacerbate information asymmetries. Consumers may lack reliable benchmarks regarding the value of their data and therefore accept systematically discounted settlements. Automation introduces additional strategic possibilities for firms. Firms could deploy bots to file and litigate large volumes of individualized claims in online arbitration proceedings. The automation may create risks of manipulation or strategic exploitation. Accordingly, any expansion of automated enforcement mechanisms may require accompanying regulatory safeguards to prevent abuse and preserve procedural fairness.
Innovation initiatives, such as Utah’s legal services sandbox ZAF, permit supervised delivery of legal assistance through nonlawyer technicians and automated software. These models aim to expand affordable representation and reduce procedural barriers for low-value claims.
The potential impact extends beyond individual victims. A central barrier in data breach claims has been the absence of attorney participation because individual data-breach claims are frequently negative in value. If automated systems reduce the marginal cost of filing and litigating a claim such that demand letters, arbitration filings, and settlement agreements are generated at minimal cost, the economics of small-value data-breach claims may shift. Claims that were previously irrational to pursue may become economically viable. Such a shift may not only empower individual claimants but also incentivize attorneys and law firms to pursue claims that previously fell below profitability thresholds.
If you’re interested in more on this topic, listen to our podcast episode.