Federal Court Finds DOJ Bulk Sensitive Data Regulations Open New Avenue For ECPA Suits

On June 16, 2026, the Northern District of Illinois became the first court to consider how the DOJ’s Bulk Sensitive Data (BSD) rule affects privacy claims under the Electronic Communications Privacy Act (ECPA). The BSD rule, enacted in April 2025, prohibits or restricts U.S. entities from transferring sensitive personal data to "countries of concern,” including China, Russia, Iran, North Korea, Cuba and Venezuela.

Unlike many state eavesdropping laws, the ECPA uses a "one-party" consent standard, meaning an individual can legally record or intercept a conversation if one party consents. But under the crime-tort exception in the ECPA, this consent defense is nullified if the interception is done for the purpose of committing an independent crime or tort.