iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Document what you can actually observe, preserve the original records, and send a focused complaint to the regulator that has authority over the organization and location involved. Start with a dated log that separates facts from hypotheses. Save unaltered emails, notices, screenshots, settings and access records; keep copies secure; then choose a route for data protection, cookies or tracking, workplace monitoring, home CCTV, nuisance contact, or suspected crime. UK Information Commissioner’s Office (ICO) routes are useful examples, not worldwide rules.
What counts as evidence of suspected surveillance?
A privacy complaint is stronger when it describes verifiable events instead of asserting an unproved conclusion. A login alert for an unfamiliar location, a privacy setting that changed without your action, an app-permission notification, a message confirming disclosure of your data, or a workplace notice about screenshots are observable events. The identity of the person responsible, the purpose, and whether the event was unlawful are separate questions.
Separate observation from interpretation
Use two fields in your notes. In the observation field, record exactly what appeared, when, where, and on which account or device. In a hypothesis field, explain possible causes and label them as uncertain. For example, write “At 14:06 UTC, the account sent a login alert for an unrecognized location” rather than “an attacker is spying on me.” A later review can test several explanations, including a stale location estimate, a shared device, an automated security check, or unauthorized access.
Recommended Free Tools
Online tracking has a specific meaning
The European Data Protection Board (EDPB) describes online tracking as collecting activity across websites or apps, such as visits and clicks, to monitor activity. Personalized advertising or recommendations can be a reason to investigate privacy practices, but they do not by themselves prove that a particular person was targeted or watched. Record the behavior that led to your concern and avoid treating a feeling of relevance as attribution.
Step 1: Define the concern narrowly
Write a one-sentence description before collecting material. Identify the service or organization, the account or device, the apparent event, and the date range. Examples include:
- An account notice reports a sign-in you did not initiate.
- A website’s cookie or privacy controls appear to change after you select a preference.
- An app requests or uses a permission at a time that does not match your activity.
- A message says personal information was disclosed to another party.
- A workplace system records screenshots, keystrokes, internet activity, or location data without a clear explanation.
Do not add a suspected perpetrator unless a record supports that attribution. A narrow statement keeps the log usable and prevents a regulator from having to separate evidence from speculation.
Step 2: Build a dated incident log
Use one row per event and keep the entries chronological. A spreadsheet, a secure digital note, or a paper notebook can work. The format below is practical editorial advice, not an official regulator form.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute| Field | What to record |
|---|---|
| Event ID | A short number or code that lets you refer to the event in your complaint. |
| Date, time and time zone | The device time and the zone or UTC offset; note if the time is approximate. |
| Service and account | The website, app, employer system or provider, plus the account identifier used. |
| Device and network context | Device type, operating-system version if known, browser, and whether you were on home Wi-Fi, mobile data or another network. |
| Exact observation | The wording of an alert, the setting that changed, the permission event, or the activity you saw. |
| URL or message identifier | The complete URL, message subject, sender, ticket number or notification ID. |
| Original location | Where the unaltered email, screenshot, export or log is stored. |
| Action taken | Password change, consent withdrawal, request to the organization, or other step, with its date. |
| Outcome | What happened after the action, including whether the alert stopped, repeated or remained unexplained. |
| Contacts | Organization, regulator, employer, police or support contacts, and any reference numbers. |
| Confidence and alternatives | What is certain, what is inferred, and plausible explanations that remain open. |
Keep the language neutral
Quote important wording exactly and put your own explanation beside it. If you cannot preserve a quote, mark it as a paraphrase. Record absences as well as changes: for example, a notice that previously showed a permission may no longer appear after an update. Do not silently correct timestamps or combine several events into one entry. If the device clock was wrong, retain the displayed time and add the correction or uncertainty in a separate note.
Step 3: Preserve originals and provenance
Preservation means keeping the material in the form in which you received or captured it, together with enough context for another person to understand it. The ICO’s surveillance-record guidance emphasizes confidentiality, integrity, availability, restricted access, accurate date and time information, and retrieving copies without losing quality.
Messages and account notices
- Keep the original email or in-app notice, not only a copied paragraph.
- Retain sender details, subject, headers where available, the complete URL, attachments, and the time received.
- Export the message in the service’s native or standard format when possible, then store a readable copy for review.
- Do not forward an original in a way that changes headers or strips attachments; forward a separate copy if support requires it.
Screenshots, photos and recordings
Capture the whole relevant screen, including the address bar, account context, visible date or time, and surrounding text. Keep the first capture unedited. If you need to highlight an area, annotate a duplicate and retain the original beside it. Avoid resizing or recompressing the only copy; the ICO specifically warns that copies should remain usable without losing image quality or date and time information. Record when and how the capture was made.
Settings, permissions and access logs
Save the current settings page, permission list, security events, connected-device list, and data-access history when the service offers them. Capture the page’s URL and the time. If a page can be downloaded, keep the download and a screenshot showing the surrounding interface. Do not alter a log to remove an embarrassing entry; redact only a separate copy intended for sharing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Secure storage and redaction
Keep an unaltered evidence set and a working set for notes. Restrict access to people who need it, use a secure account, and consider encryption for sensitive material. Make a backup in a separate secure location. Before sharing, redact unrelated people’s names, contact details, financial information and private messages. Tell the recipient what was removed and keep the unredacted original. Do not upload private records to a public forum simply to obtain opinions.
Step 4: Capture technical context without contaminating evidence
For each event, note the account session, device, operating system, browser or app version, network type, approximate location shown by the service, and whether a VPN, work profile, shared device or family account was involved. Write down recent password resets, software updates, device replacements, travel, or account sharing that could explain a location or permission change. Preserve the context before clearing cookies, signing out everywhere or resetting a device, because those actions can remove useful records.
If you must secure an account, document the step and time first, then save the resulting confirmation. A password change or multi-factor-authentication reset protects you but also changes the state you are trying to describe. Keep both the pre-change notice and the post-change confirmation.
Step 5: Protect yourself while documenting
Do not install a “spy detector,” intercept someone else’s communications, access another person’s account, or modify a device in a way that could compromise evidence. The available official material does not establish a consumer gadget or scan as a reliable way to prove who conducted online surveillance. A scan can produce alarming results without identifying a person, intent or legal violation.
If the concern involves financial loss, threats, coercive control, stalking, employment retaliation or physical danger, prioritize safety. Use a trusted device and account when seeking help, and avoid actions that could alert an abusive person. A regulator complaint does not replace emergency services or local law-enforcement reporting when there is an immediate threat or credible suspected crime. The reviewed guidance supports preserving records and using the appropriate authority, but it does not provide a universal police directory.
Step 6: Choose the complaint route
Jurisdiction comes first. Complaint rights, deadlines, required pre-contact with an organization, and the regulator’s authority depend on the country, the organization’s location, the service involved and the type of conduct. The UK routes below illustrate how one regulator separates issues.
| Issue | UK route or guidance | Evidence to emphasize |
|---|---|---|
| Use or disclosure of personal information | ICO data-protection complaint route | Timeline, organization identity, data involved, notices, requests you made and the response. |
| Cookies or online tracking | ICO cookies complaint route; in the EU, the competent national supervisory authority applies | Consent choices, cookie or tracking notices, relevant URLs, dates, and what occurred after a preference was selected. |
| Nuisance calls or messages | ICO nuisance-contact route | Calling or messaging number, date and time, content, consent history and opt-out requests. |
| Home CCTV | ICO home-CCTV complaint route | Camera location, field of view, dates, communications with the operator and images or notices retained lawfully. |
| Workplace monitoring | ICO employment-monitoring guidance | Policy or notice, screenshots, keystroke or internet records, location data, stated purpose, duration and your objection or access request. |
The ICO notes that it may not be able to respond personally to every matter. Submit only the material relevant to the issue and follow the current form and instructions. Do not assume that a cookies complaint, a data-protection complaint and a criminal report are interchangeable.
Workplace monitoring is a special case
ICO guidance addresses screenshots, keystrokes, internet activity, location devices and covert monitoring. An employer should document why monitoring is needed and what it intends to do with the information. Covert monitoring is exceptional: it should be tightly targeted and time-limited and should stop when the investigation ends. Workers may make access requests and may object in circumstances covered by the guidance. If an employer rejects an objection, the ICO says it must explain the decision and tell the worker about the right to complain.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Preserve the policy, handbook page, meeting note or message that describes monitoring before relying on your interpretation. Record whether the monitoring was announced, which workers or systems it covered, the stated purpose, and how long it operated. Keep your employment records separate from unrelated personal material when sharing evidence.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Step 7: Write a concise complaint
A regulator needs a clear account and a manageable evidence set. Use this order:
- Identify yourself and the organization. Give your contact details, the service or employer involved, and any account or case reference that is safe to disclose.
- State the issue in one paragraph. Say what you observed, the date range, and which personal data or activity appears involved.
- Attach a short timeline. Include event IDs that match the filenames of representative records.
- Describe what you asked the organization to do. Give the date, channel, wording in summary, response, and any unanswered request.
- Mark uncertainty explicitly. Write, for example, “I observed X; I do not know whether Y caused it.” Do not identify a person as responsible without supporting records.
- State the outcome you seek. You might ask the authority to assess compliance, clarify how to exercise an access right, or address a tracking or monitoring practice.
- Keep proof of submission. Save the completed form, attachments, confirmation page, acknowledgment and any reference number.
Send a small number of representative records rather than an indiscriminate data dump. Offer to provide additional originals through the regulator’s secure channel. Follow its current limits on file types and size, and do not include third-party information that is irrelevant to the complaint.
Jurisdiction and legal boundaries
UK ICO material is a UK example, not a global procedure. In the European Union, EDPB explanations of tracking and its guidance on social-media targeting and profiling do not replace the national supervisory authority that has competence over your facts. The correct authority can depend on where you live, where the organization is established, where processing occurs, and whether another regulator has primary responsibility.
US Federal Trade Commission material reviewed for this topic concerns business breach response and a staff report on large online platforms. It does not create a general consumer complaint route for every form of suspected monitoring. Check the current authority for your state, sector and conduct, and keep any regulator submission distinct from a police report or a request for emergency help.
What the FTC platform report does—and does not—show
In 2024, FTC staff said its report drew on orders to nine companies: Amazon/Twitch, Facebook (now Meta), YouTube, Twitter (now X), Snap, ByteDance/TikTok, Discord, Reddit and WhatsApp. Nine is the number of companies covered by that report, not an estimate of how common unlawful surveillance is and not evidence that a particular reader was monitored. The reviewed official sources provide no population-wide statistic for how many people experience unlawful online surveillance or how often a specific person is watched.
Common mistakes and safer fixes
- Calling a pattern proof: replace “they are tracking me” with the exact event, source and time.
- Editing the only copy: keep an untouched original and annotate a duplicate.
- Dropping the time zone: record the displayed time, zone or UTC offset, and any clock problem.
- Sending everything: provide a focused timeline and representative records; retain the complete set securely.
- Ignoring alternative explanations: note shared devices, travel, updates, VPNs and automated security checks.
- Using the wrong authority: classify the issue first—data protection, cookies, nuisance contact, home CCTV, workplace monitoring, safety or suspected crime.
- Publicly posting private material: redact third-party data and use the regulator’s secure channel.
- Changing the device before capture: document and preserve available records before clearing, resetting or uninstalling.
An example evidence package
A compact package might contain a one-page summary, a chronological log with event IDs, three or four representative original records, a separate redacted set for sharing, copies of requests sent to the organization, and the responses. The summary can say: “On 12 March, I received a sign-in alert at 14:06 UTC for an unfamiliar location. I saved the original notice and security-log export. I changed the password at 14:20 UTC and enabled multi-factor authentication. I do not know whether the location reflects unauthorized access, a shared device or an inaccurate estimate. I contacted the provider on 13 March; the response is attached.” This format lets an investigator verify the event without requiring you to prove a conclusion that the records do not establish.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
