The text message was meant to be innocuous; it ended up in a courtroom.
That scenario is becoming more common in the rental housing sector, as seemingly harmless emails, texts and organizations’ conversations can violate rapidly expanding data privacy laws that vary by state.
A panel of industry legal specialists discussed these regulatory risks at the 2026 Apartmentalize session “Law & Disorder: Workplace Communication and Data Privacy Laws,” noting which types of communication most commonly violate data privacy laws and those protected by attorney-client privilege.
The panel noted that most data privacy violations come from routine operations—such as texts, emails and instant messager communications—and that organizations should change any potentially incriminating habits before those messages create exposure.
“If you are in a lawsuit where someone has maybe sued you for a fair housing violation, a slip and fall or a wrongful eviction, the other side has the right to demand any of your communications that were related to that matter," said Jennifer McCoy, who serves as the Managing Attorney for her own law office. “When I say communication, I mean your text messages, your notes in your property management software, your emails, your WhatsApp thread. Any type of communication that touches the subject matter of that lawsuit can be discoverable.”
Disciplined communication
The nuance between compliant and noncompliant digital communication can be narrow, but often falls into the realm of solid judgement. For instance, a text saying: “Jane Smith in 4B hasn’t paid rent” contains much more regulatory risk than “Unit 4B is three months in arrears.”
McCoy notes that within litigation, legal teams are “looking for things that show intent, bias, disproportionality, unprofessionalism or inconsistency, those kinds of things. They're looking at those messages that you thought meant nothing, the informal, quick messages that you think nothing about. That text message that you send to your coworker, that's like, 'wow, 204 is a jerk.' Something like that.”
The key takeaway, McCoy said, is that before you press “send” on the message, read it and ask whether it would be appropriate to read aloud in a courtroom. If the answer is anything but “yes,” erase it and start over.
The perception is that data privacy laws mandate organizations to utilize secure systems to ensure no personal information is compromised. While that part is accurate, data privacy laws also regulate how personal information is used.
According to Alexandra Samofalova, Attorney at Spencer Fane LLP, routine daily actions such as resident applications, payment issues, maintenance supplies, accommodations and complaints all pertain to a resident's personal information. That's where a seemingly quick-hit, chatty internal communication about any of the above can contain risk.
“You still need to make sure that you're complying with the data privacy laws that apply, so that's why awareness matters,” Samofalova said. “Once your teams understand the types of ordinary communication that can be regulated and how they become regulated, then you can change your habits and do that before they actually create a situation.”
The true cost of violations
According to the panel, regulatory fines can range as high as $4 million to $7 million per enforcement. Acquiring legal defense is commonly in the six-figure range, as well, if not higher.
Additionally, organizations risk operational fallout in the form of damaged reputation, compromised trust among residents and the loss of potential renters.
“In 20-plus states right now, that same email, that same text is not just only evidence anymore," said Susan Sherfield, Director of Operations at Ann Avenue Partners, LLC. “It will also trigger privacy law violations that carry multi-billion-dollar penalties—and here's the thing: You can't choose how it's enforced, because both can happen at the same time from the same passage.”
Another perception is that insurance solves many of these issues. In most cases, it doesn't. The best solution for operators, driven home by the panelists, is disciplined communication practices and proactive compliance.
Paul Willis is a Content Director for LinnellTaylor Marketing.