Two previous Privacy In Focus articles discussed the ongoing litigation between CollegeNet, Inc. and XAP Corporation involving allegations under the Lanham Act of deceptiveness of XAP's privacy promises to users of its service. The Lanham Act, 15 U.S.C. § 1125 (a), creates a private right of action in favor of any person "likely to be damaged" by a "misleading representation of fact" about commercial goods or services. In that context, our earlier pieces discussed the need for clarity in "opt-in" questions used to secure consent to share personal information, and advised that companies should take care to word clearly any opt-in questions that would permit the selling or sharing of personal data (see the September and November 2006 Privacy In Focus issues). A recent ruling granting CollegeNet's motion for permanent injunction against XAP confirms the need for companies to be vigilant about the manner in which they secure consent to share personal data. CollegeNet, Inc. v. XAP Corporation 2008 U.S. Dist. Lexis 32344 (D. Ore.). Perhaps even more importantly, the ruling highlights the potential utility of the Lanham Act for private business plaintiffs harmed by a competitor's misleading privacy practices.

Litigation Background

CollegeNet and XAP offer online college admission application services to prospective students, colleges and universities. Their business models differ in that CollegeNet requires colleges to pay a fee for inclusion in its services, while XAP does not. Instead, XAP receives payments from state agencies, departments of education, banks and other lending institutions. These institutions pay XAP in exchange for students' personal data, which they use to target students for marketing educational loans.

The litigation between CollegeNet and XAP centered around a representation in XAP's website privacy policy that "[p]ersonal data entered by the User will not be released to third parties without the user's express consent and direction." However, XAP also asked the following question: "Are you interested in receiving information about student loans or financial aid?" If a user answered "yes" to this question, XAP would treat that as consent for it to provide commercial institutions with the user's personal data for a fee.

CollegeNet brought a claim against XAP for unfair competition under the Lanham Act asserting that this conduct amounted to unfair competition because XAP falsely assured customers that confidential information would not be disclosed, when in reality it shared the personal information of those who affirmatively answered the vague opt-in question. A jury found in favor of CollegeNet, concluding that XAP deceptively obtained and sold the personal information of students in contravention of its representation that it would not release personal information to third parties without students' express permission. In an advisory verdict, the jury set the unfair competition damages suffered by CollegeNet at $4.5 million. The court adopted the jury's advisory verdict and also found XAP's unfair competition to be willful, thus constituting sufficient exceptional circumstances to justify awarding attorneys' fees to CollegeNet.

The Permanent Injunction

In the most recent decision in the CollegeNet case, announced earlier this year, U.S. District Judge Anna J. Brown considered another claim by CollegeNet under the Lanham Act alleging that XAP was continuing to engage in misleading privacy practices. At issue were the sufficiency of various modifications that XAP had made to its privacy practices and opt-in question designed to provide greater clarity and ameliorate any confusion on the part of users of its site. The court concluded that these revisions were inadequate, however, because "they fail[ed] to convey in clear and unequivocal language that when they check the 'Yes' box, students are giving 'express consent and direction' to [XAP] to provide their personal information to third parties who have paid a fee to [XAP] in part for their right to receive that information."

In support of this conclusion, the court cited testimony from CollegeNet's expert witness, who opined that the changes and new statements regarding information sharing were vague and further concealed the consent information, leaving the "infrastructure for deception" in place. The court found that this continued deception on the part of XAP put CollegeNet in a position in which it will "continue to suffer irreparable harm by remaining at a competitive disadvantage to [XAP] as to online application systems used by [XAP] that do not adequately disclose to students that they are authorizing [XAP] to provide their personal information to third parties . . . if the students answer 'Yes' to the opt-in question."

Balancing the equities in the case, the court concluded that it would not be an undue hardship to require XAP to make clear to students that an affirmative response to the opt-in will result in disclosure of personal information to third parties, and further determined that the inclusion of such conspicuous language would serve the public interest. Accordingly, the court issued a permanent injunction that required XAP "to inform student applicants in plain, concise, and conspicuous language set forth immediately preceding the opt-in question that by answering 'Yes' to that question the applicant understands he or she specifically is authorizing [XAP] to disclose . . . personal information" to third parties. The court indicated that the form of this disclosure should include a description of the personal information to be disclosed, identify the entities that will receive such information and describe the purposes for which such entities will receive such information.

Lanham Act as Remedy

For years, privacy experts have said that the difficulty in stating claims and identifying damages were explanations for the relatively low number of private privacy lawsuits. The CollegeNet litigation demonstrates that the Lanham Act may provide a valuable new tool for private plaintiffs alleging competitive injury, as it allows claims based on deceptive privacy practices. Using the Lanham Act—which prohibits the use of false or misleading representations that are likely to deceive or confuse consumers with respect to commercial goods or services—in this way is novel. The Lanham Act is typically applied in the antitrust context and to advertising claims.

CollegeNet illustrates a court's willingness to accept this atypical application of the Lanham Act, and thus opens the door to further use of this legal remedy, through which a company might be subject to a privacy suit from a whole new class of plaintiffs—competitors who can allege a cause of action for false or misleading statements regarding privacy practices or the handling of personal information. With privacy statements now fair game for competitor challenge under the Lanham Act, companies must be vigilant about monitoring the clarity of their privacy promises and their conformance with such policies.