Deceptive privacy policy leads to multimillion Lanham Act award

CollegeNET, Inc. v. XAP Corp., 2007 WL 927946 (D. Or.)

Previous discussion here. After a jury trial, CollegeNET won a patent infringement claim, as well as its Lanham Act false advertising claim. The jury awarded $4.5 million in damages. The court rejected XAP’s argument that the Lanham Act claim was barred by laches, accepted the jury’s award of damages, refused to award extra recovery of XAP’s profits, and found that CollegeNET was entitled to attorneys’ fees because XAP’s conduct was willful.

Some background: CollegeNET and XAP each allow high school students to apply online for admission to colleges and universities. While CollegeNET charges each school for each student application, XAP offers its services to schools free. XAP makes its money in part from the sale of students’ personal data, submitted in their online applications, to “state agencies, departments of education, student-loan guarantee authorities, and commercial-lending institutions such as banks.”

XAP’s privacy policy promises that personal data isn’t released to third parties “without the user's express consent and direction.” At all relevant times, students using XAP were asked an “opt-in” question when creating certain types of accounts: “Are you interested in receiving information about students loans and financial aid?” XAP treated a “yes” answer as “express consent and direction,” and forwarded the student’s personal information to its partners for a fee.

The court found clear and convincing evidence that XAP didn’t inform students that a “yes” answer was “express consent and direction,” though it could have included such clarifying language. Further, XAP chose not to do this because it was a “bad idea” that would result in fewer opt-ins and lower revenues. Indeed, “XAP intended its privacy-policy statements to lull students into a false sense of security regarding the privacy of [their] personal information.” Though there was no direct evidence that students were actually deceived, the court found that there was a presumption of deception arising from XAP’s bad faith, and that XAP “knew its deception substantially increased the number of students who answered ‘yes’ to the opt-in question.”

CollegeNET’s expert testified that it suffered $35 million in damages, assuming that all XAP’s college applications included the opt-in feature. The evidence, however, showed that only 15% of the applications had an opt-in. The jury verdict of $4.5 million is slightly less than 15% of CollegeNET’s claimed damages, which the court found appropriate. (It also noted that, under the statute, its only discretion was to increase the damages to the extent that they didn’t fully compensate CollegeNET; there is no corresponding discretion to reduce damages.) XAP’s profits from applications with the opt-in question were $2.5 million. Given that the Lanham Act aims at compensation, not penalty, the court found that disgorgement of XAP’s profits on top of the damages would be inappropriate. Despite avoiding this extra hit, XAP is still on the hook for what’s likely to be substantial attorneys’ fees as well as the $4.5 million in damages.

My question: was the opt-in question really deceptive? Just because XAP knew that it would get fewer opt-ins if it made opt-in sound more alarming doesn’t mean that students were deceived by the actual representations at issue. What could they have thought they were agreeing to when they said they wanted to receive information about student loans and financial aid? I’m surprised that, without direct or survey evidence of deception, the court found not just deception, but willful deception. Eric Goldman may have further thoughts, given his background in privacy policies.