Deceptive Privacy Policy: $4.5 Million in Damages

A recent US Federal Court case, CollegeNET, Inc. v. XAP Corp., 2007 WL 927946 (D. Or.), involved two rivals in the competitive college application business.  CollegeNET sued XAP for patent infringement in 2003, and then added an unfair competition claim in 2004.  A jury returned a verdict in favour of CollegeNET.  What’s interesting is that the unfair competition claim resulted in a damage award of $4.5 million for a deceptive privacy policy (compared with the $4 million patent infringement award). 

XAP’s privacy policy stated that personal data wouldn’t be released to third parties “without the user’s express consent and direction.” In the XAP online application process students were asked the following opt-in question: “Are you interested in receiving information about student loans and financial aid?” If the students answered “yes,” XAP forwarded the students’ personal information to its third-party “partners” for a fee.

This was considered to constitute unfair competition, since students were lured away from CollegeNET to use the free XAP system, not realizing that their personal information was being sold to financial institutions and others.

There are two lessons:

  • First, for Canadian companies doing business online with US customers, a well-drafted privacy policy is critical; the pitfalls are not only within the realm of Canadian privacy laws but also in US privacy and trade laws;
  • Second, IP lawyers should think creatively about the possible claims as they did here: a successful intellectual property infringement claim was bolstered and (in terms of the damage award) surpassed by an unfair competition award based on the privacy policy.   

The decision can be accessed here.


Calgary – 15:30 MST 

No comments

No comments yet. Be the first.

Leave a reply

You must be logged in to post a comment.