Grinnell College faces class-action lawsuit alleging privacy violations

A proposed class-action lawsuit has been filed against Iowa’s Grinnell College, alleging the school “secretly sells, shares and tracks” data collected from users of its website.

Attorneys for Eyal Hanfling, a resident of New York, are seeking class-action status for the civil lawsuit they have filed against Grinnell College in U.S. District Court for the Southern District of Iowa.

The lawsuit claims the private, liberal arts college operates a website through which users can apply for admission and financial aid, create and manage user accounts through college-related portals, and access educational, administrative, and support services.

The website allegedly displays a “cookie banner” purporting to give users meaningful control over what data the site shares with third parties, with users informed that the site will not use cookies to track users unless they click a button marked, “I Agree.”

The lawsuit claims that assurance is false. “The website begins placing and transmitting cookies and other third-party tracking technologies capable of intercepting and transmitting users’ data, including communications, the moment users visit the website — before they can interact with the cookie banner,” the lawsuit asserts.

According to the lawsuit, the site’s tools collect detailed information from users, including data entered into search fields, forms that are submitted, email addresses, and approximate geolocation information. The site then uses “tools which transmit users’ sensitive information to the advertising, social media, and analytics companies that designed and operate” those same tools, such as TikTok, Meta, Google and Reddit, the lawsuit alleges.

The cookie banner “misleads users about the use, sharing, and sale of their data,” the lawsuit asserts, adding that the site “lulls users into a false sense of security, privacy, and control, while simultaneously enabling third parties to monitor, intercept, and transmit users’ online behavior in real time without their consent.”

The lawsuit alleges that in July 2024, Eyal Hanfling visited the college’s website and that his information was then shared with third parties. The lawsuit seeks damages for Hanfling and a putative class of similarly situated users who were allegedly harmed by the site.

“The unauthorized collection of a person’s browsing activity, website interactions, and personal identifiers constitutes an invasion of the most basic expectation of privacy in one’s online life,” the lawsuit alleges.  “When a company affirmatively represents that users may control whether their data is sold, shared, or tracked, but then secretly sells, shares, and tracks that data anyway, the misconduct is especially egregious.”

The lawsuit alleges violations of New York state’s Deceptive Acts and Practices Act and False Advertising Law, as well as violations of the federal Wiretap Act and common law violations related to privacy, fraud, and misrepresentation. The lawsuit claims the amount in controversy exceeds $5 million, and that number of potential class members is more than 100, giving the federal court jurisdiction in the matter.

The plaintiff is represented by West Des Moines attorneys J. Barton Goplerud and Brian O. Marty of Shindler, Anderson, Goplerud & Weese.

Grinnell College has yet to file a response to the lawsuit. The school’s Media Relations office did not immediately return messages Tuesday seeking comment.