High School Reunion Ruin: Classmates.com Sued Over Opt-Out Privacy Setting Change

classmates.com

Two members of networking site Classmates.com have sued the service for allegedly violating their privacy by revising the service to make members' information more accessible to the Web at large. In a complaint filed in federal district court in Seattle, Classmates.com users Thomas Ferguson and Patrick Fahy allege that the company's new default settings could expose members to "a panoply of harms," including identity theft, harassment and stalking.

The lawsuit stems from an email that Classmates.com allegedly sent to members in late January announcing that it planned to make information about members -- including their names and photos -- available via Facebook, iPhone apps and other sites and devices. "To make it easier for old friends -- including you! -- to reunite, we're coming up with ways to let more people use Classmates from around the Internet without having to visit Classmates.com," the email allegedly said.

The site told members that they could opt out of the change, but Ferguson and Fahy allege that the notice was worded "in such an innocuous and favorable manner that users would not even be tempted to 'opt out' of the new policy."

Ferguson, a New Jersey resident, and Fahy, a New York resident, allege that Classmates.com breached its contract with users by changing the settings, on an opt-out basis, without first making "full disclosure of the effects and implications of the proposed alterations."

They also argue that the wording of Classmates.com's explanatory email fell short. For instance, they said, the email talked about a new "Facebook app" and "Facebook application" but didn't elaborate. "The option to reveal personal information to the applications is 'pre-clicked,' they allege. "There is no link there or anywhere to any page view or prototype of the applications to help the user understand what these programs are, how they work, or how they will compromise and undermine the pre-existing privacy protections users have come to expect over the past 15 years."

The allegations in the lawsuit include breach of contract, violations of the federal "Electronic Data Privacy Act" and a Washington state consumer protection act. [See upate below]

The lawsuit is somewhat similar to recent cases filed against Facebook, which also revised its privacy settings. The cases also were brought by the same lead counsel -- New York attorney Roy Jacobs.

Classmates.com did not respond to requests for comment.

But even if the company did make changes to its privacy policy recently, whether it will face liability appears uncertain. Seattle lawyer Venkat Balasubramani says that the federal data privacy act, which Classmates.com is accused of violating, only applies to certain types of stored data. He says it's not clear that the information collected by Classmates.com meets that law's technical requirements.

Balasubramani adds that if the only material that Classmates.com made public was users' names, photos and basic biographical information, the plaintiffs might have a difficult time arguing that the site has compromised their privacy.

"People input their information into Classmates because they're trying to be found by other people," he says. "If you're putting your data on Classmates, it's not locked away under lock and key in your safe."

At the same time, he says, companies that change their privacy policies usually must provide users with adequate notice. Here, Classmates.com's decision to inform people of new default settings by sending their emails at the time of registration -- addresses that may no longer even be in use -- might not have been sufficient.

"At a basic level, if you're going to change your privacy practices, the change has to be clear," he says. "You have to give forward-looking notice, and need some sort of mechanism to make sure people get it."

UPDATE: [3/9/1 11:22 a.m.] While the complaint alleges a violation of the "Electronic Data Privacy Act," the actual name of the federal statute referenced in the lawsuit is the Electronic Communications Privacy Act.

Next story loading loading..