Internet Inbox Cleaning Company Cannot Be Sued For Selling Customer Data When Contract States That They “May” | PARDALIS & NOHAVICKA PRIVACY LAW UPDATE
This week’s case involves UnrollMe, a free internet service that helps consumers unsubscribe from unwanted emails. A customer sued UnrollMe because they found out that they sold user data to third parties, even though the customer signed a privacy policy that disclosed that exact activity.
The customer took the position that that the privacy policy was misleading because it says only that UnrollMe “MAY” sell consumer data, not that it would do so. The court rejected the customer’s argument giving the following example: “If I ask you if I may enter your house, and you say yes, you have given me permission to enter your house.”
The court noted that the customer was probably right that “most users thought UnrollMe would reduce the noise of internet marketing rather than increase it. But while UnrollMe’s conduct may be unseemly, it still falls within the ambit of the privacy policy.”
The customer also tried to argue that UnrollMe’s privacy policy was unconscionable because it was “a dense take-it-or-leave-it contract.” Rejecting that argument as well, the court commented that the customer “had a meaningful choice: they could have closed their browser window and not used UnrollMe.”
Two Lessons:
The first lesson: the word “may” can have different meanings in different contexts. There is a difference between “X may happen” (a possibility) and “we may do X” (permission).
The second lesson: No such thing as a free inbox scrub.
Here is the case: https://cases.justia.com/federal/district-courts/new-york/nysdce/1:2017cv07102/480699/66/0.pdf?ts=1528364342
FAQ's:
Q: Can Internet companies sell personal data?
A: If users agree to privacy policies that say they "may" sell personal data, the user has granted a company the ability to sell their personal data without legal repercussions.
Q: What if I do not want to sign over the right to sell my personal data?
A: Contracts that are dense, "take-it-or-leave-it" contracts, do not allow individuals to make reservations for certain clauses. If you are uncomfortable with a "take-it-or-leave-it" privacy clause, avoid allowing the company in question by not signing the contract, and not retaining their services.