Claims Liberty University shared students’ prayer requests with advertisers advances

LYNCHBURG, Va. (CN) — A Virginia-based federal judge rejected Liberty University’s motion to dismiss claims that it allowed digital advertising giants to access students’ sensitive information, including grades and prayer requests.“It is difficult to imagine information more personal and more sensitive than the details of a prayer request,” Senior U.S. District Judge Norman Moon, a Bill Clinton appointee, said. “It is also conceivable that some people would wish to closely guard their grades from public view.”Arizona native Kyler Lyons sued his university after discovering a connection between the university’s student portal and third parties, including Meta Platforms, Microsoft and Alphabet. Lyons accuses the university of transmitting his and a proposed class of other students’ highly sensitive data he says includes prayer requests that students post anonymously for other students and faculty at the Baptist university to add to their prayer lists.Lyons’ attorney Sonjay Singh of Siri & Glimstad cited traditions dating to the Middle Ages of priests safeguarding churchgoers’ confessions.“You know you don’t expect that your religious interactions with the religious university are going to be tracked and disclosed,” Singh said in an interview. “These are some of the things that we believed as a society for a long time, and we’re just trying to protect those rights.”Singh further criticized Liberty University for sharing data as a trusted institution.“Most of us are uncomfortable with it, but most of us know that a lot of what we do online is being tracked and recorded in some way,” Singh said. “But what we don’t expect is that institutions that we trust and that we’ve contracted with under this trust relationship are transmitting the most sensitive aspects of those relationships.”Lyons, a graduate student, seeks $5 million in damages on federal claims brought under the Family Educational Rights and Privacy Act, which regulates the release and access of education records including students’ names, date of birth and address, and the Electronic Communications Privacy Act. Lyons also sued under state claims of negligence, invasion of privacy, breach of contract and unjust enrichment.Lyons claims injuries including an invasion of privacy, a lack of trust in communicating with educational providers and the emotional distress related to the release of sensitive information.“When website operators, like defendant, make use of the tracking tool providers’ business tools, they are essentially choosing to participate in the tracking tool providers’ mass surveillance network, and in return they benefit from the tracking tool providers’ collection of user data, at the expense of their website users’ privacy,” Lyons says in his complaint. “Despite never telling users like plaintiff and class members, defendant allowed third parties such as the tracking tool providers to intercept plaintiff’s and class members’ sensitive information and use it for advertising purposes.”Liberty argues the information transmitted is exempt from the Family Educational Rights and Privacy Act because it is directory information. The university says schools may disclose directory information — which includes students’ names, addresses, email addresses, major field of study, grade levels and dates of attendance — so long as they give public notice.It claims it complies with the act by providing public notice on its website and by providing a way for students to opt out of the data disclosure, which it argues Lyons did not take advantage of. Liberty further emphasized students are required to accept Liberty’s privacy policy as part of the institutional agreement a student must agree to when applying for admission.In its motion to dismiss, Liberty also said Lyons failed to show that it transmitted any sensitive data like prayer requests.“The complaint contains no plausible factual allegations of any misuse of plaintiff’s information, any financial harm, or any loss or concrete or particularized injury flowing from the alleged transmission of his non-confidential directory information to the tracking tool providers, with whom he willingly maintained an account,” the university said in its motion to dismiss.Moon, however, is obligated to accept Lyons’ factual allegations as true and draw all reasonable inferences in his favor when considering a motion to dismiss.“Liberty argues the court should discount Lyons’ allegations about his grades and prayer requests because the figures Lyons included in his complaint show that the substance of his prayer requests were not actually communicated to third parties,” Moon said. “Yet, the court has no expertise in computer science and Liberty offers no evidence that the figures unequivocally undermine plaintiff’s allegations. At the motion to dismiss stage, the court cannot credit Liberty’s version of the facts, especially when its position is supported by nothing but counsel’s assertion."Moon agreed with Liberty that the Electronic Communications Privacy Act fails, finding Lyons failed to show that Liberty itself captured or recorded the sensitive data using an electronic, mechanical or other device rather than simply allowing the third parties access.“Under Lyons’ own version of events, Meta, Google, and Microsoft are the ‘interceptors’ and Liberty simply let the fox into the henhouse,” Moon said. “Because Liberty is more akin to a procurer than an interceptor and because there is no civil liability for procurers, Lyons’ ECPA claim must be dismissed without prejudice.”Singh did not say whether his client would amend his complaint as to the Electronic Communications Privacy Act claim.Moon noted he may need to resolve disputed facts in deciding whether Virginia or Arizona law applies, and there is a substantive difference between Virginia and Arizona law. But Singh noted Liberty’s purported conduct constitutes an invasion of privacy in all 50 states.According to Lyons, website operators like Liberty use tracking tool providers to access massive databases of consumer information for their own purposes.“In essence, when website operators use the tracking tool providers’ business tools, they choose to participate in the tracking tool providers’ mass surveillance network and, in turn, benefit from the tracking tool providers’ collection of user data at the expense of their customers’ privacy,” Lyons says in his complaint.Attorneys representing Liberty did not respond to a request for comment. Moon has yet to grant class certification to the over 100,000 proposed class members.Subscribe to our free newslettersOur weekly newsletter Closing Arguments offers the latest about ongoing trials, major litigation and rulings in courthouses around the U.S. and the world, while the monthly Under the Lights dishes the legal dirt from Hollywood, sports, Big Tech and the arts.Additional Reads