User Privacy and Information Disclosure: The Need for Clarity in Opt-in Questions for Consent to Share Personal Information

Many company Web sites obtain permission to disclose their users’ private information to third parties through the use of “opt-in” mechanisms, which require consumers to affirmatively grant consent to collect data from the user. These opt-in questions often ask general questions, such as whether the user would like to receive further information about the company or a product. Many companies construe an affirmative answer as consent to disclose personal information in accordance with its privacy policy. Although companies with this practice have generally avoided liability in the past, a recent case raises significant skepticism regarding the practice. In CollegeNET, Inc. v. XAP Corp., a U.S. district court held that answering “yes” to an opt-in question may not qualify as express consent to disclose a user’s private information. This Article addresses the potential causes of action, and likelihood of their success, against companies with these types of business practices. This Article also suggests that it is a good business practice to provide unambiguous opt-in questions to obtain informed consent from users before disclosing their personal information