The federal lawsuit accusing iReady's maker of collecting and sharing student data without proper consent survived the company's attempt to have it thrown out. On Sept. 30, U.S. District Judge F. Dennis Saylor IV refused to dismiss five of the suit's nine claims, including a federal wiretap claim, and dismissed the other four.[1]

That isn't a verdict. At this stage, a judge has to treat the complaint's factual allegations as true, "even if doubtful in fact," and decide only whether, if they were, the law would allow a claim. Whether the evidence backs them up comes later.[2]

Wyckoff's K-8 district uses iReady,[3][4] and our earlier explainer on the case laid out what the suit claims. Wyckoff is not a party. The four plaintiffs are California students suing through their mothers, though the complaint seeks to represent everyone in the U.S. who attends or attended a K-12 school and used a Curriculum Associates product.[5] The court has not certified a class.[6]

What survived

The federal wiretap claim. A company normally can't be sued under the federal Wiretap Act for capturing communications sent to itself, unless it captured them in order to commit a separate wrong. Saylor found the complaint alleges enough to support that at this stage, pointing to its claims that the company passed student data to third parties, including Google, in a way that invaded students' privacy. He disagreed with other courts that have held a profit motive rules that exception out: "The statute contains no such language, and many crimes and torts, such as fraud and conversion, are normally committed solely for monetary gain."[7]

Two California eavesdropping claims. Saylor let the plaintiffs proceed on claims that the company itself intercepted student communications and helped Google do the same. He cited the complaint's forensic analysis of one plaintiff's Chromebook, which it says showed Google Analytics sending unique user identifiers to Google when the student opened iReady.[8] He also found the data at issue "uniquely personal": assessment results, behavior while taking tests, predictions about proficiency and, according to the complaint, disability or special-education status. He noted the complaint doesn't specify whether that status was among the data shared with third parties, but said it's a reasonable inference at this stage.[9]

Massachusetts privacy and consumer-protection claims. Saylor found that, at this stage, students who used the product don't need to have bought it to bring a consumer-protection claim, and that whether the company's data practices unreasonably intruded on their privacy is a question for later.[10][11]

The complaint doesn't bring claims under FERPA or COPPA, federal student-privacy laws that don't let families sue under them directly. Saylor treated them as one factor in whether students could expect their data to stay confidential.[9] Our student-privacy law explainer covers what those laws require.

What was dismissed

Saylor threw out four claims:

  • Tracking IP addresses. A California law bars installing "pen registers," tools that record who a device is communicating with, without a court order. Saylor agreed the law can cover internet tracking. But only a tool separate from the source of the data counts, and the complaint described the company's own products as both.[12]
  • Computer fraud. Saylor read this California law narrowly, as covering damage to computers or data, and found the complaint alleged no such damage beyond the data students generated using the company's products.[13]
  • Unjust enrichment, a claim that the company profited unfairly. It can't proceed when other claims in the suit offer a legal remedy for the same harm, whether or not those claims succeed.[14]
  • Negligence. In Massachusetts, purely financial losses generally can't be recovered through a negligence claim unless there's also personal injury, property damage or a special relationship of trust, in which one side places its confidence in the other. The plaintiffs conceded their losses were financial. Saylor declined to find a special relationship between an outside software vendor and the students at the schools it serves.[15]

A different result in a similar case

On Sept. 16, Curriculum Associates filed a notice pointing the court to a Sept. 11 decision from a federal judge in California. It involved a similar suit against Renaissance Learning, another education-software company, brought in part by one of the same mothers. Like Saylor, that judge said a profit motive alone doesn't shield a company from a wiretap claim, but found the plaintiffs there hadn't alleged enough to show a separate wrongful purpose. Saylor found the complaint here did. The judge dismissed the suit without leave to amend and entered judgment for Renaissance.[16] Saylor's order does not mention that decision.[1]

Curriculum Associates' litigation page calls the claims "legally meritless" and says the company does not sell student data, use it for advertising or build commercial profiles on students.[17]

What comes next

In July, the court granted Curriculum Associates' request to pause evidence-gathering. The company had asked for the pause to last until the court ruled on its motion to dismiss. The Sept. 30 order doesn't say whether the pause has ended. It also doesn't address the company's separate, still-undecided request to keep deleting student records that schools ask it to delete while the case is pending. The company says its contracts and state laws require it to honor those requests, and the plaintiffs have opposed the request. As of Oct. 4, nothing had been filed on the court docket since the ruling.[6]

The complaint, as filed, is about consent to collecting and sharing student data in general. It doesn't mention the opinion prompts inside iReady lessons that Wyckoff parent Mia Joudeh raised at the K-8 board's June 29 meeting.[5][18]