Grinnell College Online Privacy Lawsuit, Did the School Share Your Data Without Consent? Hanfling v. Grinnell College, No. 4:2026cv00213

Grinnell College is facing a proposed class action lawsuit — Hanfling v. Grinnell College, No. 4:2026cv00213 — filed in U.S. District Court for the Southern District of Iowa, alleging the school secretly sells, shares, and tracks data collected from users of its website. If you visited Grinnell’s website to apply for admission, request financial aid, or access any college portal, your personal data may have been shared with third-party advertisers without your knowledge.

Grinnell College Online Privacy Lawsuit — Key Facts

Field	Detail
Lawsuit Filed	May 2026
Defendant	Grinnell College
Alleged Harm	Unauthorized data collection, sharing, and tracking of website users
Specific Laws Alleged	Federal Wiretap Act; New York Deceptive Acts and Practices Act; New York False Advertising Law; common law privacy, fraud, and misrepresentation
Who Is Affected	Anyone who visited Grinnell College’s website and had their data shared with third parties
Court & Case Number	U.S. District Court, Southern District of Iowa — No. 4:2026cv00213
Current Court Stage	Proposed class action — class certification pending
Lead Plaintiff Deadline	TBD — no deadline set yet by the court
Settlement Status	No settlement — active lawsuit
Law Firms Involved	Shindler, Anderson, Goplerud & Weese (West Des Moines, Iowa)
Last Updated	May 24, 2026

Who Is Grinnell College and Why Is It Facing an Online Privacy Lawsuit?

Grinnell College is a private, liberal arts college in Iowa. The school operates a website where prospective students apply for admission, manage financial aid, and access college-related portals and support services. That website — and how it handles your personal data — is exactly what this lawsuit is about.

What Did Grinnell College’s Website Allegedly Do to Users Who Visited Without Clicking “I Agree”?

The website displays a “cookie banner” that tells users the site will not use cookies to track them unless they click a button marked “I Agree.” The lawsuit claims that assurance is false. According to the complaint, the website begins placing and transmitting cookies and other third-party tracking technologies the moment users visit — before they can even interact with the cookie banner.

The site’s tools allegedly collect detailed information from users, including data entered into search fields, forms that are submitted, email addresses, and approximate geolocation information. That data is then transmitted to advertising, social media, and analytics companies — including TikTok, Meta, Google, and Reddit.

The complaint calls the cookie banner a deliberate deception. As reported by Iowa Capital Dispatch, the lawsuit argues the banner “lulls users into a false sense of security, privacy, and control, while simultaneously enabling third parties to monitor, intercept, and transmit users’ online behavior in real time without their consent.”

The lawsuit alleges that in July 2024, plaintiff Eyal Hanfling visited the college’s website and that his information was then shared with third parties without his knowledge or consent.

Related article: Medpace Holdings Securities Fraud Lawsuit, Did MEDP Mislead You as an Investor? Durbin v. Medpace Holdings Inc., No. 26-cv-00346

This case fits a growing pattern of university privacy lawsuits — similar to the University of Iowa online privacy violations lawsuit and other data privacy class action cases involving tracking pixels and deceptive cookie banners. If you want background on how the federal Wiretap Act applies to cases like this, our coverage of the Citizens Bank data breach class action lawsuit explains how federal privacy law works in these situations.

Are You Part of the Grinnell College Online Privacy Class Action?

The lawsuit seeks damages for Eyal Hanfling and a putative class of similarly situated users who were allegedly harmed by the site. Here is how to know if you may be included.

You may be part of this class if:

• You visited Grinnell College’s website at any point and had your personal data collected and shared without your consent
• You applied for admission, explored financial aid, or logged into any Grinnell college portal
• You were told through the cookie banner that tracking would not occur unless you clicked “I Agree” — but your data was shared anyway
• Your email address, geolocation data, or form submissions were transmitted to companies like Meta, TikTok, Google, or Reddit without your knowledge

You are likely NOT part of this class if:

• You clicked “I Agree” on the cookie banner, which may have authorized some level of data sharing
• You have never visited Grinnell College’s website in any capacity

Grinnell College Website Users Outside Iowa — Are You Still Covered?

Yes. The case is filed in federal court — the U.S. District Court for the Southern District of Iowa — and the lawsuit seeks class action status on behalf of all similarly situated users, not only Iowa residents. If you visited Grinnell’s website from New York, California, or any other state, you may still be part of the proposed class. The lead plaintiff, Eyal Hanfling, is himself a New York resident.

If you are unsure whether you are part of the Grinnell College online privacy lawsuit, a free consultation with a data privacy attorney can help you assess your situation before any deadlines are set by the court.

What Are Grinnell College Website Users Asking the Court to Award in the 2026 Privacy Lawsuit?

The lawsuit claims the amount in controversy exceeds $5 million, and that the number of potential class members is more than 100, giving the federal court jurisdiction in the matter.

The complaint seeks damages under several legal theories, including the federal Wiretap Act, New York’s consumer protection statutes, and common law claims related to privacy and fraud.

What Could Grinnell College Website Users Receive If the 2026 Privacy Case Settles?

No money is available yet, and no claim form exists. This case is still in its early stages — Grinnell College has not even filed a formal response to the lawsuit yet. Any eventual recovery would depend on the number of class members who come forward, the strength of the evidence, and what the parties negotiate. It is impossible to predict a per-person payout at this stage. Speaking with a data privacy attorney can help you understand your individual options.

What Should Grinnell College Website Users Do Right Now?

No immediate legal action is required to be part of this class. Most class members are automatically included if the court certifies the class — you do not need to file anything today. Here is what you should do now to protect your position:

1. Save any records showing you visited Grinnell College’s website — browser history, emails from the college, application confirmations, or financial aid correspondence
2. Document the dates you used the site, particularly if you submitted forms, searched for programs, or created a portal account
3. Note whether you clicked “I Agree” on the cookie banner or closed it without clicking — this detail may matter
4. Monitor the case docket at the U.S. District Court for the Southern District of Iowa under case No. 4:2026cv00213
5. Watch for a lead plaintiff deadline — the court has not set one yet, but if you suffered significant, documented harm, you may want to speak with an attorney about whether applying as lead plaintiff makes sense for you
6. Consider speaking with a data privacy attorney — a free consultation costs nothing and can help you understand exactly where you stand

Grinnell College Online Privacy Lawsuit Timeline

Milestone	Date
Alleged data sharing begins	Ongoing — July 2024 confirmed in complaint
Eyal Hanfling visits Grinnell website; data allegedly shared	July 2024
Lawsuit filed in Southern District of Iowa	May 2026
Grinnell College response to lawsuit	TBD — not yet filed as of May 19, 2026
Class certification hearing	TBD — not yet scheduled
Lead plaintiff deadline	TBD — not yet set by court
Expected resolution	TBD — early-stage litigation

Grinnell College Online Privacy Lawsuit — Frequently Asked Questions, No. 4:2026cv00213

Is there a class action lawsuit against Grinnell College for privacy violations right now?

 Yes. A proposed class action lawsuit was filed in May 2026 against Grinnell College in U.S. District Court for the Southern District of Iowa, alleging the school secretly sells, shares, and tracks data from users of its website. The case number is 4:2026cv00213. The court has not yet certified the class.

Do I need to do anything right now to be included in the Grinnell College privacy class action?

 No immediate action is required. If the court certifies the class, eligible members are typically included automatically. You should save any records of your visits to Grinnell’s website and monitor the case docket for updates.

When will the Grinnell College privacy lawsuit settle? 

There is no settlement at this stage. Grinnell College has not yet filed a response to the lawsuit. Settlement negotiations, if they occur at all, would come later in the litigation process — typically after class certification and discovery.

Can I file my own lawsuit against Grinnell College for privacy violations instead of joining the class? 

Yes, you can pursue an individual lawsuit, but it requires hiring your own attorney and proving your specific damages independently. Most people in this situation find that participating in a class action is simpler and less costly. A data privacy attorney can help you weigh both options based on your specific circumstances.

How will I find out if the Grinnell College lawsuit settles?

 You can monitor the docket directly through the U.S. District Court for the Southern District of Iowa (case No. 4:2026cv00213) via PACER. You can also check AllAboutLawyer.com, as we will update this article when any material change occurs in this case.

What specific laws does Grinnell College allegedly violate in this lawsuit? 

The lawsuit alleges violations of the federal Wiretap Act, New York’s Deceptive Acts and Practices Act, New York’s False Advertising Law, and common law violations related to privacy, fraud, and misrepresentation.

What does “lead plaintiff” mean, and why does it matter here? 

A lead plaintiff is a class member who agrees to represent the entire group in court. They work closely with the attorneys and may receive a larger share of any recovery. The court has not yet set a lead plaintiff deadline in this case — but if you believe you suffered significant harm, speak with a data privacy attorney now before a deadline is announced.

How much could Grinnell College website users receive from a future privacy settlement? 

There is no way to predict a specific payout at this stage. The lawsuit claims the amount in controversy exceeds $5 million, but that is a jurisdictional threshold, not a guaranteed payout per person. Individual recoveries in similar privacy cases have ranged from small statutory amounts to several hundred dollars per person, depending on the number of claimants and the strength of evidence. A data privacy attorney can give you a more informed estimate based on comparable cases.

Sources Used in This Grinnell College Online Privacy Article

• Iowa Capital Dispatch — “Grinnell College faces class-action lawsuit alleging privacy violations,” May 19, 2026

Prepared by the AllAboutLawyer.com Editorial Team and reviewed for factual accuracy against the Iowa Capital Dispatch report and Justia docket records for case No. 4:2026cv00213 on May 24, 2026. Last Updated: May 24, 2026.

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For advice about your specific situation, consult a qualified attorney.