Scholly Founder Sues Sallie Mae: Data Sale Allegations 2026

Report: Scholly Founder Sues Sallie Mae – Data Sale Allegations Expose Edtech Acquisition Risks

Chris Gray, founder of scholarship search startup Scholly, is suing acquirer Sallie Mae for wrongful termination and alleging the student loan giant sold user data without proper consent. The lawsuit, filed in Delaware Superior Court alongside a whistleblower complaint to the SEC, claims Sallie Mae laid off Gray’s co-founders and fired him after he raised concerns about data privacy. Gray alleges Sallie Mae created a non-bank subsidiary, SLM Education Services, to sell personal data—including age, race, gender, and geolocation—to third parties like universities and advertisers, bypassing regulations that apply to federally regulated banks. This case highlights a critical risk in fintech and edtech acquisitions: the potential for acquirers to exploit regulatory loopholes, undermining the trust that built the acquired company’s brand.

For executives, this is a warning: due diligence on post-acquisition data practices is no longer optional. The outcome could reshape how student data is handled across the industry, with implications for privacy regulation, M&A strategy, and consumer trust.

Context: What Happened

Chris Gray co-founded Scholly in 2013 to help students find scholarships using a matching algorithm based on eight eligibility criteria. The app grew to 5 million users and generated over $30 million in cumulative revenue. After a successful Shark Tank appearance, Gray secured investments from Daymond John and Lori Greiner. In July 2023, Sallie Mae acquired Scholly, making Gray a vice president of product management. Gray believed the sale to a regulated bank would protect user data. However, in July 2024, Sallie Mae laid off the Scholly founding team. Gray alleges he was fired before a scheduled meeting with CEO Jon Witter to discuss data privacy concerns. In December 2024, Sallie Mae launched Sallie.com, owned by SLM Education Services, which sells user data to third parties. In March 2025, Sallie Mae created Backpack Media, an education media network targeting Gen Z and Gen Alpha audiences.

Strategic Analysis: The Structural Implications

This case reveals a strategic play by Sallie Mae to monetize user data through a non-bank subsidiary, avoiding the stricter privacy regulations that apply to its banking arm. The creation of Sallie.com and Backpack Media suggests a deliberate pivot from a regulated financial services model to an unregulated data brokerage. For the edtech and fintech sectors, this raises a critical question: are acquisitions by regulated entities a safe harbor for user data, or a Trojan horse for exploitation?

Gray’s lawsuit alleges that Sallie Mae’s actions violate the Gramm-Leach-Bliley Act, which restricts the sharing of non-public personal information by financial institutions. By placing Scholly under a non-bank subsidiary, Sallie Mae may have found a loophole. This strategy could become a template for other regulated companies seeking to monetize user data, but it also invites regulatory backlash. The Consumer Financial Protection Bureau (CFPB) and state attorneys general are likely to scrutinize such practices, especially given Sallie Mae’s history with Navient, which settled for $1.85 billion over predatory lending claims.

The case also highlights the tension between founder vision and corporate strategy. Gray’s insistence on making Scholly free and protecting user data clashed with Sallie Mae’s revenue goals. This misalignment is common in acquisitions where the acquirer’s business model differs from the startup’s values. For founders, this underscores the importance of negotiating data governance clauses in acquisition agreements.

Winners & Losers

Winners: Competing scholarship platforms can attract disillusioned Scholly users and talent. Consumer data privacy advocates gain a high-profile case to push for stronger regulations. Law firms specializing in privacy litigation will see increased demand.

Losers: Chris Gray and the Scholly founding team face legal costs and reputational damage. Sallie Mae risks negative publicity, legal liability, and potential regulatory fines. Scholly users may have had their data sold without informed consent, eroding trust in the platform.

Second-Order Effects

This lawsuit could accelerate regulatory action on student data monetization. The CFPB and FTC may issue new guidelines or enforcement actions against companies using subsidiary structures to evade privacy laws. State-level privacy laws, like the California Consumer Privacy Act (CCPA), could be amended to close loopholes. The case may also deter future acquisitions of edtech startups by regulated entities, as founders become wary of post-acquisition data practices.

For the broader market, expect increased due diligence on data governance in M&A transactions. Acquirers will need to demonstrate clear data use policies to avoid similar lawsuits. Investors may demand stronger privacy protections in portfolio companies.

Market / Industry Impact

The edtech and fintech sectors face heightened scrutiny. Companies that collect student data must reassess their privacy policies and ensure compliance with existing regulations. The case may also impact the valuation of startups with large user databases, as acquirers factor in potential privacy liabilities. Publicly traded companies like Sallie Mae could see stock volatility if the lawsuit leads to significant legal costs or regulatory penalties.

Executive Action

• Review your company’s data monetization practices, especially if you operate through subsidiaries. Ensure compliance with all applicable privacy laws.
• If you are a founder considering an acquisition, negotiate explicit data governance clauses that restrict how your users’ data can be used post-acquisition.
• Monitor regulatory developments in student data privacy. Prepare for potential new rules from the CFPB or FTC that could impact your business model.

Why This Matters

This case is a bellwether for the future of data privacy in edtech. If Sallie Mae’s subsidiary strategy is deemed legal, it could open the floodgates for other companies to monetize sensitive student data. If it is struck down, it will set a precedent that regulated entities cannot use corporate structures to evade privacy obligations. Either way, the outcome will affect millions of students and the companies that serve them.

Final Take

Chris Gray’s lawsuit is not just a personal grievance; it is a systemic challenge to how student data is handled in the age of consolidation. Sallie Mae’s alleged pivot from bank to data broker reveals a strategic blind spot in the edtech acquisition playbook. Founders and executives must learn from this: trust is the most valuable asset in education technology, and once lost, it is nearly impossible to regain.

Source: TechCrunch Startups