Complaint alleges Sallie Mae established a plan and scheme to circumvent federal data-privacy protections related to the use and disclosure of student data, and retaliated against the executive who reported it.

WILMINGTON, Del., April 29, 2026 /PRNewswire/ -- Christopher Gray, founder of scholarship-matching platform Scholly and current CEO of AI test-prep platform Path, has filed a whistleblower and data-privacy lawsuit against SLM Corporation (NASDAQ: SLM), the parent company of Sallie Mae Bank, and its non-bank subsidiary SLM Education Services, LLC, in Delaware Superior Court. The complaint alleges that Sallie Mae built a deliberate corporate structure to sell the personal data of millions of students, including minors, while evading the federal privacy law that would otherwise prohibit it.

At the heart of the complaint is a two-entity structure. Salliemae.com is operated by Sallie Mae Bank, a federally regulated, FDIC-insured bank covered by the Gramm-Leach-Bliley Act (GLBA), which prohibits banks from selling nonpublic personal financial information. Sallie.com website is almost identical, holds the same branding, including logo and brand colors, but is operated by a different entity: SLM Education Services, LLC, a non-bank subsidiary not subject to those restrictions. Sallie.com's publicly posted privacy policy states, in the company's own words, that it "sells" and "shares" personal information, including sensitive personal information, for advertising and marketing purposes.

The complaint alleges this architecture was designed to circumvent GLBA, which prohibits a financial institution from disclosing nonpublic personal information to nonaffiliated third parties, directly or through any affiliate.

The impact of this scheme reaches millions of users. On March 4, 2026, Sallie Mae publicly launched Backpack Media, an advertising platform operated through SLM Education Services. Its marketing materials offer brands access to an audience of "8.5 million students, families, and young professionals", most of them are minors looking for student loans and scholarships.

Gray has also filed a formal whistleblower complaint with the U.S. Securities and Exchange Commission's Office of the Whistleblower regarding the matters at issue in the litigation. By making these filings, Gray is protected under the anti-retaliation provisions of the Delaware Whistleblowers' Protection Act and Section 21F of the Securities Exchange Act, as amended by the Dodd-Frank Act. Any further retaliatory conduct by Sallie Mae, including continued pressure on Gray, his current company, or his former Scholly shareholders, is itself actionable under both statutes and subject to additional federal and state penalties.

Sallie Mae acquired Scholly in June 2023, and Gray joined the company as a senior executive. According to the complaint, he discovered the data-monetization plan and raised concerns internally. Executives knew Gray was planning to bring those concerns directly to Sallie Mae CEO Jon Witter at a breakfast meeting scheduled through the CEO's office. He was abruptly terminated before that meeting could take place.

After the termination, Sallie Mae's Chief Legal Officer, Nicholas Jafarieh, met with Gray's counsel. According to the complaint, he admitted the company "handled [Gray's] termination wrong." In the same meeting, he warned that Gray did not "want to make an enemy" of the company.

As alleged in the complaint, in the lead-up to the filing, Sallie Mae made repeated threats to compel Gray's claims into private, confidential arbitration to keep the allegations off the public record. When that pressure failed and Gray filed his complaint in open court on April 13, the company escalated in a different direction. Its outside counsel sent a demand letter to Gray's former Scholly shareholders and explicitly tied a threat of financial clawback to Gray's communications with the press.

"I built Scholly to help students access money for college, not to help a bank sell their personal information to advertisers," Gray said. "When I saw what was happening inside Sallie Mae, I reported it. What followed was a campaign to keep the matter out of public view — their response was to fire me, threaten me, and try to silence me. Sallie Mae borrowers and employees are typically bound by mandatory arbitration agreements that keep disputes out of open court. This case is different as I'm protected, I can speak and I will."

The complaint is a matter of public record in Delaware Superior Court. A copy is available upon request.

Christopher Gray is the founder of Scholly, a scholarship-matching platform that grew to 5 million users and helped students access more than $100 million in scholarship funding. Gray appeared on ABC's Shark Tank in 2015 and 2024 and was named to the Forbes 30 Under 30 list. Originally from Birmingham, Alabama, Gray won approximately $1 million in scholarships to attend college which inspired him to create Scholly. He is currently the founder and CEO of Path, an AI-powered test-prep platform for K-12 students. He is represented in this matter by Allen and Associates.

Path is an AI-powered test prep platform founded by Christopher Gray. The platform offers AI-driven test preparation for K-12 state exams, college admissions, and professional certifications.

View original content to download multimedia:https://www.prnewswire.com/news-releases/scholly-and-path-founder-files-whistleblower-lawsuit-against-sallie-mae-alleging-the-company-is-using-a-shell-company-to-sell-millions-of-students-data-302757439.html

SOURCE Christopher Gray