Students are suing a major college admissions test maker for allegedly selling information about their disability statuses with universities, which they say could hurt their chances at getting into schools and impact the rest of their lives.

When students register to take the ACT—a standardized test used for college admissions taken by more than a million high schoolers each year—they answer a barrage of personal questions. As part of this, they are asked to note if they have disabilities that require “special provisions from the educational institution.”

The ACT, which is administered by ACT, Inc., is the only real competitor to the College Board’s SAT exam. The lawsuit claims that the ACT is selling the data it gleans from those student questionnaires—connected directly to students’ individual identities—to colleges, which then use it to make important decisions about admissions and financial aid.

“A lot of students and parents have no idea how these testing agencies, which are gatekeepers to college, are using very sensitive and confidential data in the college admissions process,” Jesse Creed, one of the plaintiffs’ lawyers, told me in a phone call. “[Colleges are] hungry for disability data, because they have limited resources, and it’s expensive to educate people with disabilities.”

In a class action lawsuit filed in U.S. District Court in Los Angeles, they say that this is a “flagrant violations of the privacy and civil rights of students with disabilities... ACT profits off these violations and uses them to gain an edge in the marketplace over its only competitor, the College Board, which does not disclose students’ disabilities to colleges and universities.”

“Student disabilities, classified by kind of disability, are listed as data elements in the searchable database ACT sells to its enrollment management clients (including colleges) as a tool to ‘find the right students for your institution,’” the lawsuit states.

A spokesperson for ACT told me in an email that the agency “does not comment on pending litigation.”

Disability advocate and attorney Marci Miller first spotted this practice, he said, when the Department of Education released a technical assistance publication in May, warning testing agencies to better protect students’ privacy under the law.

In 2002, ACT announced that it would stop flagging the test scores of disabled students who required extra time to complete the test. This lawsuit claims that ACT stopped showing information about students’ disability status on the reports that were sent to students, but continued flagging them on the version of the scores that go to universities. Motherboard was unable to confirm this is the case; it will presumably be litigated as part of the court proceedings.