Campbell et al v. Facebook Inc.

Filing 25

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT with Jury Demand, against Facebook Inc.. Filed by Matthew Campbell, Michael Hurley, David Shadpour. (Sobol, Michael) (Filed on 4/25/2014) Modified on 4/28/2014 (jlmS, COURT STAFF).

Download PDF
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 Michael W. Sobol (State Bar No. 194857) msobol@lchb.com Melissa Gardner (State Bar No. 289096) mgardner@lchb.com LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 275 Battery Street, 29th Floor San Francisco, CA 94111-3339 Telephone: 415.956.1000 Facsimile: 415.956.1008 Rachel Geman rgeman@lchb.com Nicholas Diamand ndiamand@lchb.com LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 250 Hudson Street, 8th Floor New York, NY 10013-1413 Telephone: 212.355.9500 Facsimile: 212.355.9592 Jeremy A. Lieberman Lesley F. Portnoy info@pomlaw.com POMERANTZ, LLP 600 Third Avenue, 20th Floor New York, New York 10016 Telephone: 212.661.1100 Facsimile: 212.661.8665 Patrick V. Dahlstrom pdahlstrom@pomlaw.com POMERANTZ, LLP 10 S. La Salle Street, Suite 3505 Chicago, Illinois 60603 Telephone: 312.377.1181 Facsimile: 312.377.1184 Hank Bates (State Bar No. 167688) hbates@cbplaw.com Allen Carney acarney@cbplaw.com David Slade dslade@cbplaw.com CARNEY BATES & PULLIAM, PLLC 11311 Arcade Drive Little Rock, AR 72212 Telephone: 501.312.8500 Facsimile: 501.312.8505 17 Attorneys for Plaintiffs and the Proposed Class 18 UNITED STATES DISTRICT COURT 19 NORTHERN DISTRICT OF CALIFORNIA 20 21 22 23 MATTHEW CAMPBELL, MICHAEL HURLEY, and DAVID SHADPOUR, on behalf of themselves and all others similarly situated, Plaintiffs, 24 25 CONSOLIDATED AMENDED CLASS ACTION COMPLAINT JURY TRIAL DEMANDED v. 26 Case No. 4:13-cv-05996 FACEBOOK, INC., Defendant. 27 28 CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1172205.1 CONSOLIDATED AMENDED CLASS ACTION COMPLAINT1 1 2 I. INTRODUCTION 1. 3 Defendant Facebook, Inc. (“Facebook”) has systematically intercepted Facebook 4 users’ private Facebook messages without their consent. Facebook’s conduct violates the 5 Electronic Communications Privacy Act, 18 U.S.C. §§ 2510 et seq. (“ECPA”), the California 6 Invasion of Privacy Act, California Penal Code §§ 630 et seq. (“CIPA”), and the California 7 Unfair Competition Law, Cal. Bus. & Prof. Code §§ 17200 et seq. (“UCL”). Plaintiffs seek, 8 individually and on behalf of the Class, injunctive and declaratory relief, restitution, and 9 monetary damages, on behalf of all Facebook users in the United States who have had their 10 Facebook private messages intercepted by Facebook in the manner alleged herein. 2. 11 Plaintiffs Matthew Campbell, Michael Hurley, and David Shadpour are Facebook 12 users who, during the class period, utilized Facebook’s private messaging function, each relying 13 on representations that these private and personal communications would be viewed only by the 14 sender and the recipient. Instead, when their ostensibly private messages contained links to other 15 websites, also known as “URLs,” Facebook scanned those messages and then analyzed the URL 16 in the link. If the website contained a Facebook “Like” button, Facebook treated the content of 17 Plaintiffs’ private messages as an endorsement of the website, adding up to two “Likes” to the 18 page’s count. Facebook acted without consent of its users for its own benefit. 3. 19 Generating “Likes” increases Facebook’s ability to gather massive amounts of user 20 data. Facebook primarily generates revenue from targeted advertising and the fundamental means 21 of amassing the user data needed for effective targeted advertising is through Facebook’s “Like” 22 function. The more data points Facebook has for each of its 1.2 billion users, the more Facebook 23 can take advantage of the data by utilizing complex predictive analytics to enhance the reach and 24 accuracy of its targeted advertising. Therefore, whether or not Facebook premises its targeted 25 advertising directly on the URLs it scans when intercepting private messages, it nonetheless has 26 intercepted private messages with URLs for the purpose of increasing the collection of data which 27 it does directly employ in its targeted advertising. 28 1 This Complaint is submitted pursuant to the Court’s Order of March 11, 2014 (Docket No. 17). 1172205.1 -1- CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 4. In an effort to harness the myriad data points of its users, in the form of placing 2 and publicizing its social plugins across the web, Facebook has intentionally intercepted its users’ 3 private messages, scanned the contents of those electronic communications, and manipulated the 4 contents to attribute actions the users did not intend – “Liking” the web pages they were 5 discussing in their messages – for purposes unrelated to the users’ intent and solely for the benefit 6 of Facebook. 7 II. 8 9 THE PARTIES 5. Plaintiff Matthew Campbell is a resident of Pulaski County, Arkansas. He established a Facebook account in or around January 2009, which he has maintained consistently 10 to the present day. He has used Facebook’s private messaging function throughout the class 11 period for, inter alia, purposes of conveying messages whose content includes URL links. 12 6. Plaintiff Michael Hurley is a resident of North Plains, Oregon. He established a 13 Facebook account in or around October 2008, which he has maintained consistently to the present 14 day. He has used Facebook’s private messaging function throughout the class period for, inter 15 alia, purposes of conveying messages whose content contains URL links. 16 7. Plaintiff David Shadpour is a resident of Los Angeles County, California. He 17 established a Facebook account in our around February 2006, which he has maintained 18 consistently to the present day. He has used Facebook’s private messaging function throughout 19 the class period for, inter alia, purposes of conveying messages whose content includes URL 20 links. 21 8. Defendant Facebook, Inc. is headquartered in Menlo Park, California, and 22 incorporated under the laws of the State of Delaware. 23 III. 24 JURISDICTION 9. Pursuant to 28 U.S.C. § 1331, this Court has original subject matter jurisdiction 25 over the claims of Plaintiffs and the Class that arise under the Electronic Communications 26 Privacy Act of 1986 (“ECPA”), 18 U.S.C. §§ 2510 et seq. 27 28 10. Pursuant to 28 U.S.C. § 1332, as amended by the Class Action Fairness Act of 2005 (“CAFA”), this Court has subject matter jurisdiction over this putative nationwide class 1172205.1 -2- CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 action because the matter in controversy exceeds $5,000,000.00, exclusive of interest and costs, 2 and is a class action in which some members of the Class are citizens of states different than 3 Defendant. See 28 U.S.C. § 1332(d)(2)(A). 4 11. This Court has personal jurisdiction over Facebook because its worldwide 5 headquarters are in California, and because it conducts in California substantial business from 6 which the claims in this case arise. 7 IV. 8 9 10 INTRADISTRICT ASSIGNMENT 12. Venue properly lies in this district pursuant to 28 U.S.C. § 1391(b)(1) because Facebook is headquartered in this district and a substantial part of the events or omissions which give rise to the claims alleged herein occurred in San Mateo County. 11 13. Venue is also proper in this district pursuant to Facebook’s Statement of Rights 12 and Responsibilities, which governs the agreement between Plaintiffs and Facebook and which 13 states in pertinent part that Plaintiffs “will resolve any claim, cause of action or dispute (claim) . . 14 . relating to . . . Facebook exclusively in the U.S. District Court for the Northern District of 15 California or a state court located in San Mateo County.” 16 V. 17 CHOICE OF LAW 14. California law governs the substantive legal issues in the instant matter. 18 Facebook’s Statement of Rights and Responsibilities states in pertinent part that “the laws of the 19 State of California will govern . . . any claim that might arise between you and us.” 20 VI. 21 FACTS COMMON TO ALL COUNTS 15. Facebook operates the world’s largest social-networking website, with 22 approximately 1.2 billion users, representing approximately 51% of all internet users worldwide, 23 accessing its services monthly. Facebook’s online social networking website allows users to 24 communicate through the sharing of text, photograph, video, and internet content. 25 16. The core purpose of Facebook is to facilitate communication among its users. 26 Facebook facilitates public communications via Facebook pages, and private communications via 27 personal messages and chats. Chats happen in real-time and often give the appearance of 28 conversation. 1172205.1 -3- CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 17. In order to establish a Facebook account, a user must acknowledge Facebook’s 2 Statement of Rights and Responsibilities and its Privacy Policy. Facebook’s main page states, 3 “By clicking Sign Up, you agree to our Terms and that you have read our Data Use Policy.” See 4 https://www.facebook.com.2 Within this sentence, the word “Terms” contains a hyperlink to 5 Facebook’s “Statement of Rights and Responsibilities;” (Statement of Rights and Responsibilities, 6 https://www.facebook.com/legal/terms), and the words “Data Use Policy” contain a hyperlink, 7 leading to Facebook’s “Data Use Policy.” Data Use Policy, 8 https://www.facebook.com/about/privacy. 9 18. The Statement of Rights and Responsibilities informs users that it “governs” 10 Facebook’s “relationship with users and others who interact with Facebook.” Under the 11 subsection “Privacy,” the Statement of Rights and Responsibilities provides: 12 Your privacy is very important to us. We designed our Data Use Policy to make important disclosures about how you can use Facebook to share with others and how we collect and can use your content and information. We encourage you to read the Data Use Policy, and to use it to help you make informed decisions. 13 14 15 As with the disclosure on the main page, “www.facebook.com,” the words “Data Use Policy” 16 contain a hyperlink to Facebook’s Data Use Policy. 17 19. Facebook’s Statement of Rights and Responsibilities and its Data Use Policy 18 specify the nature of the user “content and information” that Facebook receives and the manner in 19 which it can “use” it. The definition of “content” is expressly limited to data which a Facebook 20 user posts publicly on a Facebook page, and the definition of the “Information We [Facebook] 21 Receive About You” contained in the Data Use Policy excludes the content of users’ private 22 messages, including the content of users’ private messages which include an embedded link to a 23 URL. Facebook fails to disclose that it systematically scans URLs transmitted via private 24 message across its social network. 25 26 20. Facebook provides users with a spectrum of communication methods, “[d]epending on whom you’d like to share with.” The options range from the broadest possible 27 28 2 Unless otherwise noted, a citation to any Facebook web page is to the version of that page in effect on December 30, 2013, the date on which the initial complaint was filed in this action. 1172205.1 -4- CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 audience, where posts are viewable to the general public, to posts viewable by small groups of 2 friends, to messages shared “privately” with a single individual. 3 4 21. During the class period, Facebook offered a tutorial on how to communicate either publicly or privately. It stated in pertinent part: 5  6 How to Post & Share  7 Sharing Status Updates and Other Stories How do I share a status or other content on Facebook? 8 Depending on whom you’d like to share with, there are different ways to share content on Facebook: 9  Sharing with a broad audience: Use the share menu that’s located at the top of your homepage and timeline to let others know what’s on your mind. You can update your status and share photos, videos, links and other application content. Things you share will appear as posts on your timeline, and can appear in your News Feed. To control whether or not specific people have the option to view your stories, you can change the privacy settings for each piece of content you post.  Sharing with a small group of friends: Use the Groups feature to share content with a select group of people, like family members, your soccer team or your book club.  10 Sharing with an individual: You can use the share menu at the top of a friend’s timeline to write or share something on his or her timeline. Friends of your friend will also be able to view your post. If you’d like to 11 12 13 14 15 16 share something privately, you can always send someone a private message. 17 18 19 Facebook Help Center, How to Post & Share (bold and italic emphasis added). 22. 20 Facebook’s private message function combines email, chat, text messaging, and 21 Facebook’s in-service messaging feature, thereby enabling users to send and receive private 22 messages within and outside of Facebook, across different devices such as computers, 23 smartphones, and tablets. 23. 24 Facebook represents to its users that this messaging service is private – that is, a 25 communication made through the service will take place only between the sender and the 26 intended recipient(s). This is evidenced by Facebook’s most basic instructions on how to use its 27 service: “If you’d like to share something privately, you can always send someone a private 28 message.” Indeed, whenever Facebook provides instructions on how to use its messaging service, 1172205.1 -5- CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 it does so in terms assuring private communications. At its website’s “Help Center,” in the step- 2 by-step instruction on how “[t]o send a private message,” under the heading “Who can see my 3 message,” Facebook states, “You and the people you’re messaging with can view the contents 4 and history of your conversation.” Facebook Help Center, Messaging: Messages: Settings & 5 Security: Who Can See My Messages?, 6 https://www.facebook.com/help/212388195458335?sr=16&sid=0ntT7VdfDjw7Y5KSV. 7 24. When it first announced its private messaging service, Facebook represents that its 8 messaging function is “unprecedented” in terms of user control and the protection of privacy, 9 further emphasizing its promise that only the sender and the recipient or recipients are privy to the 10 private message’s content, to the exclusion of any other party, including Facebook. See 11 Seligstein, J., See the Messages that Matter, https://www.facebook.com/notes/facebook/see-the- 12 messages-that-matter/452288242130. 13 25. Contrary to its representations, Facebook has systematically intercepted the 14 contents of users’ “private” messages. Facebook scans the content of users’ private messages that 15 include a URL. On information and belief, whenever a private message contains a URL, 16 Facebook uses a software application called a “web crawler” to scan the URL, sending HTTP 17 requests to the server associated with the URL and then seeking various items of information 18 about the web page to which the URL is linked. On information and belief, Facebook’s 19 interception occurred in transit, in transmission, and/or during transfer of users’ private messages. 20 26. Facebook has developed items of code called “social plugins,” which can be 21 embedded in third-party websites and, when clicked on by visitors, interact with Facebook. One 22 such social plugin is the “Like” button. 23 27. On information and belief, at least until October 2012, Facebook has scanned 24 private messages to produce “Likes” for websites with an embedded “Like” button, where the 25 private message contains that website’s URL. After scanning the content of private messages that 26 include a link to a third-party website, Facebook has searched for information profiling the 27 message-sender’s web activity, and manipulated code in the third-party website to increase the 28 number of “Likes” indicated on the website’s Facebook plugin. 1172205.1 -6- CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 28. On information and belief, during the class period, one of the items of information 2 that Facebook’s web crawlers sought was whether or not the web page associated with the URL 3 contained a “Like” button, and when it did contain a “Like” button, the web crawlers transmitted 4 this information back to Facebook. 5 29. On information and belief, during the class period, Facebook further provided 6 these data to the web page at issue, in the form of analysis of web traffic to that site by Facebook 7 users. 8 9 10 30. On information and belief, Facebook further retained these data for the current or future objective of accumulating and analyzing user data and thereafter refining user profiles and/or enhancing its targeted advertising efforts. 11 31. Facebook’s interception and scanning of the contents of its users’ private messages 12 for the purposes of manipulating code in third party’s websites to register “Likes” is not disclosed 13 in either Facebook’s Terms of Use or its Privacy Policy. 14 32. The effect of embedding social plugins into third-party websites is that it enables 15 Facebook to extend its data gathering practices, keeping tabs on its users’ behavior even after 16 they log out of Facebook. The “Like” button, one of Facebook’s principal social plug-ins, is 17 commonly found on internet web pages. A large number of “Likes” indicates that a web page is 18 popular. A video tutorial on Facebook’s website states: 19 When someone clicks “Like,” they’re highlighting the things that are valuable to them and sharing that with their friends. And when all of this goes to your News Feed, it’s like you have a real time, super-customized window to the most valuable things on the Internet. But we understand that many of the things people care about live outside of Facebook, so we wanted to create a way to bring your friends with you to other websites. So we created social plugins. Social plugins extend the things you love about Facebook to your favorite websites. 20 21 22 23 24 25 Facebook Tutorial Video, Understanding Social Plugins at 0:15 – 0:39 (June 7, 2010), https://www.facebook.com/video/video.php?v=10150210521510484. 26 27 28 33. In practice, Facebook social plugins serve as an extension of Facebook on the internet at large. In addition to Facebook’s “Like” button at the top of a news article, Facebook’s social plugins can take the form of a sidebar feed noting who among the users’ Facebook 1172205.1 -7- CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 “Friends” have read or recommended the article, or featuring a clickable Facebook icon, as 2 circled below. 3 4 5 6 7 8 Somini Sengupta, The Information Gathering Paradox, N.Y. Times, Oct. 26, 2013. 9 10 34. If users are concerned that their extra-Facebook web traffic is being broadcast across the world’s largest social network, Facebook offers this assurance: 11 When you start to see websites that are customized for you all over the Internet, you might wonder if everyone else can see it. But it’s not like that. Although you can see customized information on other sites, all the information lives on Facebook, and Facebook doesn’t share your information with anyone through social plugins. And each person has full control of what they want to share. You’re only sharing the information you want to, and you’re only sharing it with the people you want to share it with. 12 13 14 15 16 35. 17 18 19 20 21 22 Journal showing that Facebook scanned users’ private messages for URLs, further revealing that when a private message contained a link to a third-party web page, and that page had a “Like” social plugin, Facebook registered two “Likes” for that web page via the social media plugin. See Jennifer Valentino-DeVries and Ashkan Soltani, How Private Are Your Private Facebook Messages?, Wall St. J. (Oct. 3, 2012). 36. 23 24 In October 2012, a security researcher published findings in the Wall Street In this first screenshot, the website set up by the security researcher, Ashkan Soltani, “ashkansoltani.org/fb_test.html,” has two “Likes” registered to it: 25 26 27 28 Soltani also provided the html code for the website: 1172205.1 -8- CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 2 3 4 5 6 7 8 Soltani then logged into Facebook and sent a message that contained the URL and the text 9 “testing 1 2 3.” 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Finally, Soltani navigated back to his test website to see if the number of “Likes” registered to it 24 increased, which they did. 25 26 27 28 1172205.1 -9- CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 A video showing Soltani complete this test in real-time can be found as part of the Digital Trends 2 article reporting on it. See McHugh, M., Facebook Scans Private Messages for Brand Page 3 Mentions, Admits a Bug Is Boosting Likes, Digital Trends (Oct. 4, 2012), 4 http://www.digitaltrends.com/social-media/facebook-scans-private-messages/. 5 37. The transmission of the URL in the private message increased the number of 6 “Likes” by a factor of two. The article notes that this practice is described in Facebook’s 7 guidance for developers – administrators of the third-party websites whom Facebook seeks to 8 entice to use social plugins. The developer guidance states that “the number of inbox messages 9 containing” a link to a page will count as “Likes.” 10 38. Facebook does not disclose anywhere in its Privacy Policy its practice of scanning 11 private messages and doling out “Likes” to websites if a URL is contained therein, nor has such a 12 practice ever been announced in any of Facebook’s disclosures to its users. Because Facebook 13 did not disclose this practice to its users, Facebook did not seek nor did it ever gain the consent of 14 its users to intercept their messages, or to use the data thus obtained. 15 39. If, at some point following the Wall Street Journal’s October 2012 exposé, 16 Facebook suspended its practice of intercepting and scanning users’ private messages and doling 17 out “Likes” whenever the scanned message referenced a URL with a social plugin, it has done so 18 quietly, without ever acknowledging either that it had engaged in this practice or that it had 19 discontinued it, nor has it confirmed that it will not engage in this practice in the future. 20 40. On August 27, 2013, the Swiss security firm High-Tech Bridge (“HTB”) 21 announced that it had conducted a test to assess users’ privacy in the fifty largest social networks, 22 web services, and free email systems (“Web Services”). Using the private messaging function of 23 each of the Web Services, HTB embedded in each message a URL unique to each Web Service. 24 HTB then monitored the logs of a dedicated web server for all incoming HTTP requests, to 25 determine whether a Web Service would “click” on the test URLs that had been transmitted in 26 private messages. HTB concluded that Facebook was scanning URLs in private messages. 27 28 1172205.1 - 10 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 41. The presence of a Facebook “Like” button on a web page enables Facebook to 2 collect individual users’ data, which it then employs in developing user profiles to support and 3 deliver targeted advertising – whether or not a user affirmatively clicks on the button. 4 42. The “Like” function is crucial in gathering data points for the profiles and 5 Facebook keeps on its users for purposes of delivering targeted advertising from which it 6 generates substantial revenue. The more websites that incorporate social plug-ins in response to 7 their apparent value to users, the more opportunities are created for Facebook to generate data on 8 users, and increase its own value to – and revenue from – third-party advertisers. 9 43. Any Facebook social plugin, including the “Like” button, is a series of Facebook- 10 controlled code inserted into a web page’s code. As soon as the web page is loaded, “the code 11 invokes a PHP script at Facebook.com that records information including the URL for the Web 12 page, your IP address, and your Facebook ID [if the user is simultaneously logged in on 13 Facebook].” Thus, “widespread use of the Like button allows Facebook to track people as they 14 switch from CNN.com to Yelp.com to ESPN.com, all of which are sites that…implement the 15 feature.” McCullagh, D., Facebook “Like” Button Draws Privacy Scrutiny, CNET News (June 2, 16 2010), http://news.cnet.com/8301-13578_3-20006532-38.html. 17 44. Even if a user does not affirmatively click a “Like” button, the presence on a web 18 page of the “Like” plugin enables Facebook to monitor the user’s online activity, collecting data 19 about the user, even if the user is logged out of Facebook. “If you put a Like button on your site,” 20 an attorney with the ACLU of Northern California cautioned, “you’re potentially selling out your 21 users’ privacy even if they never press that button….It’s another example of why user control 22 needs to be the default in Facebook.” 23 45. Facebook’s revenues depend on user data. Accordingly, Facebook has incentives 24 to encourage widespread placement of “Like” buttons and other Facebook-controlled social 25 plugins throughout the web because each social plugin amounts to a mechanism by which 26 Facebook can monitor internet traffic. 27 28 46. By doling out “Likes” to the web pages that install Facebook’s social plug-ins, Facebook increases the visibility and apparent popularity of these sites online, giving them a 1172205.1 - 11 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 competitive advantage over sites that do not associate with Facebook. A recent Frontline exposé 2 accurately describes “Likes” as Facebook’s “currency.” See Rushkoff, D., Generation Like, 3 Frontline, http://www.pbs.org/wgbh/pages/frontline/media/generation-like/transcript-57/. 4 Websites that do not install Facebook’s social plug-ins are thus at a competitive disadvantage, 5 which Facebook exacerbates when it inflates the number of “Likes” on web pages associated with 6 it by adding a “Like” – or two “Likes” – each time a Facebook user shares the page’s URL in a 7 private message. To stay competitive and attract visitors, websites install Facebook’s plug-ins. 8 Greater participation rates, in turn, broaden the scope of Facebook’s data collection. 9 47. Representing to users that the content of Facebook messages is “private” creates 10 an especially exploitable opportunity for Facebook, because users who believe they are 11 communicating on a service free from surveillance are more likely to reveal facts about 12 themselves that they would not reveal had they known the content was being monitored. Thus, 13 by representing that messaging would remain private, Facebook has positioned itself to monitor 14 user activity in ways that would otherwise be unavailable to it. By scanning users’ private 15 messages, and inferring “Likes” from the content of those messages, Facebook has been able to 16 glean from its users data that they otherwise would not have shared, allowing Facebook to 17 generate even more robust, and accordingly more valuable, user profiles. 18 48. All of Facebook’s activities complained of herein were undertaken without users’ 19 consent. Instead, to increase users’ comfort with the website and, thereby, to increase the amount 20 of information users share, Facebook assures users that they have individual control over privacy 21 settings and messaging options. These assurances affirmatively state that only senders and 22 intended recipients are privy to the contents of users’ nonpublic communications. In reality, 23 Facebook mined any and all transmissions across its network, including those it labels “private,” 24 for its own gain. 25 49. As information is shared by its more than one billion unique users, Facebook is 26 provided with sophisticated, exceedingly detailed data profiles which, when coupled with 27 proprietary analytics algorithms, enable Facebook to place ads throughout users’ accounts based 28 upon the extensive profiles assembled on each and every user. As Facebook has stated: 1172205.1 - 12 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 6 When an advertiser creates an ad, they are given the opportunity to choose their audience by location, demographics, likes, keywords, and any other information we receive or can tell about you and other users. For example, an advertiser can choose to target 18 to 35 year-old women who live in the United States and like basketball. An advertiser could also choose to target certain topics or keywords, like “music” or even people who like a particular song or artist. If you indicate that you are interested in topics, such as by liking a Page, including topics such as products, brands, religion, health status, or political views, you may see ads related to those topics as well. 7 * * * 8 Sometimes we allow advertisers to target a category of user, like a “moviegoer” or a “sci-fi fan.” We do this by bundling characteristics that we believe are related to the category. For example, if a person “likes” the “Star Trek” Page and mentions “Star Wars” when they check into a movie theater, we may conclude that this person is likely to be a sci-fi fan. Advertisers of sci-fi movies, for example, could ask us to target “sci-fi fans” and we would target that group, which may include you. Or if you “like” Pages that are car-related and mention a particular car brand in a post, we might put you in the “potential car buyer” category and let a car brand target to that group, which would include you. 2 3 4 5 9 10 11 12 13 14 Data Use Policy, IV. How Advertising and Sponsored Stories Work, Facebook, 15 http://www.scribd.com/doc/191118234/Facebook-2. 50. 16 The data profiles collected by Facebook enable it to deliver sophisticated targeted 17 advertising. According to a third-party study, broadly targeted campaigns on Facebook (e.g., 18 adults between the ages of 25 and 49) reach the desired audience with 95% accuracy, compared 19 with an industry average of 72%; for more narrowly targeted campaigns (e.g., females between 20 the ages of 25 and 34), Facebook reaches the desired audience with 90% accuracy, compared to 21 an industry average of just 35%. In 2009, 2010, and 2011, targeted advertising accounted for 22 98%, 95%, and 85%, respectively, of Facebook’s revenue. 51. 23 Facebook consciously harvests its users’ data, including through the conduct 24 alleged herein. The more information Facebook acquires, the more nuance and sophistication it 25 can exercise in profiling its users. Acquiring data is useful not only for aggregating traits that 26 users self-select (for example, liking the page for a political candidate could be a good indicator 27 that someone will vote for that candidate) but, as studies have shown, also for revealing attributes 28 that a person would not have chosen to share (such as personality, sexual orientation, religion and 1172205.1 - 13 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 intelligence). See, e.g., Kosinski, M. et al., Private Traits and Attributes are Predictable from 2 Digital Records of Human Behavior, Nat. Acad. of Sci., 110(15), 5802-5805 (2013). Disparate 3 data points when magnified and multiplied a billion-fold produce an exceptionally informative 4 picture. Facebook has shown its interest in using these techniques for enhancing its ad targeting 5 through its own published research. See e.g., Bakshy, E. et al., Social Influence in Social 6 Advertising, 13th ACM Conf. on Elec. Commerce (2012). Therefore, “Likes” generated by 7 Facebook’s interception of users’ private messages provide a trove of information that not only 8 informs Facebook’s knowledge of those users’ choices and characteristics but, combined with 9 other users’ data, produces deep and powerful knowledge of the user base as a whole. 10 52. On information and belief, Facebook retains the user data it has collected, 11 including the “Likes” assigned through intercepting users’ private messages. Facebook exercises 12 dominion and control over the user data it collects, and individual users have no control 13 whatsoever over their own user data collected or retained by Facebook, including any subsequent 14 exploitation, sale, or other use of the data. Dissemination of information about individuals could 15 empower the government against citizens to a degree well beyond the contemplation of the 16 Fourth Amendment. Facebook declares that it only provides the stored contents of any account to 17 the government with a warrant, yet it has been reported that the companies that purchase such 18 information can hand it over to government agencies with no probable cause and with no warrant. 19 Foreign regimes may also gain access to users’ private data after it has been aggregated by 20 companies like Facebook. 21 53. In 1986, Congress passed the ECPA with the express purpose of affording to 22 electronic communications, such as the private online communications at issue here, the same 23 protections that attach to private letters sent via the U.S. Postal Service. In recommending 24 adoption of the ECPA, the Senate Committee on the Judiciary issued the following statement: 25 A letter sent by first class mail is afforded a high level of protection against unauthorized opening by a combination of constitutional provisions, case law, and U.S. Postal Service statutes and regulations. Voice communications transmitted via common carrier are protected by title III of the Omnibus Crime Control and Safe Streets Act of 1968. But there are no comparable Federal 26 27 28 1172205.1 - 14 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 statutory standards to protect the privacy and security of communications transmitted by new noncommon carrier communications services or new forms of telecommunications and computer technology. This is so, even though American citizens and American businesses are using these new forms of technology in lieu of, or side-by-side with, first class mail and common carrier telephone services. 2 3 4 5 6 54. The Senator who introduced the Electronic Communications Privacy Act to 7 Congress described its overarching goal as follows: “We cannot let any American feel less 8 confident in putting information into an electronic mail network than he or she would in putting it 9 into an envelope and dropping it off at the Post Office.” 10 55. In response to the threats posed by internet privacy invasions, the Department of 11 Commerce has recently recommended basic principles for internet regulation that align with the 12 goals underlying the CIPA and the ECPA. First articulated by the Department of Health and 13 Human Services more than 30 years ago, they are known as the Fair Information Practice 14 Principles (“FIPPs”). The FIPPs provide a recognized framework for privacy policies which 15 “provide a framework for balancing the need for privacy with other [commercial] interests.” The 16 GAO has provided an advisory statement affirming that the act of scanning the content of 17 customers’ private messages without consent, for purposes of profiting off of the messages’ 18 content in some way – i.e. the conduct which this complaint alleges Facebook has engaged in – is 19 contrary to the FIPPS and violates the ECPA. 20 56. Facebook’s practices of intercepting and scanning its users’ private messages, for 21 the purposes of manipulating code in third-party websites to register “Likes,” or for purposes of 22 collecting or storing information concerning URL content in the private messages, are not 23 necessary for, or incidental to, Facebook’s ability to provide users the service of sending and 24 receiving private messages, or the protection of its rights or property, and are outside the ordinary 25 course of Facebook’s business as an electronic communication service provider. Facebook has at 26 all times relevant possessed the technical capacity to offer its private message service without 27 intercepting, scanning, and storing the content of users’ private messages. 28 1172205.1 - 15 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 57. Nowhere does Facebook disclose, including in its Statement of Rights and 2 Responsibilities and in its Data Use Policy, that as a matter of course Facebook intercepts, scans, 3 and stores the content of its users’ private messages, or that it uses the content of private 4 messages to register “Likes” on third parties’ websites. 5 58. Facebook misleads users into believing that they have a secure, private mechanism 6 for communication – Facebook’s private messaging function – when, in fact, Facebook intercepts 7 and scans the content of private messages to gather data in an effort to bolster its “social plug-in” 8 network, to improve its marketing algorithms, and to increase its ability to profit from data about 9 Facebook users. 10 VII. 11 12 CLASS ALLEGATIONS 59. Plaintiffs bring this nationwide class action, pursuant to Rule 23 of the Federal Rules of Civil Procedure, individually and on behalf of all members of the following Class: 13 All natural-person Facebook users located within the United States who have sent or received private messages that included URLs in their content, from within two years before the filing of this action up through and including the date when Facebook ceased its practice.3 14 15 16 60. Excluded from the Class are the following individuals and/or entities: Facebook 17 and its parents, subsidiaries, affiliates, officers and directors, current or former employees, and 18 any entity in which Facebook has a controlling interest; all individuals who make a timely 19 election to be excluded from this proceeding using the correct protocol for opting out; any and all 20 federal, state or local governments, including but not limited to their departments, agencies, 21 divisions, bureaus, boards, sections, groups, counsels and/or subdivisions; and all judges assigned 22 to hear any aspect of this litigation, as well as their immediate family members. 23 24 61. before the Court determines whether certification is appropriate. 25 26 Plaintiffs reserve the right to modify or amend the definition of the proposed Class 62. The Class is so numerous that joinder of all members is impracticable. On information and belief, there are more than 166 million Facebook account holders in the United 27 28 3 On information and belief, Facebook ceased this illegal practice at some point after it was exposed in October 2012. This date will be determined through discovery. 1172205.1 - 16 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 States. The number of separate individuals who sent private messages via Facebook, where such 2 message included URLs in the content, within two years before the filing of this action, is likely 3 in the millions, and is identifiable and ascertainable based on Facebook’s records. 4 5 63. There are questions of law or fact common to the Class that will drive the resolution of this case. These questions include, but are not limited to, the following: 6 a. Whether Facebook intentionally intercepted, endeavored to intercept, or 7 procured any other person to intercept or endeavor to intercept Plaintiffs’ and Class Members’ 8 electronic communications sent via Facebook; 9 b. Whether Facebook intentionally used, or endeavored to use, the contents of 10 Plaintiffs’ and Class Members’ electronic communications sent via Facebook, knowing or having 11 reason to know that the information was obtained in violation of 18 U.S.C. § 2511(1)(d); 12 c. Whether Facebook acted intentionally in violating privacy rights; 13 d. Whether Facebook acquired any “contents” of Plaintiffs’ and Class 14 Members’ private messages, within the meaning of 18 U.S.C. § 2510(8); 15 16 e. Facebook were “electronic communications” within the meaning of 18 U.S.C. § 2510(12); 17 18 Whether Plaintiffs’ and Class Members’ private messages sent via f. Whether Facebook used an “electronic, mechanical, or other device,” within the meaning of 18 U.S.C. § 2510(5); 19 g. The amount of statutory damages that should be levied against Facebook; 20 h. Whether injunctive and/or declaratory relief against Facebook should be 22 i. Whether Facebook’s conduct was likely to deceive its users; 23 j. Whether Facebook’s conduct was unlawful; and 24 k. Whether Plaintiffs and Class Members are entitled to restitution. 21 awarded; 25 64. Plaintiffs’ claims are typical of the claims of the Class in that Plaintiffs and the 26 Class sent and/or received private messages via Facebook, where such messages contained URLs 27 in the content. In the process, Facebook intercepted, scanned, and acquired the private messages’ 28 content, sending HTTP requests to the servers housing the web pages referred to in Plaintiffs’ and 1172205.1 - 17 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 Class Members’ private messages. Facebook further used or endeavored to use the contents of 2 Plaintiffs’ and Class Members’ private messages, where Facebook identified URLs to webpages 3 containing social plugins, by manipulating such social plugins to generate “Likes” for web pages 4 and to assemble profiles of users’ web traffic and personal preferences. Plaintiffs and Class 5 Members did not consent to the interception and uses of their private message content, which 6 form the basis for this suit. Plaintiffs and Class Members are entitled to declaratory relief, 7 statutory damages, restitution, and injunctive relief as a result of the conduct complained of 8 herein. Moreover, on information and belief, the conduct complained of herein is systemic. 9 Thus, the representative Plaintiffs, like all other Class Members, face substantial risk of the same 10 injury in the future. The factual basis of Facebook’s conduct is common to all Class Members, 11 and represents a common thread of conduct resulting in injury to all members of the Class. 12 Plaintiffs have suffered the harm alleged and have no interests antagonistic to any other Class 13 Member. 14 65. Plaintiffs will fairly and adequately protect the interests of the Class. Plaintiffs’ 15 interests do not conflict with the interests of the Class Members. Furthermore, Plaintiffs have 16 retained competent counsel experienced in class action litigation. Plaintiffs’ counsel will fairly 17 and adequately protect and represent the interests of the Class. Federal Rule of Civil Procedure 18 23(a)(4) and 23(g) are satisfied. 19 66. Plaintiffs assert that pursuant to Federal Rule of Civil Procedure 23(b)(3), 20 questions of law or fact common to the Class Members predominate over any questions affecting 21 only individual members. 22 67. A class action is superior to other available methods for the fair and efficient 23 adjudication of this controversy. Arguably no Class Member could afford to seek legal redress 24 individually for the claims alleged herein. Therefore, absent a class action, the Class Members 25 will continue to suffer losses and Facebook’s misconduct will proceed without remedy. 26 68. Even if Class Members themselves could afford such individual litigation, the 27 court system could not. Given the complex legal and factual issues involved, and considering that 28 the Class could number in the tens of millions or greater, individualized litigation would 1172205.1 - 18 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 significantly increase the delay and expense to all parties and to the Court. Individualized 2 litigation would also create the potential for inconsistent or contradictory rulings. By contrast, a 3 class action presents far fewer management difficulties, allows claims to be heard which may 4 otherwise go unheard because of the relative expense of bringing individual lawsuits, and 5 provides the benefits of adjudication, economies of scale and comprehensive supervision by a 6 single court. 7 VIII. THE CLASS REPRESENTATIVES 8 69. Plaintiff Matthew Campbell set up a Facebook account in or around January 2009, 9 which he has maintained continuously to the present. During the class period, Plaintiff Campbell 10 used Facebook’s private messaging function for purposes of sending messages containing links to 11 other websites’ URLs. At the time he established his Facebook account, Plaintiff Campbell 12 reviewed the disclosures and statements made by Facebook regarding how information is to be 13 treated on Facebook, and reasonably relying thereon, believed that the content of his private 14 Facebook messages would be seen and used only by him and his recipient. 15 70. Plaintiff Michael Hurley set up a Facebook account in or around October 2008, 16 which he has maintained continuously to the present. During the class period, Plaintiff Hurley 17 used Facebook’s private messaging function for purposes of sending messages containing links to 18 other websites’ URLs. At the time he established his Facebook account, Plaintiff Hurley 19 reviewed the disclosures and statements made by Facebook regarding how information is to be 20 treated on Facebook, and reasonably relying thereon, believed that the content of his private 21 Facebook messages would be seen and used only by him and his recipient. 22 71. Plaintiff David Shadpour set up a Facebook account in or around February 2006, 23 which he has maintained continuously to the present. During the class period, Plaintiff Shadpour 24 used Facebook’s private messaging function for purposes of sending messages containing links to 25 other websites’ URLs. At the time he established his Facebook account, Plaintiff Shadpour 26 reviewed the disclosures and statements made by Facebook regarding how information is to be 27 treated on Facebook, and reasonably relying thereon, believed that the content of his private 28 Facebook messages would be seen and used only by him and his recipient. 1172205.1 - 19 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 IX. CAUSES OF ACTION 2 COUNT ONE 3 (Violations of the Electronic Communications Privacy Act, 18 U.S.C. §§ 2510 et seq.) 4 5 72. stated fully herein. 6 7 8 73. electronic communications. 74. 15 million users in the United States alone, and over one billion users worldwide. 76. 18 web crawlers, and social plugins. 77. 21 via Facebook’s social network. 78. 24 Members. 79. 27 Through Facebook’s scanning of users’ private messages, Facebook acquired and continues to acquire the substance, purport, and meaning of private messages transmitted to and from Plaintiffs and Class Members. 25 26 Pursuant to 18 U.S.C. § 2511(1)(a), Facebook intentionally intercepted, intercepts, or endeavored or endeavors to intercept the electronic communications of Plaintiffs and Class 22 23 Facebook’s actions complained of herein are not necessary practices for providers of electronic communications, nor are they incidental to the act of facilitating private messaging 19 20 Facebook’s actions are and have been intentional as evidenced by, inter alia, its disclosures to developers and the design and implementation of its private messaging service, 16 17 Throughout the entirety of the conduct upon which this suit is based, Facebook’s actions have affected interstate commerce. On information and belief, Facebook has over 166 13 14 Facebook, as a corporation, is a “person” pursuant to 18 U.S.C. § 2510(6). 75. 10 12 Plaintiffs, individually and on behalf of Class Members, assert violations of 18 U.S.C. §§ 2511(1)(a) and (1)(d) for Facebook’s unlawful interception and use of Plaintiffs’ 9 11 Plaintiffs adopt and incorporate each and every allegation of this complaint as if 80. The private messages transmitted to and from Plaintiffs and Class Members via Facebook’s private messaging function are and have been at all relevant times electronic communications. 28 1172205.1 - 20 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 81. Facebook utilizes each accused device for the purpose of acquiring and 2 manipulating content from the message in the course of the message’s transmission, and such 3 course of action does not occur while the private message is in storage. 4 82. Facebook utilized and continues to utilize one or more devices or technology 5 comprised of an electronic, mechanical, or other device or apparatus to intercept the electronic 6 communications transmitted to and from Plaintiffs and Class Members. Such devices or 7 technology include, but are not limited to, web crawlers and social plugins. 8 9 83. and users do not use the devices for connection to the facilities. 10 11 Facebook does not furnish the above-referenced devices or technology to its users, 84. The intercepting devices or technology are not used for the ability to send or receive electronic communications. 12 85. The devices or technology are not used by Facebook, operating as an electronic 13 communication service, in the ordinary course of business as a provider of an electronic 14 communication service. 15 86. Facebook intercepted electronic communications sent by and to Plaintiffs and 16 Class Members (a) for undisclosed purposes; (b) for the purpose of generating “Likes” for third- 17 party websites; (c) for purposes of providing web traffic data to third parties; (d) for purposes of 18 cataloging user data; (e) for purposes beyond facilitating private messages sent via Facebook; (f) 19 in violation of its user agreements; (g) in violation of its public statements to users; (h) in 20 violation of federal and California law; and (i) in violation of the property rights of Plaintiffs, 21 Class Members, and third parties. These activities are not within the ordinary course of business 22 of a provider of an electronic communication service. 23 87. Pursuant to 18 U.S.C. § 2511(1)(d), Facebook intentionally used, uses, or 24 endeavored or endeavors to use the contents of Plaintiffs’ and Class Members’ electronic 25 communications while knowing or having reason to know that it obtained the information through 26 the interception of the electronic communication in violation of 18 U.S.C. § 2511(1)(a). 27 28 88. Facebook’s interception of and use of the contents of Plaintiffs’ and Class Members’ electronic communications were not performed by an employee engaged in any 1172205.1 - 21 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 activity necessary for the rendition of an electronic communication service or for the protection of 2 the rights or property of Facebook. 3 89. Facebook’s practice of intercepting, scanning, and generating “Likes” from, users’ 4 private messages, are not necessary for the rendition of Facebook’s private messaging service, 5 the protection of Facebook’s rights or property, or the security of Facebook users. These scans 6 have not been undertaken in the ordinary course of business of an electronic communication 7 service, as described in 28 U.S.C. § 2510(15). 8 9 90. communications are not electronic communication services. 10 11 Facebook’s services that are not related to the ability to send and receive electronic 91. No party to the electronic communications alleged herein consented to Facebook’s interception or use of the contents of the electronic communications. 12 92. Facebook intercepts Plaintiffs’ and Class Members’ electronic communications for 13 the purpose of committing a criminal or tortious act in violation of the laws of any state, and as 14 such, it cannot obtain consent pursuant to § 2511(2)(d). 15 16 93. As a result of Facebook’s violations of § 2511, pursuant to § 2520, Plaintiffs and the Class Members are entitled to relief as prayed for below. 17 94. While certain devices and/or technology have been identified in this Complaint, 18 Plaintiffs reserve the right to assert ECPA violations as to any further devices and/or technology 19 disclosed or those devices and/or technology upon which Facebook provides additional 20 information. 21 COUNT TWO 22 (Violations of the California Invasion of Privacy Act, Cal. Penal Code §§ 630, et seq.) 23 95. Plaintiffs adopt and incorporate each and every allegation of this complaint as if 24 stated fully herein. 25 96. Plaintiffs, individually and on behalf of Class Members, assert violations of the 26 CIPA, California Penal Code §§ 630, et seq., specifically California Penal Code §§ 631(a) and 27 632, for Facebook’s unlawful interception and scanning of the contents of its users’ private 28 1172205.1 - 22 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 messages. Facebook uses this information about the sender and recipient for purposes of 2 profiling, marketing, and advertising. 3 97. California Penal Code § 630 provides that “The Legislature hereby declares that 4 advances in science and technology have led to the development of new devices and techniques 5 for the purpose of eavesdropping upon private communications and that the invasion of privacy 6 resulting from the continual and increasing use of such devices and techniques has created a 7 serious threat to the free exercise of personal liberties and cannot be tolerated in a free and 8 civilized society.” 9 98. Facebook’s acts in violation of the CIPA occurred in the State of California 10 because those acts resulted from business decisions, practices, and operating policies that 11 Facebook developed, implemented, and utilized in the State of California and which are unlawful 12 and constitute criminal conduct in the state of Facebook’s residence and principal business 13 operations. Facebook’s implementation of its business decisions, practices, and standard ongoing 14 policies that violate the CIPA took place and continue to take place in the State of California. 15 Facebook profited and continues to profit in the State of California as a result of its repeated and 16 systemic violations of the CIPA. Facebook’s unlawful conduct, which occurred in the State of 17 California, harmed and continues to harm Plaintiffs and Class Members. Facebook developed, 18 designed, built, and physically placed in California one or more of the accused devices or 19 technology employed by Facebook to violate the CIPA. 20 21 99. which included URLs, via Facebook’s services. 22 23 100. Facebook is not and was not at any time a party to Plaintiffs’ and Class Members’ private messages. 24 25 Plaintiffs and Class Members sent and received private messages, the contents of 101. The private messages exchanged among Plaintiffs and Class Members are messages. 26 102. These messages are communications among Plaintiffs and Class Members. 27 A. Violations of California Penal Code § 631(a) 28 103. Pursuant to California Penal Code § 7, Facebook, a corporation, is a “person.” 1172205.1 - 23 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 104. Facebook uses a “machine,” “instrument,” “contrivance,” or “in any other manner” 2 is able to, read or to learn the content or meaning of Plaintiffs’ and Class Members’ private 3 messages. 4 5 105. Facebook acts willfully when it reads, attempts to read, or learns the content or meaning of Plaintiffs’ and Class Members’ private messages. 6 106. Facebook does not have the consent of any party to the communication, or it acts 7 in an unauthorized manner, when it reads, attempts to read, or learns the content or meaning of 8 Plaintiffs’ and Class Members’ private messages. 9 10 107. communication.” 11 12 Plaintiffs’ and Class Members’ private messages are “any message, report, or 108. At the time Facebook reads, attempts to read, or learns the content or meaning of Plaintiffs’ and Class Members’ private messages, the private messages are in transit. 13 109. At the time Facebook reads, attempts to read, or learns the content or meaning of 14 Plaintiffs’ and Class Members’ private messages, the private messages are passing over a wire, 15 line, or cable. 16 110. Private messages – coded, written messages sent electronically to remote locations 17 – are telegraphs within the meaning of the CIPA and this section of CIPA. As such, the wires, 18 lines, cables and/or instruments which carry and facilitate the transmission of Plaintiffs’ and Class 19 Members’ private messages are telegraph wires, lines, cables and/or instruments within the 20 meaning of the CIPA and CIPA § 631(a). 21 111. Plaintiffs and Class Members do not consent, expressly or impliedly, to 22 Facebook’s eavesdropping upon and recording of their private messages. Facebook does not 23 disclose material information to its users relating to its attempts at, among other things, 24 intercepting, scanning and reading the contents of users’ private messages. 25 112. There is no knowledge or expectation among Plaintiffs and Class Members 26 regarding the extent of Facebook’s reading of message content, learning about the content or 27 meaning of users’ private messages, the acquisition of such content, the collection of such 28 content, or the manipulation of such content. Each and every one of these actions extends beyond 1172205.1 - 24 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 the normal occurrences, requirements, and expectations regarding the facilitation and 2 transmission of Facebook’s private messages. 3 B. Violations of California Penal Code § 632 4 113. Pursuant to California Penal Code §§ 7 and 632(b), Facebook, a corporation, is a 5 “person.” 6 114. California Penal Code § 632 prohibits eavesdropping upon or the recording of any 7 confidential communication, including those occurring by telephone, telegraph or other device, 8 through the use of an amplification or electronic recording device without the consent of all 9 parties to the communication. 10 11 115. Facebook intentionally and without the consent of any party to the communication eavesdrops upon and/or records the contents of Plaintiffs’ and Class Members’ private messages. 12 116. Facebook uses electronic amplifying or recording devices, including its web 13 crawlers and social plugins, to eavesdrop upon and to record Plaintiffs’ and Class Members’ 14 private messages, for purposes independent and unrelated to storage. 15 16 117. Plaintiffs’ and Class Members’ private messages are confidential communications with specifically identified and designated recipients. 17 118. At the time Plaintiffs and Class Members transmit private messages via Facebook, 18 their communications are confidential because the communications are confined to those persons 19 specified as recipients in the destination address fields. There neither would nor could be any 20 expectation that a third party, such as Facebook, would act in any manner other than to facilitate 21 the communication of the private message between the sender and the intended recipient or 22 recipients. There certainly would not and could not be any expectation that Facebook – a third 23 party – would scan the contents of the private message in an effort to learn and profit from the 24 information contained therein. 25 119. There is no knowledge or expectation among Plaintiffs and Class Members 26 regarding the extent of Facebook’s reading of users’ private message content, learning about the 27 content or meaning of the private messages, acquiring and collecting the content of such 28 messages, and manipulating the content of such messages – each action being beyond the normal 1172205.1 - 25 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 occurrences, requirements, and expectations regarding the facilitation and transmission of private 2 messages via Facebook. 3 4 120. Plaintiffs’ and Class Members’ private messages sent via Facebook are carried on among the parties by means of an electronic device that is not a radio. 5 121. Plaintiffs and Class Members do not consent, expressly or impliedly, to 6 Facebook’s eavesdropping upon and recording of their private messages. Facebook does not 7 disclose material information to its users relating to its attempts at reading, scanning, acquiring, 8 collecting, and manipulating the contents of users’ private messages. 9 122. While Plaintiffs have identified certain accused devices and/or technology in this 10 Complaint, Plaintiffs reserve the right to assert violations of California Penal Code §§ 631 and 11 632 as to any further devices or technology subsequently discovered or any devices or technology 12 upon which Facebook provides additional information. 13 14 123. As a result of Facebook’s violations of California Penal Code §§ 631 and 632, Plaintiffs and the Class are entitled to relief as prayed for below. 15 COUNT THREE 16 (Violations of California’s Unfair Competition Law, Cal. Bus. & Prof. Code § 17200, et seq.) 17 124. Plaintiffs and Class Members reallege and incorporate by reference every 18 allegation set forth in the preceding paragraphs as though alleged in this Count. 19 125. Facebook’s conduct as alleged herein constitutes unfair, unlawful, or fraudulent 20 business acts or practices as proscribed by Section 17200, et seq., of the California Business & 21 Professions Code (“UCL”). 22 126. Facebook’s conduct constitutes “unlawful” business acts or practices by virtue of 23 Defendant’s violation of the Electronic Communications Privacy Act, 18 U.S.C. §§ 2510, et seq., 24 California Penal Code §§ 631(a) and 632. 25 127. Plaintiffs reasonably relied on Facebook’s representations that Plaintiffs’ private 26 messages are viewable only by the sender and the recipient and, as a result, engaged in “private” 27 messaging on Facebook. Facebook failed to disclose to Plaintiffs and members of the general 28 1172205.1 - 26 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 public that it systematically reviews and captures the content of, and metadata associated with, 2 Plaintiffs’ private messages. Facebook failed to disclose that it aggregates the content and data of 3 private messages, using it to turn a profit. Facebook’s Data Use Policy fails to disclose 4 Facebook’s acts or practices, and together with its statements that private messages are viewable 5 only by the sender and the recipient, are likely to deceive members of the public. As a result, 6 Facebook’s conduct constitutes “fraudulent” business acts or practices. 7 128. Plaintiffs have an interest in controlling the disposition and dissemination of their 8 private messages. Contrary to Plaintiffs’ interests, Facebook exercised control over the content of 9 Plaintiffs’ private messages, exploiting it for profit without Plaintiffs’ consent. As a result, 10 Facebook’s conduct constitutes “unfair” business acts or practices. 11 12 129. Plaintiffs have suffered injury in fact and lost money or property as a result of Facebook’s business acts or practices. 13 130. Plaintiffs and Class Members seek an order to enjoin Facebook from such 14 unlawful, unfair, and fraudulent business acts or practices, and to restore to Plaintiffs and Class 15 Members their interest in money or property that may have been acquired by Facebook by means 16 of unfair competition. 17 JURY TRIAL DEMANDED 18 19 Pursuant to Federal Rule of Civil Procedure 38, Plaintiffs, individually and on behalf of the Class they seek to represent, demand a jury on any issue so triable of right by a jury. 20 PRAYER FOR RELIEF 21 22 WHEREFORE, Plaintiffs, on behalf of themselves and all Class Members, request judgment be entered against Facebook and that the Court grant the following: 23 1. An order determining that this action may be maintained as a class action under 24 Rule 23 of the Federal Rules of Civil Procedure, that Plaintiffs are proper class representatives, 25 that Plaintiffs’ attorneys be appointed Class counsel pursuant to Rule 23(g) of the Federal Rules 26 of Civil Procedure, and that Class notice be promptly issued; 27 28 2. Judgment against Facebook for Plaintiffs’ and Class Members’ asserted causes of action; 1172205.1 - 27 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 3. Appropriate declaratory relief against Facebook; 2 4. Preliminary and permanent injunctive relief against Facebook; 3 5. Restitution pursuant to the California Business and Professions Code, Section 4 17200, et seq., including reimbursement to the Plaintiffs and all Class Members of all losses 5 incurred by them as a result of the privacy violations described herein and also including 6 disgorgement of all amounts accruing to Facebook because of its unlawful, unfair, and/or 7 fraudulent business practices; 8 6. Actual damages suffered by Plaintiffs in an amount according to proof at trial; 9 7. An award of damages to Plaintiffs and Class Members pursuant to 18 U.S.C. 10 § 2520; 11 12 8. Penal Code § 637.2; 13 14 An award of damages to Plaintiffs and Class Members pursuant to California 9. An award of reasonable attorney’s fees and other litigation costs reasonably incurred; and 15 10. Any and all relief to which Plaintiffs and the Class may be entitled. 16 17 Dated: April 25, 2014 LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 18 By: 19 /s/ Michael W. Sobol Michael W. Sobol 20 Michael W. Sobol (State Bar No. 194857) msobol@lchb.com Melissa Gardner (State Bar No. 289096) mgardner@lchb.com LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 275 Battery Street, 29th Floor San Francisco, CA 94111-3339 Telephone: 415.956.1000 Facsimile: 415.956.1008 21 22 23 24 25 26 27 28 1172205.1 - 28 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 1 Rachel Geman rgeman@lchb.com Nicholas Diamand ndiamand@lchb.com LIEFF CABRASER HEIMANN & BERNSTEIN, LLP 250 Hudson Street, 8th Floor New York, NY 10013-1413 Telephone: 212.355.9500 Facsimile: 212.355.9592 2 3 4 5 6 Hank Bates (State Bar No. 167688) hbates@cbplaw.com Allen Carney acarney@cbplaw.com David Slade dslade@cbplaw.com CARNEY BATES & PULLIAM, PLLC 11311 Arcade Drive Little Rock, AR 72212 Telephone: 501.312.8500 Facsimile: 501.312.8505 7 8 9 10 11 12 Jeremy A. Lieberman Lesley F. Portnoy info@pomlaw.com POMERANTZ, LLP 600 Third Avenue, 20th Floor New York, NY 10016 Telephone: 212.661.1100 Facsimile: 212.661.8665 13 14 15 16 Patrick V. Dahlstrom pdahlstrom@pomlaw.com POMERANTZ, LLP 10 S. La Salle Street, Suite 3505 Chicago, IL 60603 Telephone: 312.377.1181 Facsimile: 312.377.1184 17 18 19 20 Jon Tostrud (State Bar No. 199502) jtostrud@tostrudlaw.com TOSTRUD LAW GROUP, PC 1925 Century Park East, Suite 2125 Los Angeles, CA 90067 Telephone: 310.278.2600 Facsimile: 310.278.2640 21 22 23 24 25 Attorneys for Plaintiffs and the Proposed Class 26 27 28 1172205.1 - 29 - CONSOLIDATED AMENDED CLASS ACTION COMPLAINT