"In Re: Facebook Privacy Litigation"

Filing 92

AMENDED COMPLAINT (First Amended Consolidated Complaint) against Facebook, Inc.. Filed byMike Robertson, David Gould. (Nassiri, Kassra) (Filed on 6/13/2011)

Download PDF
1 2 3 4 5 6 7 8 9 KASSRA P. NASSIRI (215405) (knassiri@nassiri-jung.com) CHARLES H. JUNG (217909) (cjung@nassiri-jung.com) NASSIRI & JUNG LLP 47 Kearny Street, Suite 700 San Francisco, California 94108 Telephone: (415) 762-3100 Facsimile: (415) 534-3200 EDELSON MCGUIRE LLP SEAN REIS (184044) (sreis@edelson.com) 30021 Tomas Street, Suite 300 Rancho Santa Margarita, CA 92688 Telephone: (949) 459-2124 Facsimile: (949) 459-2123 ASCHENBRENER LAW, P.C. MICHAEL J. ASCHENBRENER (mja@aschenbrenerlaw.com)(pro hac vice) 10 S Riverside Plaza, Suite 1800 Chicago, Illinois 60606 Telephone: (312) 462-4922 Facsimile: (312) 462-4923 10 11 Attorneys for Plaintiffs and the Putative Class 12 UNITED STATES DISTRICT COURT 13 NORTHERN DISTRICT OF CALIFORNIA 14 SAN FRANCISCO DIVISION 15 Case No. 10-cv-02389-JW 16 CLASS ACTION 17 FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT 18 19 IN RE: FACEBOOK PRIVACY LITIGATION ACTION FILED: 05/28/10 20 JURY TRIAL DEMANDED 21 22 Plaintiffs David Gould and Mike Robertson (“Plaintiffs”) bring this suit on behalf of 23 themselves and all others similarly situated, and make the following allegations on information and 24 belief, except as to allegations pertaining to Plaintiffs, which are based on their personal knowledge: 25 I. 26 1. INTRODUCTION Plaintiffs bring this class action complaint against Facebook, Inc. (“Facebook”) for 27 disclosing its users’ sensitive personally identifiable information (“PII”) with Facebook’s advertising 28 -1FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 partners, in violation of Facebook’s own privacy policy, Facebook’s specific and prominent 2 promises to users, accepted industry standards, and federal law. 3 2. Facebook’s own policies state “[w]e never share your personal information with our 4 advertisers” and “[w]e do not give your content of information to advertisers without your consent.” 5 Facebook touts these statements in multiple areas of its site including its privacy policy and multiple 6 posts on its official blog. 7 3. Unbeknownst to its users, and in clear contrast to Facebook’s own stated policies, 8 Facebook intentionally and knowingly transmitted PII, including users’ real names, to third party 9 advertisers without user consent. 10 II. 11 4. PARTIES Plaintiff David Gould is a resident of South Lake Tahoe, California. He is a 12 registered user of Facebook’s services and has been since at least 2008. During the relevant time 13 period, Plaintiff Gould clicked on at least one third-party advertisement displayed on Facebook.com. 14 In registering as a Facebook user and using Facebook’s services, including clicking on 15 advertisements, Mr. Gould relied on Facebook’s promises regarding the privacy of his personal data. 16 5. Plaintiff Mike Robertson is a resident of Marin County, California. He is a registered 17 user of Facebook’s services and has been since at least 2008. During the relevant time period, 18 Plaintiff Robertson clicked on at least one third-party advertisement displayed on Facebook.com. In 19 registering as a Facebook user and using Facebook’s services, including clicking on advertisements, 20 Mr. Robertson relied on Facebook’s promises regarding the privacy of his personal data. 21 6. Defendant Facebook, Inc. (hereinafter, “Facebook”) is a Delaware corporation that 22 maintains its headquarters in Santa Clara County, California. Facebook conducts business 23 throughout California and the nation. 24 III. 25 7. JURISDICTION AND VENUE This Court has personal jurisdiction over Facebook because (a) a substantial portion 26 of the wrongdoing alleged in this complaint took place in this state, (b) Facebook is authorized to do 27 business here, has sufficient minimum contacts with this state, and/or otherwise intentionally avails 28 itself of the markets in this state through the promotion, marketing and sale of products and services -2FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 in this state, to render the exercise of jurisdiction by this Court permissible under traditional notions 2 of fair play and substantial justice. 3 8. This Court has subject matter jurisdiction pursuant to the Class Action Fairness Act 4 of 2005, 28 U.S.C. §§ 1332(a) and 1332(d) because the amount in controversy exceeds 5 $5,000,000.00 exclusive of interest and costs, and more than two-thirds of the users of the putative 6 class are citizens of states different than that of Facebook. Additionally, the Court has subject matter 7 jurisdiction pursuant to 28 U.S.C. § 1331. 8 9. Venue is proper in this District under 28 U.S.C. § 1391(b) and (c). A substantial 9 portion of the events and conduct giving rise to the violations of law complained of herein occurred 10 in this District. Facebook’s principal executive offices and headquarters are located in Santa Clara 11 County, California. 12 IV. 13 STATEMENT OF FACTS A. About Facebook 10. 14 Facebook is the world’s largest social networking website, with over 500 million 15 registered users worldwide. 16 11. 17 According to Facebook, its “mission is to give people the power to share and make the world more open and connected.”1 To accomplish that mission, Facebook allows anyone with 18 access to a computer and Internet connection to register for its services free of charge. 19 12. One of the few requirements Facebook places on its registrants is that they provide 20 their actual names, rather than merely a pseudonymous username, as is commonplace with other 21 website registrations. 22 13. Once registered, a Facebook user may post a multitude of information to their own 23 personal “Facebook profile” page, including their birth date, place of birth, current and past 24 addresses, present and past employment, relationship status, personal pictures, videos, and more. 25 26 27 28 1 http://www.facebook.com/facebook?v=info%ref=pf -3FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 14. Each Facebook user’s account is tied to a user ID number (“UID”) and/or username 2 that uniquely identifies the individual. Armed with knowledge of a user’s UID or username, a 3 person is able to access the user’s real name, gender, picture, friends, networks, interests, photos, and 4 any other information located on the user’s profile page. 5 15. In many ways, Facebook is accomplishing its stated mission. Facebook users store 6 and share an unprecedented amount of personal information through its service. While users may 7 share this information in order to connect with other Facebook users, they are also sharing this 8 information with Facebook itself. And all this personal information is valuable to Facebook because 9 it is valuable to advertisers. 10 B. Facebook’s Business Model 16. 11 Facebook consumers pay for Facebook’s products and services with their personal 12 information. In other words, Facebook users provide their valuable PII to Facebook in exchange for 13 access to facebook.com and for Facebook’s promises not to disclose their PII to third parties without 14 consent. 15 17. This business model allows users to contract with Facebook: users provide valuable 16 PII; Facebook provides valuable services backed by privacy promises. This business model also 17 allows Facebook to make money because of the inherent monetary value of PII. 18 18. From a revenue perspective, Facebook is an advertising platform. It makes money 19 much like television shows, magazines, newspapers, and other successful media—by selling 20 advertising. 21 19. What separates Facebook from traditional media is its uninhibited and unprecedented 22 access to information about those individuals who will view the ads that Facebook sells to 23 advertisers. 24 20. Historically, advertisers relied upon demographic sampling and other means to make 25 educated guesses at the characteristics and preferences of consumers. In contrast, Facebook actually 26 knows the true identities, likes and dislikes of users. Accordingly, Facebook is an incredibly 27 compelling advertising platform. Advertisers need not guess as to whether any given advertisement 28 will reach the appropriate demographics; Facebook can and does assure each advertiser that their -4FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 advertisements will reach precisely the right audience. Therefore, Facebook’s access to user PII 2 makes advertising on Facebook more effective, efficient and valuable for advertisers, and in turn, 3 more valuable to Facebook. 4 21. If not for the inherent and identifiable value of its users’ PII, Facebook’s business 5 model would collapse. Thus, its promises concerning the safeguarding of the personal consumer 6 data Facebook receives in exchange for its products and services are vital to its business and to its 7 advertising partners. 8 22. This business model—providing online services to consumers and profiting from 9 selling access to their PII to third-parties—has burgeoned into a multi-billion dollar per year 10 industry.2 11 23. Indeed, consumers themselves are beginning to recognize the value of their own PII, 12 and online giant Google has contemplated paying consumers for their personal data. As reported by 13 the Wall Street Journal, a confidential internal Google document outlined ways Google could profit 14 from its vast databases of personal information, including allowing users to “opt-in to share their 15 personal data in return for direct benefits (e.g., [Google] will pay for all/part of [the user’s] ISP bill 16 or other affiliate/coupon benefits).”3 In the document, Google also contemplates that “Google can 17 build a data exchange / trading platform allowing individual data owners to transact with others 18 directly, or openly sell their data to any bidders.”4 In fact, as reported by the Wall Street Journal, 19 consumers can now sell their own data for considerable and measurable sums of money, thus 20 realizing the sort of gains that Facebook is accustomed to generating from the sale of personal data.5 21 22 23 2 24 25 26 27 28 Unboxed—Rewarding Consumers for Providing Personal Data, http://www.nytimes.com/2010/07/18/business/18unboxed.html?_r=1 3 Google: Into the Future, http://online.wsj.com/public/resources/documents/infoflash10.html?project=GOOGLEDOCS1008 4 Google Agonizes on Privacy as Ad World Vaults Ahead, http://online.wsj.com/article/SB10001424052748703309704575413553851854026.html 5 Web’s Hot New Commodity: Privacy, http://online.wsj.com/article/SB10001424052748703529004576160764037920274.html -5FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 C. Advertising on Facebook 2 24. Users store an enormous amount of personal information on Facebook’s servers. 3 Facebook uses this information in conjunction with its advertising partners to target users based 4 upon highly specified criteria. 5 25. Targeted advertisements drive Facebook’s bottom line. Utilizing the tremendous 6 amount of user data stored on its systems, Facebook has buoyed to become the preeminent conduit 7 of online advertising in the world.6 8 9 26. The information that Facebook possesses about its users allows its advertising partners to target users based on age, city of residence, gender, and interests—such as mountain 10 biking, for example. Using this data, an advertiser providing services for a mountain biking store in 11 Utah can direct ads to 20 to 30-year old men in Moab, Utah who have expressly shared with 12 Facebook an interest in mountain biking. 13 27. The underlying user-inputted data used to facilitate the highly targeted advertising 14 described above is extremely valuable and coveted by virtually all companies conducting business 15 online. Extending the hypothetical above, the only thing better for an advertiser would be to know 16 the true identity of that 20-something male mountain biker. Equipped with that information, the 17 advertiser could reach out personally to the individual, collect additional information contained on 18 the user’s profile to further entice him, and/or begin to develop a digital dossier about the user to 19 target advertisements to him in the future. But Facebook’s own Privacy Policy prohibits this. 20 Facebook’s Privacy Policy specifically states: 21 How We Use Your Information 22 To serve personalized advertising to you. We don’t share your information with advertisers without your consent. (An example of consent would be if you asked us to provide your shipping address to an advertiser to receive a free sample.) We allow advertisers to choose the characteristics of users who will see their advertisements and we may use any of the non-personally identifiable attributes we have collected (including information you may have decided not to show to other users, such as your birth year or other sensitive personal information or preferences) to select the appropriate audience for 23 24 25 26 27 28 6 http://www.comscore.com/Press_Events/Press_Releases/2010/5/Americans_Received_1_Trillion_ Display_Ads_in_Q1_2010_as_Online_Advertising_Market_Rebounds_from_2009_Recession. -6FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 those advertisements. For example, we might use your interest in soccer to show you ads for soccer equipment, but we do not tell the soccer equipment company who you are… 2 3 Facebook’s Privacy Policy, http://www.facebook.com/policy.php (last visited May 31, 2010) 4 (emphasis in original). 5 28. 6 Facebook makes similar representations in its Privacy Guide: We never share your personal information with our advertisers. Facebook’s ad targeting is done entirely anonymously. If advertisers select demographic targeting for their ads, Facebook automatically matches those ads to the appropriate audience. Advertisers only receive anonymous data reports. 7 8 9 Controlling How You Share, http://www.facebook.com/privacy/explanation.php (last visited May 10 31, 2010)(emphasis in original). 11 29. Likewise, Facebook’s Statement of Rights and Responsibilities reads: 12 About Advertisements on Facebook 13 Our goal is to deliver ads that are not only valuable to advertisers, but also valuable to you. In order to do that, you agree to the following: 14 15 1. You can use your privacy settings to limit how your name and profile picture may be associated with commercial or sponsored content served by us. You give us permission to use your name and profile picture in connection with that content, subject to the limits you place. 16 17 2. We do not give your content or information to advertisers without your consent. 18 19 Statement of Rights and Responsibilities, http://www.facebook.com/terms.php (last visited on May 20 31, 2010) (emphasis added). 21 30. Facebook’s management officials have consistently made similar statements on the 22 official Facebook Blog. Facebook’s Director of Corporate Communications and Public Policy 23 posted the following on April 5, 2010: 24 25 26 27 28 Still others asked to be opted-out of having their information shared with advertisers. This reflects a common misconception about advertising on Facebook. We don’t share your information with advertisers unless you tell us to (e.g. to get a sample, hear more, or enter a contest). Any assertion to the contrary is false. Period. Instead, we enable advertisers to target anonymized demographics and attributes. That is, a company selling boats can target people between 40 and 50 years old who expressed an interest in boating. However, we never provide the advertiser any names or other information about the people who are shown, or even who click on, the ads. -7FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 2 The Facebook Blog, http://blog.facebook.com/blog.php?post=379388037130 (last visited May 31, 3 2010) (emphasis added). 4 31. In response to widespread concern about the privacy of user information, on February 5 16, 2009, Facebook’s CEO, Mark Zuckerberg, reiterated that personal information would not be 6 shared without user consent: 7 Our philosophy is that people own their information and control who they share it with. When a person shares information on Facebook, they first need to grant Facebook a license to use that information so that we can show it to the other people they’ve asked us to share it with. Without this license, we couldn’t help people share that information … In reality, we wouldn’t share your information in a way that you wouldn’t want. The trust you place in us as a safe place to share information is the most important part of what makes Facebook work. 8 9 10 11 12 The Facebook Blog, http://blog.facebook.com/blog.php?post=54434097130 (last visited October 6, 13 2010). 14 32. Through these and other representations, Facebook has consistently and adamantly 15 promised not to share any user’s specific identity or personal information with its advertising 16 partners. 17 33. Facebook requires its users to agree to its Privacy Policy upon registering with the 18 site. Users must affirm that they “have read and agree[d] to” Facebook’s Terms of Use (a hyperlink 19 to the document entitled Statement of Rights and Responsibilities) and Facebook’s Privacy Policy. 20 D. Facebook Violates Its Privacy Policy 21 34. In direct violation of its own Privacy Policy and of the representations quoted above, 22 Facebook shares its users’ sensitive information with third party advertisers without its users’ 23 knowledge or consent. 24 35. When a Facebook user clicks on an advertisement posted on Facebook’s website, 25 Facebook sends a “Referrer Header” to the corresponding advertiser. The Referrer Header reveals 26 the specific web page address the user was viewing prior to clicking the advertisement. Through the 27 design of its system, Facebook sends Referrer Headers containing UIDs and the usernames to 28 advertisers. -8FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 36. When a Facebook advertiser receives a Referrer Header identifying the user who 2 clicked an ad, the advertiser is essentially granted access to obtain substantial additional information 3 about the user, such as the user’s name, gender, picture, friends, networks, interests, photos, and 4 more. 5 37. Thus, Facebook advertisers gain even more detailed user information: not just 6 anonymous user demographics, but specific information about individual users including real name, 7 gender, friends, interests, and more. Facebook’s systems send this information to advertisers despite 8 Facebook’s Privacy Policy and its other representations as to users’ privacy vis-à-vis advertisers. 9 E. The Scope and Duration of Facebook’s Nonconsensual Disclosures 38. 10 On information and belief, Facebook began disclosing communications containing 11 user’s usernames/UIDs no later than February 2010 when Facebook implemented a website 12 “upgrade” that began to embed ever more detailed data within Referrer Headers. 13 39. 14 15 These disclosures continued until the publication of a May 21, 2010 article in the Wall Street Journal7 and a May 21, 2010 posting to the website of Professor Benjamin Edelman of the Harvard Business School8 exposed Facebook’s practices. According to the Wall Street Journal 16 publication, after being contacted by the Journal, Facebook admitted that it had been passing data to 17 ad companies that could allow those companies to tell if a particular user was clicking an ad. 18 Facebook finally ceased the nonconsensual transmissions only after researchers discovered them. 19 F. The Risks of Referrer Header Leakage 40. 20 The privacy risks attendant with leaking Referrer Header’s containing sensitive 21 information are well known and documented in the IT industry. 22 41. 23 The HTTP Referrer Header is a standard web browser function provided by web browsers since the HTTP 1.0 specification in May 1996.9 The current version of the publicly- 24 25 26 27 28 7 http://online.wsj.com/article/SB10001424052748704513104575256701215465596.html. http://www.benedelman.org/news/052010-1.html 9 http://www.w3.org/Protocols/rfc1945/rfc1945 8 -9FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 2 available HTTP specification, RFC 2616,10 provides for HTTP Referrer Headers in its provision 14.36.11 3 42. It is well known that if a company inserts sensitive information, such as username or 4 UID into a URL, then the company risks disclosing this information whenever a user clicks a link to 5 a third-party website. Indeed, the drafters of the HTTP specification specifically flagged this risk; in 6 section 15.1.3, the HTTP specification advises developers of substantially the same actions 7 described in the instant case: “Authors of services which use the HTTP protocol SHOULD NOT use 8 GET based forms for the submission of sensitive data, because this will cause this data to be encoded 9 in the REQUEST-URI.”12 10 43. Facebook’s software engineers knew or should have known that private user 11 information would be divulged as a result of Facebook’s website re-design. Facebook was put on 12 specific notice of the problem with their Referrer Headers when, in August 2009, Balachander 13 Krishnamurthy and Craig E. Wills published an article titled, “On the Leakage of Personally 14 Identifiable Information Via Online Social Networks.”13 In this article, the authors detail the 15 problem of Facebook and other sites sharing with advertisers information that the sites previously 16 promised to protect. The authors specifically sent this article to Facebook. Facebook confirmed its 17 knowledge of the Krishnamurthy et al. article in September 2009.14 18 44. This unauthorized disclosure of a person’s identity and what Facebook page they 19 were viewing could have the effect of revealing to advertisers confidential and sometimes highly 20 sensitive information, including a user’s private interests. For example, if a Facebook user who was 21 gay and struggling to come out of the closet was viewing the Facebook page of a gay support group, 22 23 24 25 10 http://www.w3.org/Protocols/rfc2616/rfc2616.html http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.36 12 http://www.w3.org/Protocols/rfc2616/rfc2616-sec15.html#sec15.1.3 13 http://conferences.sigcomm.org/sigcomm/2009/workshops/wosn/papers/p7.pdf. 14 http://www.mediapost.com/publications/index.cfm?fa=Articles.showArticle&art_aid=114344. 11 26 27 28 -10FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 and then clicked on an ad, the advertiser would know the exact identity of that person, and that s/he 2 was viewing the Facebook page of a gay support group just before navigating to their site. 3 V. 4 45. CLASS ACTION ALLEGATIONS Plaintiff brings this action on behalf of himself and all other persons in the following 5 similarly-situated class: all Facebook users in the United States who, at any time after May 28, 6 2006 clicked on a third-party advertisement displayed on Facebook.com (the “Class”). Excluded 7 from the Class are Facebook, its officers and directors, legal representatives, successors or assigns, 8 any entity in which Facebook has or had a controlling interest, the judge to whom this case is 9 assigned and the judge’s immediate family. 10 46. Every member of the proposed Class is a party to Facebook’s Terms and Conditions 11 and Privacy Policy as alleged herein. 12 47. The Class is composed of numerous people, whose joinder in this action would be 13 impracticable. The disposition of their claims through this class action will benefit Class members, 14 the parties and the courts. Since 2006, Facebook has grown from millions of users to over 500 15 million users. Upon information and belief, there are millions of persons in the Class. 16 48. Upon information and belief, the identities and contact information of the individual 17 members of the Class are available through Facebook’s electronic records. 18 49. There is a well-defined community of interest in questions of law and fact affecting 19 the Class. These questions of law and fact predominate over individual questions affecting 20 individual Class members, including, but not limited to, the following: 21 a. what and how personally-identifiable data and advertisement click information was 22 transmitted to advertisers; 23 b. whether Facebook violated its Terms of Service, Privacy Policy, and other representations to 24 users by making its users’ personal information and advertisement click information 25 available to advertisers without authorization; 26 c. whether any Class member knew or consented to Facebook’s transmission of personally27 identifiable data to advertisers; 28 -11FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 d. whether Class members are entitled to damages as a result of Facebook’s conduct, and, if so, 2 what is the measure of those damages; 3 e. whether Facebook’s conduct described herein violated the Electronic Communications 4 Privacy Act, 18 U.S.C. § 2510 et seq. (the “ECPA”); 5 f. whether Facebook’s conduct described herein Stored Communications Act, 18 U.S.C. § 2701 6 et seq.(the “SCA”); 7 g. whether Facebook’s conduct described herein violated California’s Unfair Competition Law 8 (Cal. Bus. & Prof. Code § 17200, et seq.); 9 h. whether Facebook’s conduct described herein violated California’s Computer Crime Law 10 (Cal. Penal Code § 502); 11 i. whether Facebook’s conduct described herein violated the California Legal Remedies Act 12 (Cal. Civ. Code § 1750, et seq.); 13 j. whether Facebook’s conduct described herein constitutes a breach of contract; and 14 k. whether Facebook was unjustly enriched as a result of its conduct described herein. 15 50. Facebook engaged in a common course of conduct giving rise to the legal rights 16 sought to be enforced by Class members. Similar or identical statutory and common law violations, 17 business practices and injuries are involved. Individual questions, if any, pale by comparison to the 18 numerous common questions that dominate. 19 51. The injuries sustained by members of the Class flow, in each instance, from a 20 common nucleus of operative facts. In each case, Facebook caused or permitted unauthorized 21 communications of private and personally identifying information to be delivered to third parties 22 without adequate or any notice, consent or opportunity to opt out. 23 52. Given the similar nature of the Class members’ claims and the absence of material 24 differences in the statutes and common laws upon which the Class members’ claims are based, a 25 nationwide class will be easily managed by the Court and the parties. 26 53. Because of the relatively small size of the individual Class members’ claims, no Class 27 user could afford to seek legal redress on an individual basis. 28 -12FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 54. Plaintiffs’ claims are typical of those of the Class as all members of the Class are 2 similarly affected by Facebook’s uniform and actionable conduct as alleged herein. 3 55. Facebook has acted and failed to act on grounds generally applicable to Plaintiffs and 4 the other members of the Class, requiring the Court’s imposition of uniform relief to ensure 5 compatible standards of conduct toward the members of the Class. 6 56. Plaintiffs will fairly and adequately protect the interests of the Class and have 7 retained counsel competent and experienced in class action litigation. Plaintiffs have no interests 8 antagonistic to, or in conflict with, the Class that Plaintiffs seek to represent. 9 57. Plaintiffs reserve the right to revise the above class definition based on facts learned 10 in discovery. 11 COUNT I (Violation of the Wiretap Act) 12 13 58. Plaintiffs incorporate the foregoing allegations as if fully set forth herein. 14 59. The Electronic Communications Privacy Act, 18 U.S.C. § 2510 et seq. (the “Wiretap 15 Act”) broadly defines an “electronic communication” as “any transfer of signs, signals, writing, 16 images, sounds, data, or intelligence of any nature transmitted in whole or in party by a wire, radio, 17 electromagnetic, photoelectronic or photooptical system that affects interstate or foreign 18 commerce…” 18 U.S.C. § 2510(12). 19 60. Pursuant to the Wiretap Act, Facebook operates an “electronic communications 20 service” as defined in 18 U.S.C. § 2510(15). Facebook provides its users with the ability to send or 21 receive electronic communications to or from any of Facebook’s millions of users and to or from 22 third parties who are not Facebook users, such as advertisers. These electronic communications 23 include, among other things, the ability for users to send and receive private messages, share 24 photographs and video, and the ability to post messages on user profile pages that can be viewed by 25 anyone with access to those profile pages. Facebook also provides its advertisers the ability to send 26 electronic communications to Facebook users by placing targeted advertisements on Facebook.com, 27 and allows Facebook users to receive those electronic communications and send electronic 28 communications to advertisers by clicking on advertising banners. -13FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 61. The Wiretap Act broadly defines the contents of a communication. Pursuant to the 2 Wiretap Act, “contents” of a communication, when used with respect to any wire, oral, or electronic 3 communications, include any information concerning the substance, purport, or meaning of that 4 communication. 18 U.S.C. § 2510(8). “Contents,” when used with respect to any wire or oral 5 communication, includes any information concerning the identity of the parties to such 6 communication or the existence, substance, purport, or meaning of that communication. The 7 definition thus includes all aspects of the communication itself. No aspect, including the identity of 8 the parties, the substance of the communication between them, or the fact of the communication 9 itself, is excluded. The privacy of the communication to be protected is intended to be 10 comprehensive. 11 62. The Wiretap Act prevents an electronic communications service provider from 12 intentionally divulging the contents of any communication while in transmission on that service to 13 any person or entity other than an addressee or intended recipient of such communication. 18 U.S.C. 14 § 2511(3)(a). 15 63. Plaintiffs and Class members are “person[s] whose ... electronic communication[s] 16 [are] disclosed... or intentionally used in violation of this chapter” within the meaning of 18 U.S.C. § 17 2520(a). 18 64. By clicking on an advertisement banner displayed on Facebook.com, users are asking 19 Facebook to send an electronic communication to the advertiser who supplied the ad. But pursuant 20 to Facebook’s Terms and Conditions and its Privacy Policy, users do not expect and do not consent 21 to Facebook’s disclosure of any of their PII and do expect that their identities and what Facebook 22 page they were viewing at the time they clicked an ad will be configured by Facebook to be private. 23 65. The design of the Facebook website, Facebook’s web page addresses, and Facebook’s 24 advertisement system is evidence of Facebook’s conscious objective to divulge the identities of its 25 users to advertisers. By divulging user identities and other user information to advertisers without 26 user consent, Facebook intentionally violated 18 U.S.C. § 2511(3)(a). Facebook intentionally 27 disclosed user identities to advertisers to enhance its profitability and revenue through advertising. 28 -14FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 This disclosure was not necessary for the operation of Facebook’s system or to protect Facebook’s 2 rights or property. 3 66. Each incident in which Facebook divulged PII of a Facebook user is a separate and 4 distinct violation of the ECPA. Plaintiffs and members of the Class therefore seek remedy as 5 provided for by 18 U.S.C. § 2520, including such preliminary and other equitable or declaratory 6 relief as may be appropriate, damages consistent with subsection (c) of that section to be proven at 7 trial, punitive damages to be proven at trial, and attorneys’ fees and other litigation costs reasonably 8 incurred. 9 67. Plaintiffs and the Class, pursuant to 18 U.S.C. § 2520(2), are entitled to preliminary, 10 equitable, and declaratory relief, in addition to statutory damages of the greater of $10,000 or $100 a 11 day for each day of violation, actual and punitive damages, reasonable attorneys’ fees, and 12 Facebook’s profits obtained from the violations described herein. 13 COUNT II (Violations of the Stored Communications Act) 14 15 68. Plaintiffs incorporate the foregoing allegations as if fully set forth herein. 16 69. The Stored Communications Act of 1986 (“SCA”) incorporates the Wiretap Act’s 17 definition of an “electronic communication service.” 18 U.S.C. § 2711(1). As set forth above, 18 Facebook is an electronic communications service provider within the meaning of the ECPA and is 19 therefore also subject to the restrictions contained in the SCA governing electronic communications 20 service providers. 21 70. The SCA also incorporates the Wiretap Act’s broad definition of “electronic 22 communication” and “electronic storage.” 18 U.S.C. § 2711(1). Pursuant to the Wiretap Act and 23 the SCA, “electronic storage” means any “temporary storage of a wire or electronic communication 24 incidental to the electronic transmission thereof.” 18 U.S.C. § 2510(17)(A). This type of electronic 25 storage includes communications in intermediate electronic storage that have not yet been delivered 26 to their intended recipient. 27 28 -15FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 71. Examples of communications held by Facebook in temporary storage pursuant to 18 2 U.S.C. § 2510(17)(A) include private messages not yet received by the intended recipient and user 3 requests to Facebook to visit advertiser websites. 4 72. The SCA prohibits any electronic communications service provider from divulging to 5 any person or entity the contents of a communication while in electronic storage by that service. 18 6 U.S.C. § 2702(a)(1). 7 73. When a user signs up for Facebook’s services, the user provides PII to Defendant for 8 the sole purpose of communicating that information to his or her “friends” on Facebook’s system. 9 Instead, Facebook sends this information to third parties when the user clicks on advertisements, in 10 violation of 18 U.S.C. § 2702(a)(1). 11 74. When a Facebook user clicks on an advertisement posted on Facebook’s website, the 12 user sends a message to Facebook requesting that Facebook connect the user to the specific 13 advertisement. This is because the displayed advertising is run on and through Facebook’s servers. 14 While the user may intend to or think s/he is communicating directly with the advertiser, technically, 15 the user is communicating with Facebook. In other words, Facebook actually acts as the 16 intermediary between the user and the advertiser. In this role, Facebook dictates the exact 17 information ultimately sent to the advertiser. 18 75. This scenario is analogous to a Google user who drafts and sends an email using 19 Gmail to another person. While the user intends for the other person to receive the email, the user is 20 actually sending a message to Google asking Google to send the email message to the perceived 21 intended recipient because Google operates the Gmail service. Then, Google sends the email 22 message to the perceived intended recipient. In other words, the intended recipient of the email 23 message is, in the first instance, actually Google, not the other person. Surely, the Act—which 24 contains a multitude of restrictions concerning the disclosure of communications to third parties— 25 does not allow Google (who is necessarily an intended recipient) to share a Gmail user’s emails with 26 anyone it chooses. 27 76. The same principle applies here. As alleged above, users have shared PII with 28 Facebook for the specific purposes of registering to use the service or to share information with -16FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 friends. Users have not shared the PII with Facebook for the purpose of sharing it with advertisers. 2 In fact, Facebook has promised it would not share user PII with advertisers, and users, including 3 Plaintiffs, have relied on this promise. Much as Google should not be permitted to share Gmail user 4 emails with anyone it chooses because it is technically the intended recipient of such an email, 5 Facebook should not be permitted to share user PII or disclose the contents of its user’s requests 6 anyone it chooses, including advertisers. 7 77. Upon clicking an advertisement displayed on Facebook, users expect, intend and 8 consent for Facebook to share the bare request to be taken to the advertisement with the 9 corresponding advertiser. But users do not expect, intend or consent for Facebook to add or pass 10 along PII with that request. That, though, is exactly what Facebook does via a “Referrer Header,” 11 despite Facebook’s explicit promises not to share personal information, including UIDs and 12 usernames with third-parties, such as advertisers. And it is the disclosure of the user PII that violates 13 the SCA. 14 78. Plaintiffs plead the following facts in the alternative: 15 i. When a Facebook user clicks on an ad, the user is sending a communication to the 16 Advertiser requesting that the Advertiser send an electronic communication to that 17 individual allowing the user to view the Advertiser's website. Instead, Facebook 18 discloses an additional communication containing the user's username and/or UID to 19 the Advertiser in violation of 18 U.S.C. § 2702(a)(1). 20 ii. Alternatively, when a Facebook user clicks on an ad, the user is asking Facebook to 21 send an electronic communication to that Advertiser allowing the user to view the 22 Advertiser's website. Instead, Facebook exceeds its authority to disclose records 23 about its users by sending usernames and/or UIDs to the Advertiser, instead of a 24 simple request for the information needed to view the Advertiser's website, in 25 violation of 18 U.S.C. § 2702(a)(1). 26 iii. Alternatively, when a user signs up for Facebook's services, the user provides PII to 27 Defendant for the sole purpose of communicating that information to his or her 28 -17FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 "friends" on Facebook's system. Instead, Facebook sends this information to third 2 parties when the user clicks on advertisements, in violation of 18 U.S.C. § 2702(a)(1). 3 iv. Alternatively, when a Facebook user clicks on an ad, the user does not intend to send 4 Facebook nor the Advertiser any information regarding his or her true identity. By 5 disclosing records containing such information Facebook violated 18 U.S.C. § 6 2702(a)(1). 7 79. The design of the Facebook website, Facebook’s web page addresses, and Facebook’s 8 advertisement system is evidence of Facebook’s knowledge of and intent to divulge the private 9 contents of its users’ electronic communications without user consent, in violation of 18 U.S.C. 10 § 2702(1)(a). Facebook intentionally disclosed user identities and other information to advertisers to 11 enhance its profitability and revenue through advertising. The disclosures were not necessary for the 12 operation of Facebook’s system or to protect Facebook’s rights or property. 13 80. The SCA definition of “electronic storage” also includes “storage of [a wire or 14 electronic] communication by an electronic communication service for purposes of backup 15 protection of such communication.” 18 U.S.C. § 2510(17)(B). The information that Facebook users 16 send via electronic communications to Facebook to be displayed in user profiles—such as name, 17 gender, pictures, friends, religious, political and sexual preferences, wall posts and more—is 18 electronically stored by Facebook for backup purposes. All of the foregoing user information, once 19 posted, remains available for viewing and re-access at a later time by the user and other persons 20 authorized by the user to access that information. This storage is one of the main services that 21 Facebook provides to its users. 22 81. Because Facebook thus operates as a “virtual filing cabinet” for its users, allowing 23 them to store and re-access at a later time their photos, messages, wall posts and more, Facebook is 24 also a “remote computing service” provider pursuant to 18 U.S.C. § 2711(2). 25 82. The SCA, at 18 U.S.C. § 2702(a)(2), provides that “a person or entity providing an 26 remote communication service to the public shall not knowingly divulge to any person or entity the 27 contents of any communication which is carrier or maintained on that service (A) on behalf of, and 28 received by means of electronic transmission…a subscriber or customer of such service; (B) solely -18FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 for the purpose of providing storage…to such subscriber or customer, if the provider is not 2 authorized to access the contents of any such communications for purposes of providing any services 3 other than storage or computer processing.” 4 83. As a result of Facebook’s disclosure of user identities, Facebook gives unauthorized 5 access to and thereby divulges electronically-stored information to advertisers about the particular 6 user who clicked an ad. With the user name that Facebook provides them, advertisers can navigate 7 to user profiles and see a user’s stored electronic communications, including Facebook names, 8 gender, pictures, friends, networks, wall posts, photos, and more. Because Facebook is both an 9 electronic communication service provider and a remote computing service provider, Facebook’s 10 disclosure of this information to advertisers is in violation of both 18 U.S.C. § 2702(a)(1) and (2). 11 As set forth above, Facebook’s disclosures were knowing and intentional and designed to enhance 12 its profitability and revenue through advertising. The disclosures were not necessary for the 13 operation of Facebook’s system or to protect Facebook’s rights or property. 14 84. Facebook intentionally and knowingly divulged confidential and private information 15 relating to Plaintiffs and Class member’ stored electronic communications without the consent, 16 knowledge or authorization of Plaintiffs and members of the Class. 17 85. Plaintiffs and Class members are “person[s] aggrieved by [a] violation of [the SCA] 18 in which the conduct constituting the violation is engaged in with a knowing or intentional state or 19 mind…” within the meaning of 18 U.S.C. § 2707(a). 20 86. Each incident in which Facebook provided personally identifiable information of a 21 Facebook user, thereby divulging that user’s stored communications to a third party, is a separate 22 and distinct violation of the SCA, subject to the remedies provided under the SCA, and specifically 23 pursuant to 18 U .S.C. § 2707(a). 24 87. Plaintiffs and users of the Class therefore seek remedy as provided for by 18 U.S.C. § 25 2707(b) and (c), including such preliminary and other equitable or declaratory relief as may be 26 appropriate, damages consistent with subsection (c) of that section to be proven at trial, punitive 27 damages to be proven at trial, and attorneys’ fee and other litigation costs reasonably incurred. 28 -19FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 88. Plaintiffs and the Class, pursuant to 18 U.S.C. § 2707(c), are entitled to preliminary, 2 equitable, and declaratory relief, in addition to statutory damages of no less than $1,000 per 3 violation, actual and punitive damages, reasonable attorneys’ fees, and Facebook’s profits obtained 4 from the violations described herein. 5 6 7 COUNT III (Violation of Cal. Bus. & Prof. Code § 17200) (This Count has been dismissed with prejudice and is included only to preserve a potential appeal.) 8 89. Plaintiff incorporates the foregoing allegations as if fully set forth herein. 9 90. California’s Unfair Competition Law (“UCL”), Cal. Bus. & Prof. Code § 17200, et 10 seq., protects both consumers and competitors by promoting fair competition in commercial markets 11 for goods and services. 12 91. The UCL prohibits any unlawful, unfair or fraudulent business act or practice. A 13 business practice need only meet one of the three criteria to be considered unfair competition. An 14 unlawful business practice is anything that can properly be called a business practice and that at the 15 same time is forbidden by law. 16 17 18 92. As described herein, Facebook’s nonconsensual disclosure of its users’ personal information to third-party advertisers without their authorization is a violation of the UCL. 93. Facebook has violated the “unlawful” prong of the UCL in that Facebook’s conduct 19 violated the ECPA (18 U.S.C. § 2510 et seq.), the SCA (18 U.S.C. § 2701 et seq.), Consumer Legal 20 Remedies Act (Cal. Civ. Code § 1750 et seq.), and the California Computer Crime Law (Cal. Penal 21 Code § 502). 22 94. Facebook violated the fraudulent prong of the UCL by explicitly representing in its 23 Privacy Policy and in subsequent public statements that it would not make users’ personal 24 information available to any third party without authorization. Facebook used those 25 misrepresentations to induce users to submit their personally identifiable information to its website. 26 Facebook then knowingly transmitted that information to third parties without its users’ 27 authorization. 28 -20FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 95. Facebook violated the unfair prong of the UCL by gaining control over and divulging 2 to third parties its users’ PII without consent and under false pretenses. 3 96. Facebook’s unfair or deceptive practices occurred primarily and substantially in 4 California. Decisions concerning the retention and safeguarding the disclosure of user information 5 were made in California, Facebook maintains all or a substantial part of its computer systems 6 containing user information in California, and the disclosure of its users’ information took place 7 primarily and substantially in California. 8 97. Pursuant to Cal. Bus. & Prof. Code § 17203, Plaintiffs seek an order of this Court 9 permanently enjoining Facebook from continuing to engage in the unfair and unlawful conduct 10 described herein. Plaintiffs seek an order requiring Facebook to (1) immediately cease the unlawful 11 practices stated in this Complaint; and (2) awarding Plaintiffs and the Class reasonable costs and 12 attorneys’ fees pursuant to Cal. Code Civ. Proc. § 1021.5. 13 14 15 16 COUNT IV (Violation of California’s Computer Crime Law (“CCCL”), Cal. Penal Code § 502) (This Count has been dismissed with prejudice as it relates to §§ 502(c)(1)(2)(3)(6) & (7), and is included only to preserve a potential appeal, except for the allegations under § 502(c)(8), which has not been dismissed with prejudice.) 98. Plaintiffs incorporate the foregoing allegations as if fully set forth herein. 99. Facebook knowingly accessed and without permission used any data, computer, 17 18 computer system, or computer network in order to execute a scheme or artifice to deceive and/or to 19 wrongfully control or obtain money, property, or data in violation of Cal. Penal Code § 502(c)(1). 20 Facebook did so by accessing and sharing with advertisers the personal information of Plaintiffs and 21 Class members in order to deceive Facebook users and/or to wrongfully obtain money from 22 advertisers and more data from Facebook users. 23 100. Facebook knowingly accessed and without permission took, copied, or made use of 24 Plaintiffs’ and Class members’ personal information in violation of § 502(c)(2). 25 101. Facebook knowingly and without permission used or caused to be used computer 26 services by impermissibly accessing, collecting, and transmitting Plaintiffs’ and Class members’ 27 personal information in violation of § 502(c)(3). 28 -21FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 102. Facebook knowingly and without permission provided or assisted in providing a 2 means of accessing a computer, computer system, or computer network by creating a system that 3 allowed advertisers to impermissibly access, collect, and transmit Plaintiffs’ and Class members’ 4 personal information in violation of § 502(c)(6). 5 103. Facebook knowingly and without permission accessed or caused to be accessed 6 Plaintiffs’ and Class members’ computers and/or computer networks by impermissibly divulging 7 Plaintiffs’ and Class members’ personal information to advertisers in violation of § 502(c)(7). 8 104. Facebook knowingly and without permission introduced a computer contaminant, as 9 defined in § 502(b)(10), by introducing computer instructions designed to record or transmit to 10 advertisers Plaintiffs’ and the Class’s personally-identifiable information on Facebook’s computer 11 networks without the intent or permission of Plaintiffs or the Class in violation of § 502(c)(8). These 12 instructions usurped the normal operations of the relevant computers, which by normal operation 13 would not transmit the PII of Plaintiff and/or the Class members. 14 105. As a direct and proximate result of Facebook’s violation of § 502, Facebook caused 15 loss to Plaintiffs and the Class members in an amount to be proven at trial. Plaintiffs and the Class 16 are entitled to the recovery of attorneys’ fees pursuant to § 502(e). 17 106. Plaintiffs and Class members have also suffered irreparable injury as a result of 18 Facebook’s unlawful conduct, including the collection and sharing of their personal information. 19 Additionally, because the stolen information cannot be returned, the harm from the security breach is 20 ongoing and compounding. Accordingly, Plaintiffs and the Class have no adequate remedy at law, 21 entitling them to injunctive relief. 22 23 24 COUNT V (Violation of the Consumers Legal Remedies Act, Cal. Civ. Code § 1750, et seq.) (This Count has been dismissed with prejudice and is included only to preserve a potential appeal.) 25 107. Plaintiffs incorporate the foregoing allegations as if fully set forth herein. 26 108. The Consumers Legal Remedies Act prohibits the act, use or employment by any 27 person of any deception, fraud, false pretense, false promise, misrepresentation, concealment, 28 suppression or omission of any material fact with intent that others rely upon such act in connection -22FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 with the sale or advertisement of any merchandise whether or not any person has in fact been misled, 2 deceived or damaged thereby. 3 109. As described within, Facebook has engaged in deceptive practices, unlawful methods 4 of competition, and/or unfair acts as defined by Cal. Civ. Code §§ 1750, et seq., to the detriment of 5 Plaintiffs and the Class. 6 110. Facebook, acting with knowledge, intentionally and unlawfully brought harm upon 7 Plaintiffs and the Class by deceptively inducing Plaintiffs and the Class to register with Facebook, 8 supply Facebook with personal and private information, and click on advertisements based upon 9 deceptive and misleading representations that it would not disclose their personal or private 10 information to third-parties without authorization. Specifically, Facebook violated Cal. Civ. Code § 11 1750 in at least the following respects: 12 a. In violation of § 1770(a)(5) by representing that goods or services have characteristics 13 and benefits that they do not have; 14 b. In violation of § 1770(a)(14) by representing that a transaction confers or involves 15 rights, remedies, or obligations which it does not have or involve, or which are prohibited by law; 16 and 17 c. In violation of § 1770(a)(16) by representing that the subject of a transaction has been 18 supplied in accordance with a previous representation when it has not. 19 111. Plaintiffs and the Class have suffered harm as a direct and proximate result of the 20 Facebook’s violations of law and wrongful conduct. 21 112. Under Cal. Civ. Code § 1780(a) & (b), Plaintiffs and the Class seek injunctive relief 22 requiring Facebook to cease and desist the illegal conduct described herein, and any other 23 appropriate remedy for violations of the CLRA. For the sake of clarity, Plaintiffs explicitly disclaim 24 any claim for damages under the CLRA at this time. 25 COUNT VI (Breach of Contract) 26 27 113. Plaintiffs incorporate the foregoing allegations as if fully set forth herein. 28 -23FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 114. In order to register for and use its social-networking website, Facebook required that 2 Plaintiffs and the Class affirmatively assent to its Terms and Conditions and Privacy Policy (the 3 “Agreement”). 4 115. The Agreement’s provisions constitute a valid and enforceable contract between 5 Plaintiffs and the Class on the one hand, and Facebook on the other. 6 116. Under the Agreement, Plaintiffs and the Class transmitted sensitive personally- 7 identifiable information to Facebook in exchange for use of Facebook and Facebook’s promise that 8 it would not share that personal information with third parties, including but not limited to 9 advertisers, without their authorization. 10 117. Facebook users pay for Facebook’s services with their personal information. 11 Facebook’s users exchange something valuable—access to their personal information—for 12 Facebook’s services and Facebook’s promise to safeguard that personal information. In particular, 13 Facebook promises that any personal information submitted by its users will only be disclosed to 14 advertisers in the specific ways and circumstances set out in Facebook’s privacy policy and with 15 user consent. 16 118. Facebook collects revenues in large part because the personal information submitted 17 by its users increases the value of Facebook’s advertising services. Because Facebook has access to 18 highly personal information about its users, Facebook’s advertising platform is particularly attractive 19 to advertisers and marketers who can and do use that personal information to deliver highly-targeted 20 ads to Facebook’s users. In this regard, Facebook’s services are vehicles to acquire personal 21 information about consumers in order to sell that personal information to advertisers. 22 119. If not for the inherent and identifiable value of access to personal consumer 23 information, Facebook would be much less profitable. Thus, its promises concerning the 24 safeguarding of the personal information Facebook receives from its users in exchange for its 25 services are vital to its business and its users. 26 120. Facebook’s practices—providing services to consumers and profiting from the sale of 27 personal information to advertisers—have helped Facebook achieve a valuation exceeding $30 28 billion. -24FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 121. Facebook materially breached the terms of the Agreement through its unlawful 2 conduct alleged herein, including its disclosure of Plaintiffs’ and the Class’s personal information to 3 its advertiser partners. 4 122. As a result of Facebook’s misconduct and breach of the Agreement described herein, 5 Plaintiffs and the Class suffered damages. Plaintiff and the Class members did not receive the benefit 6 of the bargain for which they contracted and for which the paid valuable consideration in the form of 7 their personal information, which, as alleged above, has ascertainable value to be proven at trial. In 8 other words, Plaintiff and each Class member gave up something of value, PII, in exchange for 9 access to Facebook and Facebook’s privacy promises. Facebook materially breached the contracts 10 by violating its privacy terms, thus depriving Plaintiff and Class members the benefit of the bargain. 11 Thus, their actual and appreciable damages take the form of the value of their PII that Facebook 12 wrongfully shared with advertisers. 13 COUNT VII (Violation of Cal. Civ. Code §§ 1572 & 1573) 14 123. Plaintiffs incorporate the foregoing allegations as if fully set forth herein. 124. Cal. Civ. Code § 1572 provides in relevant part that actual fraud exists when a party 15 16 to a contract suppresses “that which is true, by one having knowledge or belief of the fact” “with 17 intent to deceive another party thereto, or to induce him to enter into the contract.” 18 125. Cal. Civ. Code § 1573 provides in relevant part that constructive fraud exists “[i]n 19 any such act or omission as the law specially declares to be fraudulent, without respect to actual 20 fraud.” 21 126. Facebook violated § 1572 through its repeated and explicit false assertions that it 22 would not share the identity of its users with its advertisers without consent, as described herein. 23 Facebook further violated this section by suppressing its knowledge of this fact. Plaintiffs Gould 24 and Robertson relied on Facebook’s false assertions in contracting with and using Facebook. 25 127. Additionally and/or alternatively, Facebook violated § 1573 by breaching its duty to 26 protect its users’ identities from its advertisers and gaining an advantage in doing so, by misleading 27 its users to their prejudice, as described herein. 28 -25FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 128. Plaintiffs, on behalf of themselves and the Class, seek damages from Facebook, 2 including but not limited to disgorgement of all proceeds Facebook obtained from its unlawful 3 business practices. 4 5 6 COUNT VIII (Unjust Enrichment (In the Alternative)) (This Count has been dismissed with prejudice and is included only to preserve a potential appeal.) 129. Plaintiffs incorporate the foregoing allegations as if fully set forth herein. 130. Plaintiffs and the Class have conferred a benefit upon Facebook. Facebook has 7 8 received and retained money belonging to Plaintiffs and the Class as a result of sharing its users’ 9 personal information with its advertisers without their consent, as described herein. 10 131. Facebook appreciates or has knowledge of said benefit. 132. Under principles of equity and good conscience, Facebook should not be permitted to 11 12 retain money belonging to Plaintiffs and the Class that it unjustly received as a result of its actions. 13 133. Plaintiffs and the Class have suffered loss as a direct result of Facebook’s conduct. 134. Plaintiffs, on their own behalf and on behalf of the Class, seek the imposition of a 14 15 constructive trust on and restitution of the proceeds of Facebook received as a result of its conduct 16 described herein, as well as attorney’s fees and costs pursuant to Cal. Civ. Proc. Code § 1021.5. 17 PRAYER FOR RELIEF 18 WHEREFORE, Plaintiffs, individually and on behalf of the Class, pray for the following 19 relief: 20 A. Certify this case as a class action on behalf of the Class defined above, appoint 21 Plaintiffs Gould and Robertson as class representatives, and appoint their counsel as class co22 counsel; 23 B. Declare that Facebook’s actions, as described herein, violate the ECPA (18 U.S.C. § 24 2510 et seq.), the SCA (18 U.S.C. § 2701 et seq.), California Unfair Competition Law (Cal. Bus. & 25 Prof. Code § 17200, et seq.), the Computer Crime Law (Cal. Penal Code § 502), and the Consumer 26 Legal Remedies Act (Cal. Bus. & Prof. Code § 1750), and constitute breach of contract, fraud, and 27 unjust enrichment; 28 -26FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 C. Awarding injunctive and other equitable relief as is necessary to protect the interests 2 of Plaintiffs and the Class, including, inter alia, an order prohibiting Facebook from engaging in the 3 wrongful and unlawful acts described herein; 4 D. Disgorge Facebook of all revenue earned from displaying third-party advertising on 5 Facebook.com during the class period; 6 E. Awarding damages, including statutory damages where applicable, to Plaintiffs and 7 the Class in an amount to be determined at trial; 8 F. Awarding all economic, monetary, actual, consequential, and compensatory damages 9 caused Facebook’s conduct, and if its conduct is proved willful, award Plaintiffs and the Class 10 exemplary damages; 11 G. Award restitution against Facebook for all money to which Plaintiffs and the Class 12 are entitled in equity; 13 H. Awarding Plaintiffs and the Class their reasonable litigation expenses and attorneys’ I. Awarding Plaintiffs and the Class pre- and post-judgment interest, to the extent 14 fees; 15 16 allowable; and 17 J. Awarding such other and further relief as equity and justice may require. 18 19 Dated: June 13, 2011 20 /s/ Kassra P. Nassiri Kassra P. Nassiri Attorneys for Plaintiffs and the Putative Class 21 22 23 24 25 Respectfully submitted, NASSIRI & JUNG LLP Dated: June 13, 2011 Respectfully submitted, EDELSON MCGUIRE, LLP /s/ Sean Reis _ Sean Reis Attorneys for Plaintiffs and the Putative Class 26 27 28 -27FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW 1 Dated: June 13, 2011 Respectfully submitted, ASCHENBRENER LAW, P.C. 2 /s/ Michael Aschenbrener_ Michael Aschenbrener Attorneys for Plaintiffs and the Putative Class 3 4 JURY TRIAL DEMANDED 5 6 Plaintiffs hereby demand a trial by jury. 7 8 Dated: June 13, 2011 9 Respectfully submitted, NASSIRI & JUNG LLP /s/ Kassra P. Nassiri ______ Kassra P. Nassiri Attorneys for Plaintiffs and the Putative Class 10 11 12 Dated: June 13, 2011 13 Respectfully submitted, EDELSON MCGUIRE, LLP /s/ Sean Reis _ Sean Reis Attorneys for Plaintiffs and the Putative Class 14 15 16 17 18 19 Dated: June 13, 2011 Respectfully submitted, ASCHENBRENER LAW, P.C. /s/ Michael Aschenbrener_ Michael Aschenbrener Attorneys for plaintiffs and the Putative Class 20 21 22 23 24 25 26 27 28 -28FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Case No. 10-cv-02389-JW

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.


Why Is My Information Online?