"In Re: Facebook Privacy Litigation"
Filing
92
AMENDED COMPLAINT (First Amended Consolidated Complaint) against Facebook, Inc.. Filed byMike Robertson, David Gould. (Nassiri, Kassra) (Filed on 6/13/2011)
1
2
3
4
5
6
7
8
9
KASSRA P. NASSIRI (215405)
(knassiri@nassiri-jung.com)
CHARLES H. JUNG (217909)
(cjung@nassiri-jung.com)
NASSIRI & JUNG LLP
47 Kearny Street, Suite 700
San Francisco, California 94108
Telephone:
(415) 762-3100
Facsimile:
(415) 534-3200
EDELSON MCGUIRE LLP
SEAN REIS (184044) (sreis@edelson.com)
30021 Tomas Street, Suite 300
Rancho Santa Margarita, CA 92688
Telephone:
(949) 459-2124
Facsimile: (949) 459-2123
ASCHENBRENER LAW, P.C.
MICHAEL J. ASCHENBRENER
(mja@aschenbrenerlaw.com)(pro hac vice)
10 S Riverside Plaza, Suite 1800
Chicago, Illinois 60606
Telephone: (312) 462-4922
Facsimile: (312) 462-4923
10
11
Attorneys for Plaintiffs and the Putative Class
12
UNITED STATES DISTRICT COURT
13
NORTHERN DISTRICT OF CALIFORNIA
14
SAN FRANCISCO DIVISION
15
Case No. 10-cv-02389-JW
16
CLASS ACTION
17
FIRST AMENDED
CONSOLIDATED CLASS
ACTION COMPLAINT
18
19
IN RE: FACEBOOK PRIVACY LITIGATION
ACTION FILED: 05/28/10
20
JURY TRIAL DEMANDED
21
22
Plaintiffs David Gould and Mike Robertson (“Plaintiffs”) bring this suit on behalf of
23
themselves and all others similarly situated, and make the following allegations on information and
24
belief, except as to allegations pertaining to Plaintiffs, which are based on their personal knowledge:
25
I.
26
1.
INTRODUCTION
Plaintiffs bring this class action complaint against Facebook, Inc. (“Facebook”) for
27
disclosing its users’ sensitive personally identifiable information (“PII”) with Facebook’s advertising
28
-1FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
partners, in violation of Facebook’s own privacy policy, Facebook’s specific and prominent
2
promises to users, accepted industry standards, and federal law.
3
2.
Facebook’s own policies state “[w]e never share your personal information with our
4
advertisers” and “[w]e do not give your content of information to advertisers without your consent.”
5
Facebook touts these statements in multiple areas of its site including its privacy policy and multiple
6
posts on its official blog.
7
3.
Unbeknownst to its users, and in clear contrast to Facebook’s own stated policies,
8
Facebook intentionally and knowingly transmitted PII, including users’ real names, to third party
9
advertisers without user consent.
10
II.
11
4.
PARTIES
Plaintiff David Gould is a resident of South Lake Tahoe, California. He is a
12
registered user of Facebook’s services and has been since at least 2008. During the relevant time
13
period, Plaintiff Gould clicked on at least one third-party advertisement displayed on Facebook.com.
14
In registering as a Facebook user and using Facebook’s services, including clicking on
15
advertisements, Mr. Gould relied on Facebook’s promises regarding the privacy of his personal data.
16
5.
Plaintiff Mike Robertson is a resident of Marin County, California. He is a registered
17
user of Facebook’s services and has been since at least 2008. During the relevant time period,
18
Plaintiff Robertson clicked on at least one third-party advertisement displayed on Facebook.com. In
19
registering as a Facebook user and using Facebook’s services, including clicking on advertisements,
20
Mr. Robertson relied on Facebook’s promises regarding the privacy of his personal data.
21
6.
Defendant Facebook, Inc. (hereinafter, “Facebook”) is a Delaware corporation that
22
maintains its headquarters in Santa Clara County, California. Facebook conducts business
23
throughout California and the nation.
24
III.
25
7.
JURISDICTION AND VENUE
This Court has personal jurisdiction over Facebook because (a) a substantial portion
26
of the wrongdoing alleged in this complaint took place in this state, (b) Facebook is authorized to do
27
business here, has sufficient minimum contacts with this state, and/or otherwise intentionally avails
28
itself of the markets in this state through the promotion, marketing and sale of products and services
-2FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
in this state, to render the exercise of jurisdiction by this Court permissible under traditional notions
2
of fair play and substantial justice.
3
8.
This Court has subject matter jurisdiction pursuant to the Class Action Fairness Act
4
of 2005, 28 U.S.C. §§ 1332(a) and 1332(d) because the amount in controversy exceeds
5
$5,000,000.00 exclusive of interest and costs, and more than two-thirds of the users of the putative
6
class are citizens of states different than that of Facebook. Additionally, the Court has subject matter
7
jurisdiction pursuant to 28 U.S.C. § 1331.
8
9.
Venue is proper in this District under 28 U.S.C. § 1391(b) and (c). A substantial
9
portion of the events and conduct giving rise to the violations of law complained of herein occurred
10
in this District. Facebook’s principal executive offices and headquarters are located in Santa Clara
11
County, California.
12
IV.
13
STATEMENT OF FACTS
A.
About Facebook
10.
14
Facebook is the world’s largest social networking website, with over 500 million
15
registered users worldwide.
16
11.
17
According to Facebook, its “mission is to give people the power to share and make
the world more open and connected.”1 To accomplish that mission, Facebook allows anyone with
18
access to a computer and Internet connection to register for its services free of charge.
19
12.
One of the few requirements Facebook places on its registrants is that they provide
20
their actual names, rather than merely a pseudonymous username, as is commonplace with other
21
website registrations.
22
13.
Once registered, a Facebook user may post a multitude of information to their own
23
personal “Facebook profile” page, including their birth date, place of birth, current and past
24
addresses, present and past employment, relationship status, personal pictures, videos, and more.
25
26
27
28
1
http://www.facebook.com/facebook?v=info%ref=pf
-3FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
14.
Each Facebook user’s account is tied to a user ID number (“UID”) and/or username
2
that uniquely identifies the individual. Armed with knowledge of a user’s UID or username, a
3
person is able to access the user’s real name, gender, picture, friends, networks, interests, photos, and
4
any other information located on the user’s profile page.
5
15.
In many ways, Facebook is accomplishing its stated mission. Facebook users store
6
and share an unprecedented amount of personal information through its service. While users may
7
share this information in order to connect with other Facebook users, they are also sharing this
8
information with Facebook itself. And all this personal information is valuable to Facebook because
9
it is valuable to advertisers.
10
B.
Facebook’s Business Model
16.
11
Facebook consumers pay for Facebook’s products and services with their personal
12
information. In other words, Facebook users provide their valuable PII to Facebook in exchange for
13
access to facebook.com and for Facebook’s promises not to disclose their PII to third parties without
14
consent.
15
17.
This business model allows users to contract with Facebook: users provide valuable
16
PII; Facebook provides valuable services backed by privacy promises. This business model also
17
allows Facebook to make money because of the inherent monetary value of PII.
18
18.
From a revenue perspective, Facebook is an advertising platform. It makes money
19
much like television shows, magazines, newspapers, and other successful media—by selling
20
advertising.
21
19.
What separates Facebook from traditional media is its uninhibited and unprecedented
22
access to information about those individuals who will view the ads that Facebook sells to
23
advertisers.
24
20.
Historically, advertisers relied upon demographic sampling and other means to make
25
educated guesses at the characteristics and preferences of consumers. In contrast, Facebook actually
26
knows the true identities, likes and dislikes of users. Accordingly, Facebook is an incredibly
27
compelling advertising platform. Advertisers need not guess as to whether any given advertisement
28
will reach the appropriate demographics; Facebook can and does assure each advertiser that their
-4FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
advertisements will reach precisely the right audience. Therefore, Facebook’s access to user PII
2
makes advertising on Facebook more effective, efficient and valuable for advertisers, and in turn,
3
more valuable to Facebook.
4
21.
If not for the inherent and identifiable value of its users’ PII, Facebook’s business
5
model would collapse. Thus, its promises concerning the safeguarding of the personal consumer
6
data Facebook receives in exchange for its products and services are vital to its business and to its
7
advertising partners.
8
22.
This business model—providing online services to consumers and profiting from
9
selling access to their PII to third-parties—has burgeoned into a multi-billion dollar per year
10
industry.2
11
23.
Indeed, consumers themselves are beginning to recognize the value of their own PII,
12
and online giant Google has contemplated paying consumers for their personal data. As reported by
13
the Wall Street Journal, a confidential internal Google document outlined ways Google could profit
14
from its vast databases of personal information, including allowing users to “opt-in to share their
15
personal data in return for direct benefits (e.g., [Google] will pay for all/part of [the user’s] ISP bill
16
or other affiliate/coupon benefits).”3 In the document, Google also contemplates that “Google can
17
build a data exchange / trading platform allowing individual data owners to transact with others
18
directly, or openly sell their data to any bidders.”4 In fact, as reported by the Wall Street Journal,
19
consumers can now sell their own data for considerable and measurable sums of money, thus
20
realizing the sort of gains that Facebook is accustomed to generating from the sale of personal data.5
21
22
23
2
24
25
26
27
28
Unboxed—Rewarding Consumers for Providing Personal Data,
http://www.nytimes.com/2010/07/18/business/18unboxed.html?_r=1
3
Google: Into the Future, http://online.wsj.com/public/resources/documents/infoflash10.html?project=GOOGLEDOCS1008
4
Google Agonizes on Privacy as Ad World Vaults Ahead,
http://online.wsj.com/article/SB10001424052748703309704575413553851854026.html
5
Web’s Hot New Commodity: Privacy,
http://online.wsj.com/article/SB10001424052748703529004576160764037920274.html
-5FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
C.
Advertising on Facebook
2
24.
Users store an enormous amount of personal information on Facebook’s servers.
3
Facebook uses this information in conjunction with its advertising partners to target users based
4
upon highly specified criteria.
5
25.
Targeted advertisements drive Facebook’s bottom line. Utilizing the tremendous
6
amount of user data stored on its systems, Facebook has buoyed to become the preeminent conduit
7
of online advertising in the world.6
8
9
26.
The information that Facebook possesses about its users allows its advertising
partners to target users based on age, city of residence, gender, and interests—such as mountain
10
biking, for example. Using this data, an advertiser providing services for a mountain biking store in
11
Utah can direct ads to 20 to 30-year old men in Moab, Utah who have expressly shared with
12
Facebook an interest in mountain biking.
13
27.
The underlying user-inputted data used to facilitate the highly targeted advertising
14
described above is extremely valuable and coveted by virtually all companies conducting business
15
online. Extending the hypothetical above, the only thing better for an advertiser would be to know
16
the true identity of that 20-something male mountain biker. Equipped with that information, the
17
advertiser could reach out personally to the individual, collect additional information contained on
18
the user’s profile to further entice him, and/or begin to develop a digital dossier about the user to
19
target advertisements to him in the future. But Facebook’s own Privacy Policy prohibits this.
20
Facebook’s Privacy Policy specifically states:
21
How We Use Your Information
22
To serve personalized advertising to you. We don’t share your information
with advertisers without your consent. (An example of consent would be if
you asked us to provide your shipping address to an advertiser to receive a
free sample.) We allow advertisers to choose the characteristics of users who
will see their advertisements and we may use any of the non-personally
identifiable attributes we have collected (including information you may have
decided not to show to other users, such as your birth year or other sensitive
personal information or preferences) to select the appropriate audience for
23
24
25
26
27
28
6
http://www.comscore.com/Press_Events/Press_Releases/2010/5/Americans_Received_1_Trillion_
Display_Ads_in_Q1_2010_as_Online_Advertising_Market_Rebounds_from_2009_Recession.
-6FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
those advertisements. For example, we might use your interest in soccer to
show you ads for soccer equipment, but we do not tell the soccer equipment
company who you are…
2
3
Facebook’s Privacy Policy, http://www.facebook.com/policy.php (last visited May 31, 2010)
4
(emphasis in original).
5
28.
6
Facebook makes similar representations in its Privacy Guide:
We never share your personal information with our advertisers.
Facebook’s ad targeting is done entirely anonymously. If advertisers select
demographic targeting for their ads, Facebook automatically matches those
ads to the appropriate audience. Advertisers only receive anonymous data
reports.
7
8
9
Controlling How You Share, http://www.facebook.com/privacy/explanation.php (last visited May
10
31, 2010)(emphasis in original).
11
29.
Likewise, Facebook’s Statement of Rights and Responsibilities reads:
12
About Advertisements on Facebook
13
Our goal is to deliver ads that are not only valuable to advertisers, but also
valuable to you. In order to do that, you agree to the following:
14
15
1. You can use your privacy settings to limit how your name and profile
picture may be associated with commercial or sponsored content served by us.
You give us permission to use your name and profile picture in connection
with that content, subject to the limits you place.
16
17
2. We do not give your content or information to advertisers without
your consent.
18
19
Statement of Rights and Responsibilities, http://www.facebook.com/terms.php (last visited on May
20
31, 2010) (emphasis added).
21
30.
Facebook’s management officials have consistently made similar statements on the
22
official Facebook Blog. Facebook’s Director of Corporate Communications and Public Policy
23
posted the following on April 5, 2010:
24
25
26
27
28
Still others asked to be opted-out of having their information shared with
advertisers. This reflects a common misconception about advertising on
Facebook. We don’t share your information with advertisers unless you
tell us to (e.g. to get a sample, hear more, or enter a contest). Any assertion to
the contrary is false. Period. Instead, we enable advertisers to target
anonymized demographics and attributes. That is, a company selling boats can
target people between 40 and 50 years old who expressed an interest in
boating. However, we never provide the advertiser any names or other
information about the people who are shown, or even who click on, the ads.
-7FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
2
The Facebook Blog, http://blog.facebook.com/blog.php?post=379388037130 (last visited May 31,
3
2010) (emphasis added).
4
31.
In response to widespread concern about the privacy of user information, on February
5
16, 2009, Facebook’s CEO, Mark Zuckerberg, reiterated that personal information would not be
6
shared without user consent:
7
Our philosophy is that people own their information and control who they
share it with. When a person shares information on Facebook, they first need
to grant Facebook a license to use that information so that we can show it to
the other people they’ve asked us to share it with. Without this license, we
couldn’t help people share that information … In reality, we wouldn’t share
your information in a way that you wouldn’t want. The trust you place in us
as a safe place to share information is the most important part of what makes
Facebook work.
8
9
10
11
12
The Facebook Blog, http://blog.facebook.com/blog.php?post=54434097130 (last visited October 6,
13
2010).
14
32.
Through these and other representations, Facebook has consistently and adamantly
15
promised not to share any user’s specific identity or personal information with its advertising
16
partners.
17
33.
Facebook requires its users to agree to its Privacy Policy upon registering with the
18
site. Users must affirm that they “have read and agree[d] to” Facebook’s Terms of Use (a hyperlink
19
to the document entitled Statement of Rights and Responsibilities) and Facebook’s Privacy Policy.
20
D.
Facebook Violates Its Privacy Policy
21
34.
In direct violation of its own Privacy Policy and of the representations quoted above,
22
Facebook shares its users’ sensitive information with third party advertisers without its users’
23
knowledge or consent.
24
35.
When a Facebook user clicks on an advertisement posted on Facebook’s website,
25
Facebook sends a “Referrer Header” to the corresponding advertiser. The Referrer Header reveals
26
the specific web page address the user was viewing prior to clicking the advertisement. Through the
27
design of its system, Facebook sends Referrer Headers containing UIDs and the usernames to
28
advertisers.
-8FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
36.
When a Facebook advertiser receives a Referrer Header identifying the user who
2
clicked an ad, the advertiser is essentially granted access to obtain substantial additional information
3
about the user, such as the user’s name, gender, picture, friends, networks, interests, photos, and
4
more.
5
37.
Thus, Facebook advertisers gain even more detailed user information: not just
6
anonymous user demographics, but specific information about individual users including real name,
7
gender, friends, interests, and more. Facebook’s systems send this information to advertisers despite
8
Facebook’s Privacy Policy and its other representations as to users’ privacy vis-à-vis advertisers.
9
E.
The Scope and Duration of Facebook’s Nonconsensual Disclosures
38.
10
On information and belief, Facebook began disclosing communications containing
11
user’s usernames/UIDs no later than February 2010 when Facebook implemented a website
12
“upgrade” that began to embed ever more detailed data within Referrer Headers.
13
39.
14
15
These disclosures continued until the publication of a May 21, 2010 article in the
Wall Street Journal7 and a May 21, 2010 posting to the website of Professor Benjamin Edelman of
the Harvard Business School8 exposed Facebook’s practices. According to the Wall Street Journal
16
publication, after being contacted by the Journal, Facebook admitted that it had been passing data to
17
ad companies that could allow those companies to tell if a particular user was clicking an ad.
18
Facebook finally ceased the nonconsensual transmissions only after researchers discovered them.
19
F.
The Risks of Referrer Header Leakage
40.
20
The privacy risks attendant with leaking Referrer Header’s containing sensitive
21
information are well known and documented in the IT industry.
22
41.
23
The HTTP Referrer Header is a standard web browser function provided by web
browsers since the HTTP 1.0 specification in May 1996.9 The current version of the publicly-
24
25
26
27
28
7
http://online.wsj.com/article/SB10001424052748704513104575256701215465596.html.
http://www.benedelman.org/news/052010-1.html
9
http://www.w3.org/Protocols/rfc1945/rfc1945
8
-9FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
2
available HTTP specification, RFC 2616,10 provides for HTTP Referrer Headers in its provision
14.36.11
3
42.
It is well known that if a company inserts sensitive information, such as username or
4
UID into a URL, then the company risks disclosing this information whenever a user clicks a link to
5
a third-party website. Indeed, the drafters of the HTTP specification specifically flagged this risk; in
6
section 15.1.3, the HTTP specification advises developers of substantially the same actions
7
described in the instant case: “Authors of services which use the HTTP protocol SHOULD NOT use
8
GET based forms for the submission of sensitive data, because this will cause this data to be encoded
9
in the REQUEST-URI.”12
10
43.
Facebook’s software engineers knew or should have known that private user
11
information would be divulged as a result of Facebook’s website re-design. Facebook was put on
12
specific notice of the problem with their Referrer Headers when, in August 2009, Balachander
13
Krishnamurthy and Craig E. Wills published an article titled, “On the Leakage of Personally
14
Identifiable Information Via Online Social Networks.”13 In this article, the authors detail the
15
problem of Facebook and other sites sharing with advertisers information that the sites previously
16
promised to protect. The authors specifically sent this article to Facebook. Facebook confirmed its
17
knowledge of the Krishnamurthy et al. article in September 2009.14
18
44.
This unauthorized disclosure of a person’s identity and what Facebook page they
19
were viewing could have the effect of revealing to advertisers confidential and sometimes highly
20
sensitive information, including a user’s private interests. For example, if a Facebook user who was
21
gay and struggling to come out of the closet was viewing the Facebook page of a gay support group,
22
23
24
25
10
http://www.w3.org/Protocols/rfc2616/rfc2616.html
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.36
12
http://www.w3.org/Protocols/rfc2616/rfc2616-sec15.html#sec15.1.3
13
http://conferences.sigcomm.org/sigcomm/2009/workshops/wosn/papers/p7.pdf.
14
http://www.mediapost.com/publications/index.cfm?fa=Articles.showArticle&art_aid=114344.
11
26
27
28
-10FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
and then clicked on an ad, the advertiser would know the exact identity of that person, and that s/he
2
was viewing the Facebook page of a gay support group just before navigating to their site.
3
V.
4
45.
CLASS ACTION ALLEGATIONS
Plaintiff brings this action on behalf of himself and all other persons in the following
5
similarly-situated class: all Facebook users in the United States who, at any time after May 28,
6
2006 clicked on a third-party advertisement displayed on Facebook.com (the “Class”). Excluded
7
from the Class are Facebook, its officers and directors, legal representatives, successors or assigns,
8
any entity in which Facebook has or had a controlling interest, the judge to whom this case is
9
assigned and the judge’s immediate family.
10
46.
Every member of the proposed Class is a party to Facebook’s Terms and Conditions
11
and Privacy Policy as alleged herein.
12
47.
The Class is composed of numerous people, whose joinder in this action would be
13
impracticable. The disposition of their claims through this class action will benefit Class members,
14
the parties and the courts. Since 2006, Facebook has grown from millions of users to over 500
15
million users. Upon information and belief, there are millions of persons in the Class.
16
48.
Upon information and belief, the identities and contact information of the individual
17
members of the Class are available through Facebook’s electronic records.
18
49.
There is a well-defined community of interest in questions of law and fact affecting
19
the Class. These questions of law and fact predominate over individual questions affecting
20
individual Class members, including, but not limited to, the following:
21
a. what and how personally-identifiable data and advertisement click information was
22
transmitted to advertisers;
23
b. whether Facebook violated its Terms of Service, Privacy Policy, and other representations to
24
users by making its users’ personal information and advertisement click information
25
available to advertisers without authorization;
26
c. whether any Class member knew or consented to Facebook’s transmission of personally27
identifiable data to advertisers;
28
-11FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
d. whether Class members are entitled to damages as a result of Facebook’s conduct, and, if so,
2
what is the measure of those damages;
3
e. whether Facebook’s conduct described herein violated the Electronic Communications
4
Privacy Act, 18 U.S.C. § 2510 et seq. (the “ECPA”);
5
f. whether Facebook’s conduct described herein Stored Communications Act, 18 U.S.C. § 2701
6
et seq.(the “SCA”);
7
g. whether Facebook’s conduct described herein violated California’s Unfair Competition Law
8
(Cal. Bus. & Prof. Code § 17200, et seq.);
9
h. whether Facebook’s conduct described herein violated California’s Computer Crime Law
10
(Cal. Penal Code § 502);
11
i. whether Facebook’s conduct described herein violated the California Legal Remedies Act
12
(Cal. Civ. Code § 1750, et seq.);
13
j. whether Facebook’s conduct described herein constitutes a breach of contract; and
14
k. whether Facebook was unjustly enriched as a result of its conduct described herein.
15
50.
Facebook engaged in a common course of conduct giving rise to the legal rights
16
sought to be enforced by Class members. Similar or identical statutory and common law violations,
17
business practices and injuries are involved. Individual questions, if any, pale by comparison to the
18
numerous common questions that dominate.
19
51.
The injuries sustained by members of the Class flow, in each instance, from a
20
common nucleus of operative facts. In each case, Facebook caused or permitted unauthorized
21
communications of private and personally identifying information to be delivered to third parties
22
without adequate or any notice, consent or opportunity to opt out.
23
52.
Given the similar nature of the Class members’ claims and the absence of material
24
differences in the statutes and common laws upon which the Class members’ claims are based, a
25
nationwide class will be easily managed by the Court and the parties.
26
53.
Because of the relatively small size of the individual Class members’ claims, no Class
27
user could afford to seek legal redress on an individual basis.
28
-12FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
54.
Plaintiffs’ claims are typical of those of the Class as all members of the Class are
2
similarly affected by Facebook’s uniform and actionable conduct as alleged herein.
3
55.
Facebook has acted and failed to act on grounds generally applicable to Plaintiffs and
4
the other members of the Class, requiring the Court’s imposition of uniform relief to ensure
5
compatible standards of conduct toward the members of the Class.
6
56.
Plaintiffs will fairly and adequately protect the interests of the Class and have
7
retained counsel competent and experienced in class action litigation. Plaintiffs have no interests
8
antagonistic to, or in conflict with, the Class that Plaintiffs seek to represent.
9
57.
Plaintiffs reserve the right to revise the above class definition based on facts learned
10
in discovery.
11
COUNT I
(Violation of the Wiretap Act)
12
13
58.
Plaintiffs incorporate the foregoing allegations as if fully set forth herein.
14
59.
The Electronic Communications Privacy Act, 18 U.S.C. § 2510 et seq. (the “Wiretap
15
Act”) broadly defines an “electronic communication” as “any transfer of signs, signals, writing,
16
images, sounds, data, or intelligence of any nature transmitted in whole or in party by a wire, radio,
17
electromagnetic, photoelectronic or photooptical system that affects interstate or foreign
18
commerce…” 18 U.S.C. § 2510(12).
19
60.
Pursuant to the Wiretap Act, Facebook operates an “electronic communications
20
service” as defined in 18 U.S.C. § 2510(15). Facebook provides its users with the ability to send or
21
receive electronic communications to or from any of Facebook’s millions of users and to or from
22
third parties who are not Facebook users, such as advertisers. These electronic communications
23
include, among other things, the ability for users to send and receive private messages, share
24
photographs and video, and the ability to post messages on user profile pages that can be viewed by
25
anyone with access to those profile pages. Facebook also provides its advertisers the ability to send
26
electronic communications to Facebook users by placing targeted advertisements on Facebook.com,
27
and allows Facebook users to receive those electronic communications and send electronic
28
communications to advertisers by clicking on advertising banners.
-13FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
61.
The Wiretap Act broadly defines the contents of a communication. Pursuant to the
2
Wiretap Act, “contents” of a communication, when used with respect to any wire, oral, or electronic
3
communications, include any information concerning the substance, purport, or meaning of that
4
communication. 18 U.S.C. § 2510(8). “Contents,” when used with respect to any wire or oral
5
communication, includes any information concerning the identity of the parties to such
6
communication or the existence, substance, purport, or meaning of that communication. The
7
definition thus includes all aspects of the communication itself. No aspect, including the identity of
8
the parties, the substance of the communication between them, or the fact of the communication
9
itself, is excluded. The privacy of the communication to be protected is intended to be
10
comprehensive.
11
62.
The Wiretap Act prevents an electronic communications service provider from
12
intentionally divulging the contents of any communication while in transmission on that service to
13
any person or entity other than an addressee or intended recipient of such communication. 18 U.S.C.
14
§ 2511(3)(a).
15
63.
Plaintiffs and Class members are “person[s] whose ... electronic communication[s]
16
[are] disclosed... or intentionally used in violation of this chapter” within the meaning of 18 U.S.C. §
17
2520(a).
18
64.
By clicking on an advertisement banner displayed on Facebook.com, users are asking
19
Facebook to send an electronic communication to the advertiser who supplied the ad. But pursuant
20
to Facebook’s Terms and Conditions and its Privacy Policy, users do not expect and do not consent
21
to Facebook’s disclosure of any of their PII and do expect that their identities and what Facebook
22
page they were viewing at the time they clicked an ad will be configured by Facebook to be private.
23
65.
The design of the Facebook website, Facebook’s web page addresses, and Facebook’s
24
advertisement system is evidence of Facebook’s conscious objective to divulge the identities of its
25
users to advertisers. By divulging user identities and other user information to advertisers without
26
user consent, Facebook intentionally violated 18 U.S.C. § 2511(3)(a). Facebook intentionally
27
disclosed user identities to advertisers to enhance its profitability and revenue through advertising.
28
-14FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
This disclosure was not necessary for the operation of Facebook’s system or to protect Facebook’s
2
rights or property.
3
66.
Each incident in which Facebook divulged PII of a Facebook user is a separate and
4
distinct violation of the ECPA. Plaintiffs and members of the Class therefore seek remedy as
5
provided for by 18 U.S.C. § 2520, including such preliminary and other equitable or declaratory
6
relief as may be appropriate, damages consistent with subsection (c) of that section to be proven at
7
trial, punitive damages to be proven at trial, and attorneys’ fees and other litigation costs reasonably
8
incurred.
9
67.
Plaintiffs and the Class, pursuant to 18 U.S.C. § 2520(2), are entitled to preliminary,
10
equitable, and declaratory relief, in addition to statutory damages of the greater of $10,000 or $100 a
11
day for each day of violation, actual and punitive damages, reasonable attorneys’ fees, and
12
Facebook’s profits obtained from the violations described herein.
13
COUNT II
(Violations of the Stored Communications Act)
14
15
68.
Plaintiffs incorporate the foregoing allegations as if fully set forth herein.
16
69.
The Stored Communications Act of 1986 (“SCA”) incorporates the Wiretap Act’s
17
definition of an “electronic communication service.” 18 U.S.C. § 2711(1). As set forth above,
18
Facebook is an electronic communications service provider within the meaning of the ECPA and is
19
therefore also subject to the restrictions contained in the SCA governing electronic communications
20
service providers.
21
70.
The SCA also incorporates the Wiretap Act’s broad definition of “electronic
22
communication” and “electronic storage.” 18 U.S.C. § 2711(1). Pursuant to the Wiretap Act and
23
the SCA, “electronic storage” means any “temporary storage of a wire or electronic communication
24
incidental to the electronic transmission thereof.” 18 U.S.C. § 2510(17)(A). This type of electronic
25
storage includes communications in intermediate electronic storage that have not yet been delivered
26
to their intended recipient.
27
28
-15FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
71.
Examples of communications held by Facebook in temporary storage pursuant to 18
2
U.S.C. § 2510(17)(A) include private messages not yet received by the intended recipient and user
3
requests to Facebook to visit advertiser websites.
4
72.
The SCA prohibits any electronic communications service provider from divulging to
5
any person or entity the contents of a communication while in electronic storage by that service. 18
6
U.S.C. § 2702(a)(1).
7
73.
When a user signs up for Facebook’s services, the user provides PII to Defendant for
8
the sole purpose of communicating that information to his or her “friends” on Facebook’s system.
9
Instead, Facebook sends this information to third parties when the user clicks on advertisements, in
10
violation of 18 U.S.C. § 2702(a)(1).
11
74.
When a Facebook user clicks on an advertisement posted on Facebook’s website, the
12
user sends a message to Facebook requesting that Facebook connect the user to the specific
13
advertisement. This is because the displayed advertising is run on and through Facebook’s servers.
14
While the user may intend to or think s/he is communicating directly with the advertiser, technically,
15
the user is communicating with Facebook. In other words, Facebook actually acts as the
16
intermediary between the user and the advertiser. In this role, Facebook dictates the exact
17
information ultimately sent to the advertiser.
18
75.
This scenario is analogous to a Google user who drafts and sends an email using
19
Gmail to another person. While the user intends for the other person to receive the email, the user is
20
actually sending a message to Google asking Google to send the email message to the perceived
21
intended recipient because Google operates the Gmail service. Then, Google sends the email
22
message to the perceived intended recipient. In other words, the intended recipient of the email
23
message is, in the first instance, actually Google, not the other person. Surely, the Act—which
24
contains a multitude of restrictions concerning the disclosure of communications to third parties—
25
does not allow Google (who is necessarily an intended recipient) to share a Gmail user’s emails with
26
anyone it chooses.
27
76.
The same principle applies here. As alleged above, users have shared PII with
28
Facebook for the specific purposes of registering to use the service or to share information with
-16FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
friends. Users have not shared the PII with Facebook for the purpose of sharing it with advertisers.
2
In fact, Facebook has promised it would not share user PII with advertisers, and users, including
3
Plaintiffs, have relied on this promise. Much as Google should not be permitted to share Gmail user
4
emails with anyone it chooses because it is technically the intended recipient of such an email,
5
Facebook should not be permitted to share user PII or disclose the contents of its user’s requests
6
anyone it chooses, including advertisers.
7
77.
Upon clicking an advertisement displayed on Facebook, users expect, intend and
8
consent for Facebook to share the bare request to be taken to the advertisement with the
9
corresponding advertiser. But users do not expect, intend or consent for Facebook to add or pass
10
along PII with that request. That, though, is exactly what Facebook does via a “Referrer Header,”
11
despite Facebook’s explicit promises not to share personal information, including UIDs and
12
usernames with third-parties, such as advertisers. And it is the disclosure of the user PII that violates
13
the SCA.
14
78.
Plaintiffs plead the following facts in the alternative:
15
i. When a Facebook user clicks on an ad, the user is sending a communication to the
16
Advertiser requesting that the Advertiser send an electronic communication to that
17
individual allowing the user to view the Advertiser's website. Instead, Facebook
18
discloses an additional communication containing the user's username and/or UID to
19
the Advertiser in violation of 18 U.S.C. § 2702(a)(1).
20
ii. Alternatively, when a Facebook user clicks on an ad, the user is asking Facebook to
21
send an electronic communication to that Advertiser allowing the user to view the
22
Advertiser's website. Instead, Facebook exceeds its authority to disclose records
23
about its users by sending usernames and/or UIDs to the Advertiser, instead of a
24
simple request for the information needed to view the Advertiser's website, in
25
violation of 18 U.S.C. § 2702(a)(1).
26
iii. Alternatively, when a user signs up for Facebook's services, the user provides PII to
27
Defendant for the sole purpose of communicating that information to his or her
28
-17FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
"friends" on Facebook's system. Instead, Facebook sends this information to third
2
parties when the user clicks on advertisements, in violation of 18 U.S.C. § 2702(a)(1).
3
iv. Alternatively, when a Facebook user clicks on an ad, the user does not intend to send
4
Facebook nor the Advertiser any information regarding his or her true identity. By
5
disclosing records containing such information Facebook violated 18 U.S.C. §
6
2702(a)(1).
7
79.
The design of the Facebook website, Facebook’s web page addresses, and Facebook’s
8
advertisement system is evidence of Facebook’s knowledge of and intent to divulge the private
9
contents of its users’ electronic communications without user consent, in violation of 18 U.S.C.
10
§ 2702(1)(a). Facebook intentionally disclosed user identities and other information to advertisers to
11
enhance its profitability and revenue through advertising. The disclosures were not necessary for the
12
operation of Facebook’s system or to protect Facebook’s rights or property.
13
80.
The SCA definition of “electronic storage” also includes “storage of [a wire or
14
electronic] communication by an electronic communication service for purposes of backup
15
protection of such communication.” 18 U.S.C. § 2510(17)(B). The information that Facebook users
16
send via electronic communications to Facebook to be displayed in user profiles—such as name,
17
gender, pictures, friends, religious, political and sexual preferences, wall posts and more—is
18
electronically stored by Facebook for backup purposes. All of the foregoing user information, once
19
posted, remains available for viewing and re-access at a later time by the user and other persons
20
authorized by the user to access that information. This storage is one of the main services that
21
Facebook provides to its users.
22
81.
Because Facebook thus operates as a “virtual filing cabinet” for its users, allowing
23
them to store and re-access at a later time their photos, messages, wall posts and more, Facebook is
24
also a “remote computing service” provider pursuant to 18 U.S.C. § 2711(2).
25
82.
The SCA, at 18 U.S.C. § 2702(a)(2), provides that “a person or entity providing an
26
remote communication service to the public shall not knowingly divulge to any person or entity the
27
contents of any communication which is carrier or maintained on that service (A) on behalf of, and
28
received by means of electronic transmission…a subscriber or customer of such service; (B) solely
-18FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
for the purpose of providing storage…to such subscriber or customer, if the provider is not
2
authorized to access the contents of any such communications for purposes of providing any services
3
other than storage or computer processing.”
4
83.
As a result of Facebook’s disclosure of user identities, Facebook gives unauthorized
5
access to and thereby divulges electronically-stored information to advertisers about the particular
6
user who clicked an ad. With the user name that Facebook provides them, advertisers can navigate
7
to user profiles and see a user’s stored electronic communications, including Facebook names,
8
gender, pictures, friends, networks, wall posts, photos, and more. Because Facebook is both an
9
electronic communication service provider and a remote computing service provider, Facebook’s
10
disclosure of this information to advertisers is in violation of both 18 U.S.C. § 2702(a)(1) and (2).
11
As set forth above, Facebook’s disclosures were knowing and intentional and designed to enhance
12
its profitability and revenue through advertising. The disclosures were not necessary for the
13
operation of Facebook’s system or to protect Facebook’s rights or property.
14
84.
Facebook intentionally and knowingly divulged confidential and private information
15
relating to Plaintiffs and Class member’ stored electronic communications without the consent,
16
knowledge or authorization of Plaintiffs and members of the Class.
17
85.
Plaintiffs and Class members are “person[s] aggrieved by [a] violation of [the SCA]
18
in which the conduct constituting the violation is engaged in with a knowing or intentional state or
19
mind…” within the meaning of 18 U.S.C. § 2707(a).
20
86.
Each incident in which Facebook provided personally identifiable information of a
21
Facebook user, thereby divulging that user’s stored communications to a third party, is a separate
22
and distinct violation of the SCA, subject to the remedies provided under the SCA, and specifically
23
pursuant to 18 U .S.C. § 2707(a).
24
87.
Plaintiffs and users of the Class therefore seek remedy as provided for by 18 U.S.C. §
25
2707(b) and (c), including such preliminary and other equitable or declaratory relief as may be
26
appropriate, damages consistent with subsection (c) of that section to be proven at trial, punitive
27
damages to be proven at trial, and attorneys’ fee and other litigation costs reasonably incurred.
28
-19FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
88.
Plaintiffs and the Class, pursuant to 18 U.S.C. § 2707(c), are entitled to preliminary,
2
equitable, and declaratory relief, in addition to statutory damages of no less than $1,000 per
3
violation, actual and punitive damages, reasonable attorneys’ fees, and Facebook’s profits obtained
4
from the violations described herein.
5
6
7
COUNT III
(Violation of Cal. Bus. & Prof. Code § 17200)
(This Count has been dismissed with prejudice and is included only to preserve a potential
appeal.)
8
89.
Plaintiff incorporates the foregoing allegations as if fully set forth herein.
9
90.
California’s Unfair Competition Law (“UCL”), Cal. Bus. & Prof. Code § 17200, et
10
seq., protects both consumers and competitors by promoting fair competition in commercial markets
11
for goods and services.
12
91.
The UCL prohibits any unlawful, unfair or fraudulent business act or practice. A
13
business practice need only meet one of the three criteria to be considered unfair competition. An
14
unlawful business practice is anything that can properly be called a business practice and that at the
15
same time is forbidden by law.
16
17
18
92.
As described herein, Facebook’s nonconsensual disclosure of its users’ personal
information to third-party advertisers without their authorization is a violation of the UCL.
93.
Facebook has violated the “unlawful” prong of the UCL in that Facebook’s conduct
19
violated the ECPA (18 U.S.C. § 2510 et seq.), the SCA (18 U.S.C. § 2701 et seq.), Consumer Legal
20
Remedies Act (Cal. Civ. Code § 1750 et seq.), and the California Computer Crime Law (Cal. Penal
21
Code § 502).
22
94.
Facebook violated the fraudulent prong of the UCL by explicitly representing in its
23
Privacy Policy and in subsequent public statements that it would not make users’ personal
24
information available to any third party without authorization. Facebook used those
25
misrepresentations to induce users to submit their personally identifiable information to its website.
26
Facebook then knowingly transmitted that information to third parties without its users’
27
authorization.
28
-20FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
95.
Facebook violated the unfair prong of the UCL by gaining control over and divulging
2
to third parties its users’ PII without consent and under false pretenses.
3
96.
Facebook’s unfair or deceptive practices occurred primarily and substantially in
4
California. Decisions concerning the retention and safeguarding the disclosure of user information
5
were made in California, Facebook maintains all or a substantial part of its computer systems
6
containing user information in California, and the disclosure of its users’ information took place
7
primarily and substantially in California.
8
97.
Pursuant to Cal. Bus. & Prof. Code § 17203, Plaintiffs seek an order of this Court
9
permanently enjoining Facebook from continuing to engage in the unfair and unlawful conduct
10
described herein. Plaintiffs seek an order requiring Facebook to (1) immediately cease the unlawful
11
practices stated in this Complaint; and (2) awarding Plaintiffs and the Class reasonable costs and
12
attorneys’ fees pursuant to Cal. Code Civ. Proc. § 1021.5.
13
14
15
16
COUNT IV
(Violation of California’s Computer Crime Law (“CCCL”), Cal. Penal Code § 502)
(This Count has been dismissed with prejudice as it relates to §§ 502(c)(1)(2)(3)(6) & (7), and is
included only to preserve a potential appeal, except for the allegations under § 502(c)(8), which
has not been dismissed with prejudice.)
98.
Plaintiffs incorporate the foregoing allegations as if fully set forth herein.
99.
Facebook knowingly accessed and without permission used any data, computer,
17
18
computer system, or computer network in order to execute a scheme or artifice to deceive and/or to
19
wrongfully control or obtain money, property, or data in violation of Cal. Penal Code § 502(c)(1).
20
Facebook did so by accessing and sharing with advertisers the personal information of Plaintiffs and
21
Class members in order to deceive Facebook users and/or to wrongfully obtain money from
22
advertisers and more data from Facebook users.
23
100.
Facebook knowingly accessed and without permission took, copied, or made use of
24
Plaintiffs’ and Class members’ personal information in violation of § 502(c)(2).
25
101.
Facebook knowingly and without permission used or caused to be used computer
26
services by impermissibly accessing, collecting, and transmitting Plaintiffs’ and Class members’
27
personal information in violation of § 502(c)(3).
28
-21FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
102.
Facebook knowingly and without permission provided or assisted in providing a
2
means of accessing a computer, computer system, or computer network by creating a system that
3
allowed advertisers to impermissibly access, collect, and transmit Plaintiffs’ and Class members’
4
personal information in violation of § 502(c)(6).
5
103.
Facebook knowingly and without permission accessed or caused to be accessed
6
Plaintiffs’ and Class members’ computers and/or computer networks by impermissibly divulging
7
Plaintiffs’ and Class members’ personal information to advertisers in violation of § 502(c)(7).
8
104.
Facebook knowingly and without permission introduced a computer contaminant, as
9
defined in § 502(b)(10), by introducing computer instructions designed to record or transmit to
10
advertisers Plaintiffs’ and the Class’s personally-identifiable information on Facebook’s computer
11
networks without the intent or permission of Plaintiffs or the Class in violation of § 502(c)(8). These
12
instructions usurped the normal operations of the relevant computers, which by normal operation
13
would not transmit the PII of Plaintiff and/or the Class members.
14
105.
As a direct and proximate result of Facebook’s violation of § 502, Facebook caused
15
loss to Plaintiffs and the Class members in an amount to be proven at trial. Plaintiffs and the Class
16
are entitled to the recovery of attorneys’ fees pursuant to § 502(e).
17
106.
Plaintiffs and Class members have also suffered irreparable injury as a result of
18
Facebook’s unlawful conduct, including the collection and sharing of their personal information.
19
Additionally, because the stolen information cannot be returned, the harm from the security breach is
20
ongoing and compounding. Accordingly, Plaintiffs and the Class have no adequate remedy at law,
21
entitling them to injunctive relief.
22
23
24
COUNT V
(Violation of the Consumers Legal Remedies Act, Cal. Civ. Code § 1750, et seq.)
(This Count has been dismissed with prejudice and is included only to preserve a potential
appeal.)
25
107.
Plaintiffs incorporate the foregoing allegations as if fully set forth herein.
26
108.
The Consumers Legal Remedies Act prohibits the act, use or employment by any
27
person of any deception, fraud, false pretense, false promise, misrepresentation, concealment,
28
suppression or omission of any material fact with intent that others rely upon such act in connection
-22FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
with the sale or advertisement of any merchandise whether or not any person has in fact been misled,
2
deceived or damaged thereby.
3
109.
As described within, Facebook has engaged in deceptive practices, unlawful methods
4
of competition, and/or unfair acts as defined by Cal. Civ. Code §§ 1750, et seq., to the detriment of
5
Plaintiffs and the Class.
6
110.
Facebook, acting with knowledge, intentionally and unlawfully brought harm upon
7
Plaintiffs and the Class by deceptively inducing Plaintiffs and the Class to register with Facebook,
8
supply Facebook with personal and private information, and click on advertisements based upon
9
deceptive and misleading representations that it would not disclose their personal or private
10
information to third-parties without authorization. Specifically, Facebook violated Cal. Civ. Code §
11
1750 in at least the following respects:
12
a.
In violation of § 1770(a)(5) by representing that goods or services have characteristics
13
and benefits that they do not have;
14
b.
In violation of § 1770(a)(14) by representing that a transaction confers or involves
15
rights, remedies, or obligations which it does not have or involve, or which are prohibited by law;
16
and
17
c.
In violation of § 1770(a)(16) by representing that the subject of a transaction has been
18
supplied in accordance with a previous representation when it has not.
19
111.
Plaintiffs and the Class have suffered harm as a direct and proximate result of the
20
Facebook’s violations of law and wrongful conduct.
21
112.
Under Cal. Civ. Code § 1780(a) & (b), Plaintiffs and the Class seek injunctive relief
22
requiring Facebook to cease and desist the illegal conduct described herein, and any other
23
appropriate remedy for violations of the CLRA. For the sake of clarity, Plaintiffs explicitly disclaim
24
any claim for damages under the CLRA at this time.
25
COUNT VI
(Breach of Contract)
26
27
113.
Plaintiffs incorporate the foregoing allegations as if fully set forth herein.
28
-23FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
114.
In order to register for and use its social-networking website, Facebook required that
2
Plaintiffs and the Class affirmatively assent to its Terms and Conditions and Privacy Policy (the
3
“Agreement”).
4
115.
The Agreement’s provisions constitute a valid and enforceable contract between
5
Plaintiffs and the Class on the one hand, and Facebook on the other.
6
116.
Under the Agreement, Plaintiffs and the Class transmitted sensitive personally-
7
identifiable information to Facebook in exchange for use of Facebook and Facebook’s promise that
8
it would not share that personal information with third parties, including but not limited to
9
advertisers, without their authorization.
10
117.
Facebook users pay for Facebook’s services with their personal information.
11
Facebook’s users exchange something valuable—access to their personal information—for
12
Facebook’s services and Facebook’s promise to safeguard that personal information. In particular,
13
Facebook promises that any personal information submitted by its users will only be disclosed to
14
advertisers in the specific ways and circumstances set out in Facebook’s privacy policy and with
15
user consent.
16
118.
Facebook collects revenues in large part because the personal information submitted
17
by its users increases the value of Facebook’s advertising services. Because Facebook has access to
18
highly personal information about its users, Facebook’s advertising platform is particularly attractive
19
to advertisers and marketers who can and do use that personal information to deliver highly-targeted
20
ads to Facebook’s users. In this regard, Facebook’s services are vehicles to acquire personal
21
information about consumers in order to sell that personal information to advertisers.
22
119.
If not for the inherent and identifiable value of access to personal consumer
23
information, Facebook would be much less profitable. Thus, its promises concerning the
24
safeguarding of the personal information Facebook receives from its users in exchange for its
25
services are vital to its business and its users.
26
120.
Facebook’s practices—providing services to consumers and profiting from the sale of
27
personal information to advertisers—have helped Facebook achieve a valuation exceeding $30
28
billion.
-24FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
121.
Facebook materially breached the terms of the Agreement through its unlawful
2
conduct alleged herein, including its disclosure of Plaintiffs’ and the Class’s personal information to
3
its advertiser partners.
4
122.
As a result of Facebook’s misconduct and breach of the Agreement described herein,
5
Plaintiffs and the Class suffered damages. Plaintiff and the Class members did not receive the benefit
6
of the bargain for which they contracted and for which the paid valuable consideration in the form of
7
their personal information, which, as alleged above, has ascertainable value to be proven at trial. In
8
other words, Plaintiff and each Class member gave up something of value, PII, in exchange for
9
access to Facebook and Facebook’s privacy promises. Facebook materially breached the contracts
10
by violating its privacy terms, thus depriving Plaintiff and Class members the benefit of the bargain.
11
Thus, their actual and appreciable damages take the form of the value of their PII that Facebook
12
wrongfully shared with advertisers.
13
COUNT VII
(Violation of Cal. Civ. Code §§ 1572 & 1573)
14
123.
Plaintiffs incorporate the foregoing allegations as if fully set forth herein.
124.
Cal. Civ. Code § 1572 provides in relevant part that actual fraud exists when a party
15
16
to a contract suppresses “that which is true, by one having knowledge or belief of the fact” “with
17
intent to deceive another party thereto, or to induce him to enter into the contract.”
18
125.
Cal. Civ. Code § 1573 provides in relevant part that constructive fraud exists “[i]n
19
any such act or omission as the law specially declares to be fraudulent, without respect to actual
20
fraud.”
21
126.
Facebook violated § 1572 through its repeated and explicit false assertions that it
22
would not share the identity of its users with its advertisers without consent, as described herein.
23
Facebook further violated this section by suppressing its knowledge of this fact. Plaintiffs Gould
24
and Robertson relied on Facebook’s false assertions in contracting with and using Facebook.
25
127.
Additionally and/or alternatively, Facebook violated § 1573 by breaching its duty to
26
protect its users’ identities from its advertisers and gaining an advantage in doing so, by misleading
27
its users to their prejudice, as described herein.
28
-25FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
128.
Plaintiffs, on behalf of themselves and the Class, seek damages from Facebook,
2
including but not limited to disgorgement of all proceeds Facebook obtained from its unlawful
3
business practices.
4
5
6
COUNT VIII
(Unjust Enrichment (In the Alternative))
(This Count has been dismissed with prejudice and is included only to preserve a potential
appeal.)
129.
Plaintiffs incorporate the foregoing allegations as if fully set forth herein.
130.
Plaintiffs and the Class have conferred a benefit upon Facebook. Facebook has
7
8
received and retained money belonging to Plaintiffs and the Class as a result of sharing its users’
9
personal information with its advertisers without their consent, as described herein.
10
131.
Facebook appreciates or has knowledge of said benefit.
132.
Under principles of equity and good conscience, Facebook should not be permitted to
11
12
retain money belonging to Plaintiffs and the Class that it unjustly received as a result of its actions.
13
133.
Plaintiffs and the Class have suffered loss as a direct result of Facebook’s conduct.
134.
Plaintiffs, on their own behalf and on behalf of the Class, seek the imposition of a
14
15
constructive trust on and restitution of the proceeds of Facebook received as a result of its conduct
16
described herein, as well as attorney’s fees and costs pursuant to Cal. Civ. Proc. Code § 1021.5.
17
PRAYER FOR RELIEF
18
WHEREFORE, Plaintiffs, individually and on behalf of the Class, pray for the following
19
relief:
20
A.
Certify this case as a class action on behalf of the Class defined above, appoint
21
Plaintiffs Gould and Robertson as class representatives, and appoint their counsel as class co22
counsel;
23
B.
Declare that Facebook’s actions, as described herein, violate the ECPA (18 U.S.C. §
24
2510 et seq.), the SCA (18 U.S.C. § 2701 et seq.), California Unfair Competition Law (Cal. Bus. &
25
Prof. Code § 17200, et seq.), the Computer Crime Law (Cal. Penal Code § 502), and the Consumer
26
Legal Remedies Act (Cal. Bus. & Prof. Code § 1750), and constitute breach of contract, fraud, and
27
unjust enrichment;
28
-26FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
C.
Awarding injunctive and other equitable relief as is necessary to protect the interests
2
of Plaintiffs and the Class, including, inter alia, an order prohibiting Facebook from engaging in the
3
wrongful and unlawful acts described herein;
4
D.
Disgorge Facebook of all revenue earned from displaying third-party advertising on
5
Facebook.com during the class period;
6
E.
Awarding damages, including statutory damages where applicable, to Plaintiffs and
7
the Class in an amount to be determined at trial;
8
F.
Awarding all economic, monetary, actual, consequential, and compensatory damages
9
caused Facebook’s conduct, and if its conduct is proved willful, award Plaintiffs and the Class
10
exemplary damages;
11
G.
Award restitution against Facebook for all money to which Plaintiffs and the Class
12
are entitled in equity;
13
H.
Awarding Plaintiffs and the Class their reasonable litigation expenses and attorneys’
I.
Awarding Plaintiffs and the Class pre- and post-judgment interest, to the extent
14
fees;
15
16
allowable; and
17
J.
Awarding such other and further relief as equity and justice may require.
18
19
Dated: June 13, 2011
20
/s/ Kassra P. Nassiri
Kassra P. Nassiri
Attorneys for Plaintiffs and the Putative Class
21
22
23
24
25
Respectfully submitted,
NASSIRI & JUNG LLP
Dated: June 13, 2011
Respectfully submitted,
EDELSON MCGUIRE, LLP
/s/ Sean Reis _
Sean Reis
Attorneys for Plaintiffs and the Putative Class
26
27
28
-27FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
1
Dated: June 13, 2011
Respectfully submitted,
ASCHENBRENER LAW, P.C.
2
/s/ Michael Aschenbrener_
Michael Aschenbrener
Attorneys for Plaintiffs and the Putative Class
3
4
JURY TRIAL DEMANDED
5
6
Plaintiffs hereby demand a trial by jury.
7
8
Dated: June 13, 2011
9
Respectfully submitted,
NASSIRI & JUNG LLP
/s/ Kassra P. Nassiri ______
Kassra P. Nassiri
Attorneys for Plaintiffs and the Putative Class
10
11
12
Dated: June 13, 2011
13
Respectfully submitted,
EDELSON MCGUIRE, LLP
/s/ Sean Reis _
Sean Reis
Attorneys for Plaintiffs and the Putative Class
14
15
16
17
18
19
Dated: June 13, 2011
Respectfully submitted,
ASCHENBRENER LAW, P.C.
/s/ Michael Aschenbrener_
Michael Aschenbrener
Attorneys for plaintiffs and the Putative Class
20
21
22
23
24
25
26
27
28
-28FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
Case No. 10-cv-02389-JW
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?