Robertson v. Facebook, Inc.

Filing 1

COMPLAINT against Facebook, Inc. ( Filing fee $ 350, receipt number 54611007450.). Filed byMike Robertson. (srm, COURT STAFF) (Filed on 6/1/2010) (gm, COURT STAFF).

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

KASSRA P. NASSIRI (215405) [e-mail] CHARLES H. JUNG (217909) [e-mail] NASSIRI & JUNG LLP 251 Kearny Street, Suite 501 San Francisco, California 94108 Telephone: [phone] Facsimile: [phone] Attorneys for Plaintiff Mike Robertson UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION

MIKE ROBERTSON, individually and on behalf of all others similarly situated, Plaintiff, vs. FACEBOOK, INC., a Delaware corporation, and DOES 1-50, inclusive, Defendant.

Case No. CLASS ACTION COMPLAINT FOR: 1. BREACH OF CONTRACT; 2. BREACH OF IMPLIED COVENANT OF GOOD FAITH AND FAIR DEALING; 3. VIOLATION OF THE ELECTRONIC COMMUNICATIONS PRIVACY ACT; 4. VIOLATION OF STORED COMMUNICATIONS ACT; AND 5. UNJUST ENRICHMENT. ACTION FILED: 05/31/10 JURY TRIAL DEMANDED

Plaintiff brings this suit on behalf of himself and all others similarly situated, and makes the 23 following allegations on information and belief, except as to allegations pertaining to Plaintiff, 24 which are based on his personal knowledge: 25 26 1. 27 individuals whose privacy was violated by the actions of Facebook, Inc. ("Facebook"). 28 I. INTRODUCTION This is a class action lawsuit, brought by, and on behalf of similarly-situated

-1CLASS ACTION COMPLAINT

1 2. 2 our advertisers" and "We do not give your content of information to advertisers without your 3 consent." 4 3. 5 policies, Facebook intentionally and knowingly transmitted personal user information to third party 6 advertisers without member consent. 7 4. 8 a. Facebook's own terms and conditions with its members; 9 b. Electronic Communications Privacy Act, 18 U.S.C. § 2510 et seq. (the "ECPA"); 10 and 11 c. Stored Communications Act, 18 U.S.C. § 2701 et seq.(the "SCA"). 12 13 5. 14 2008 and June 2010, Plaintiff clicked on at least one advertising banner from his Facebook profile 15 page. 16 6. 17 maintains its headquarters in Palo Alto, California. 18 19 7. 20 portion of the wrongdoing alleged in this complaint took place in this state, (b) all defendants are 21 authorized to do business here, have sufficient minimum contacts with this state, and/or otherwise 22 intentionally avail themselves of the markets in this state through the promotion, marketing and sale 23 of products and services in this state, to render the exercise of jurisdiction by this Court permissible 24 under traditional notions of fair play and substantial justice. 25 8. 26 of 2005, U.S.C. §§ 1332(a) and 1332(d) because the amount in controversy exceeds $5,000,000.00 27 exclusive of interest and costs, and more than two-thirds of the members of the putative class are 28 citizens of states different than that of Facebook.
-2CLASS ACTION COMPLAINT

Facebook's own policies state that "We never share your personal information with

Unbeknownst to Facebook members, and in violation of Facebook's own stated

Facebook's conduct violated one or more of the following:

II.

PARTIES

Plaintiff Mike Robertson is a resident of Marin County, California. Between June

Defendant Facebook, Inc. (hereinafter, "Facebook") is a Delaware corporation which

III.

JURISDICTION AND VENUE

This Court has personal jurisdiction over all defendants because (a) a substantial

This Court has subject matter jurisdiction pursuant to the Class Action Fairness Act

1 9. 2 portion of the events and conduct giving rise to the violations of law complained of herein occurred 3 in this District. Facebook's principal executive offices and headquarters are located in Palo Alto, 4 California. 5 6 10. 7 offices of defendant Facebook are located in Santa Clara County. 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 A. 11. 12. with friends. 13. Facebook membership requires the member to provide their actual name, birth date, V. STATEMENT OF FACTS Facebook Receives Personal Information from its Members and Promises not to Disclose that Information to Advertisers Facebook owns and operates an online web site located at http://www.facebook.com. Facebook is an online social network to exchange personal information confidentially IV. INTRADISTRICT ASSIGNMENT Intradistrict assignment to the San Jose Division is proper because the principal Venue is proper in this District under 28 U.S.C. § 1391(b) and (c). A substantial

gender and email address. Facebook also requires members to register with a unique username and password in order to access its computer network. Facebook allows members to provide information about the member's "hometown" to join a "network," which generally is a high school, college, workplace, or city. Facebook members also have the option to provide additional personal information including sexual preferences, political and religious convictions, telephone numbers, address, activities, interest, education, work, and to post photographs. 14. The information described in Paragraph 13 above can be used to identify and locate

the Facebook member. Personally identifiable information (hereinafter, "PII") is information that can be used to distinguish or trace an individual's identity, and when combined or used with other identifying information, is, or can be linked or linkable to a specific individual. 15. Facebook, which is under increasing scrutiny over its privacy practices from

consumer, privacy advocates and lawmakers, enacted a privacy policy in order to address privacy concerns and to argue against the need for government regulation. 16. conditions:
-3CLASS ACTION COMPLAINT

Facebook requires its members to be contractually bound to the following terms and

1 a. Facebook's Privacy Guide states as follows: 2 3 4 5 6 31, 2010)(emphasis in original). 7 b. Facebook's Privacy Policy states as follows: 8 9 10 11 12 13 14 15 16 17 18 (emphasis in original). 19 c. 20 21 22 23 24 25 26 27 28 31, 2010).
-4CLASS ACTION COMPLAINT

We never share your personal information with our advertisers. Facebook's ad targeting is done entirely anonymously. If advertisers select demographic targeting for their ads, Facebook automatically matches those ads to the appropriate audience. Advertisers only receive anonymous data reports. Controlling How You Share, http://www.facebook.com/privacy/explanation.php (last visited May

To serve personalized advertising to you. We don't share your information with advertisers without your consent. (An example of consent would be if you asked us to provide your shipping address to an advertiser to receive a free sample.) We allow advertisers to choose the characteristics of users who will see their advertisements and we may use any of the non-personally identifiable attributes we have collected (including information you may have decided not to show to other users, such as your birth year or other sensitive personal information or preferences) to select the appropriate audience for those advertisements. For example, we might use your interest in soccer to show you ads for soccer equipment, but we do not tell the soccer equipment company who you are. You can see the criteria advertisers may select by visiting our advertising page. Even though we do not share your information with advertisers without your consent, when you click on or otherwise interact with an advertisement there is a possibility that the advertiser may place a cookie in your browser and note that it meets the criteria they selected. Facebook's Privacy Policy, http://www.facebook.com/policy.php (last visited May 31, 2010)

Facebook's Statement of Rights and Responsibilities states as follows:

About Advertisements on Facebook Our goal is to deliver ads that are not only valuable to advertisers, but also valuable to you. In order to do that, you agree to the following: 1. You can use your privacy settings to limit how your name and profile picture may be associated with commercial or sponsored content served by us. You give us permission to use your name and profile picture in connection with that content, subject to the limits you place. 2. We do not give your content or information to advertisers without your consent. Statement of Rights and Responsibilities, http://www.facebook.com/terms.php (last visited on May

1 17. 2 following on the Facebook Blog: 3 4 5 6 7 8 9 10 11 12 18. 13 Information Via Online Social Networks" (hereinafter, "August 2009 Research Paper") written by 14 researchers at AT&T Labs and Worcester Polytechnic Institute flagged Facebook's sharing of 15 member PII. The August 2009 Research Paper highlighted Facebook's practice of transmitting its 16 members' user names or ID numbers tied to personal profiles being viewed when members click on 17 ads. The researchers concluded that by using such leaked information in combination with tracking 18 cookies, third parties, such as advertisers, could gain access to a Facebook member's other PII listed 19 in Paragraph 13 of this Complaint, identify individual Facebook members, and even follow their 20 movements across the internet. 21 19. 22 ("WSJ Exposé"), Facebook had been sending to advertisers information that directed those 23 advertisers back to a Facebook member's profile page full of personal information of the type set 24 forth in Paragraph 13 of this Complaint. According to the article, in some cases Facebook signaled 25 "which user name or ID was clicking on the ad as well as the user name or ID of the page being 26 viewed. By seeing what ads a user clicked on, an advertiser could tell something about a user's 27 interests." 28 According to an exposé published by the online Wall Street Journal on May 21, 2010 Still others asked to be opted-out of having their information shared with advertisers. This reflects a common misconception about advertising on Facebook. We don't share your information with advertisers unless you tell us to (e.g. to get a sample, hear more, or enter a contest). Any assertion to the contrary is false. Period. Instead, we enable advertisers to target anonymized demographics and attributes. That is, a company selling boats can target people between 40 and 50 years old who expressed an interest in boating. However, we never provide the advertiser any names or other information about the people who are shown, or even who click on, the ads. The Facebook Blog, http://blog.facebook.com/blog.php?post=379388037130 (last visited May 31, 2010). B. Facebook Intentionally Shares Personal Data with Advertisers Without Member Knowledge or Consent In August 2009, a paper entitled "On the Leakage of Personally Identifiable Facebook's Director of Corporate Communications and Public Policy posted the

-5CLASS ACTION COMPLAINT

1 20. 2 August 2009 Research Paper contacted Facebook about the transmission of personal data, 3 Facebook's practice persisted. According to the WSJ Exposé, it wasn't until after being contacted 4 by the Wall Street Journal that Facebook changed its software to prevent the indentifying code tied 5 to the user from being transmitted: 6 7 8 9 21. 10 similarly-situated class: all Facebook members who, at any time after June 1, 2006, clicked on an 11 advertisement banner located on their Facebook profile page (the "Class"). Excluded from the 12 Class are Facebook, its officers and directors, members of their immediate families and each of their 13 legal representatives, officers, directors, successors or assigns and any entity in which Facebook has 14 or have had a controlling interest, the judge to whom this case is assigned and any member of the 15 judge's immediate family. 16 22. 17 alleged herein. 18 23. 19 impracticable. The disposition of their claims through this class action will benefit Class members, 20 the parties and the courts. Since 2006, Facebook has grown from millions of users to over 300 21 million users. Upon information and belief, there are thousands of persons in the Class. 22 24. 23 of the Class are available through Facebook's electronic records. 24 25. 25 the Class. These questions of law and fact predominate over individual questions affecting 26 individual Class members, including, but not limited to, the following: 27 a. What and how personally identifiable data was transmitted to advertisers; 28 There is a well-defined community of interest in questions of law and fact affecting Upon information and belief, the identities and addresses of the individual members The Class is composed of numerous people, whose joinder in this action would be Every member of the proposed Class is a party to Facebook's terms and conditions as A Facebook spokesman acknowledged it has been passing data to ad companies that could allow them to tell if a particular user was clicking an ad. VI. CLASS ACTION ALLEGATIONS Also according to the WSJ Exposé, although the researchers who published the

Plaintiff brings this action on behalf of himself and all other persons in the following

-6CLASS ACTION COMPLAINT

1 b. Whether Facebook's terms and conditions prohibit Facebook from sending 2 personally identifiable data to advertisers; 3 c. Whether any Class member knew or consented to Facebook's transmission of 4 personally identifiable data to advertisers; 5 d. Whether Class members are entitled to damages as a result of Facebook's 6 conduct, and, if so, what is the measure of those damages; 7 e. Whether Facebook's conduct towards the members of the Class violated the 8 ECPA, and the SCA, its contract with the Class, and whether Facebook was 9 unjustly enriched thereby, as alleged below. 10 26. 11 sought to be enforced by Class members. Similar or identical statutory and common law violations, 12 business practices and injuries are involved. Individual questions, if any, pale by comparison to the 13 numerous common questions that dominate. 14 27. 15 common nucleus of operative facts. In each case, Facebook caused or permitted unauthorized 16 communications of private and personally indentifying information to be delivered to third parties 17 without adequate or any notice, consent or opportunity to opt out. 18 28. 19 differences in the statutes and common laws upon which the Class members' claims are based, a 20 nationwide class will be easily managed by the Court and the parties. 21 29. 22 member could afford to seek legal redress on an individual basis. 23 30. 24 similarly affected by Facebook's uniform and actionable conduct as alleged herein. 25 31. 26 counsel competent and experienced in class action litigation. Plaintiff has no interests antagonistic 27 to, or in conflict with, the Class that Plaintiff seeks to represent. 28 Plaintiff will fairly and adequately protect the interests of the Class and has retained Plaintiff's claims are typical of those of the Class as all members of the Class are Because of the relatively small size of the individual Class members' claims, no Class Given the similar nature of the Class members' claims and the absence of material The injuries sustained by members of the Class flow, in each instance, from a Facebook engaged in a common course of conduct giving rise to the legal rights

-7CLASS ACTION COMPLAINT

1 2 32. 3 herein. 4 33. 5 6

COUNT I (Breach of Contract) Plaintiff repeats and realleges each of the preceding paragraphs, as if set forth fully

Plaintiff and members of the Class signed up to be members of Facebook, pursuant to

which each entered into an agreement with Facebook (e.g., Facebook's Statement of Rights and Responsibilities). Pursuant to the terms and conditions of that agreement, Plaintiff and the Class 7 provided Facebook with valuable personally identifiable information and Facebook promised not to 8 transmit such information to advertisers absent member consent. Facebook's terms and conditions 9 were non-negotiable and offered by Facebook on a take-it-or-leave-it basis. 10 34. 11 advertisers. 12 35. 13 names and user IDs, to advertisers without consent. 14 36. 15 37. 16 Plaintiff and members of the Class, Plaintiff and the Class have been damaged in an amount to be 17 proven at trial. 18 19 20 21 22 23 24 25 26 27 28 herein. 39. Facebook expressly and/or impliedly agreed to carry out its contractual obligations in 38. COUNT II (Breach of Implied Covenant of Good Faith and Fair Dealing) Plaintiff repeats and realleges each of the preceding paragraphs, as if set forth fully As a direct and proximate result of Facebook's breach of their agreement with Plaintiff and the Class have performed their obligations under the contracts. Facebook breached its contractual obligations by transmitting PII, including user Plaintiff and members of the Class never authorized Facebook to transmit PII to any

good faith and fair dealing and not to do anything that would have the effect of injuring the right of Plaintiff and the Class to receive the benefits of the agreement. 40. Plaintiff and members of the Class reasonably rely upon Facebook to act in good faith

both with regard to Facebook's terms and conditions and in the methods and manner in which Facebook carries out those terms and conditions. Facebook's transmission of PII evidences bad faith and ill motive.

-8CLASS ACTION COMPLAINT

1 41. 2 in deliberately, routinely and systematically transmitting Plaintiff's and Class member's PII to 3 advertisers without consent. 4 42. 5 and fair dealing, Plaintiff and the Class have been damaged in an amount to be proven at trial. 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 herein. 44. Facebook operates an "electronic communications service" as defined in 18 U.S.C. § 43. COUNT III (Violation of Electronic Communications Privacy Act) Plaintiff repeats and realleges each of the preceding paragraphs, as if set forth fully As a direct and proximate result of Facebook's breach of the covenant of good faith Facebook breached the covenant of good faith and fair dealing by exercising bad faith

2510(15). Facebook provides its members with the ability to send or receive electronic communications to or from any of Facebook's millions of members. 45. Pursuant to the Electronic Communications Privacy Act of 1986 ("ECPA"),

"electronic storage" includes any "storage of [a wire or electronic] communication by an electronic communication service for purposes of backup protection of such communication." 18 U.S.C. § 2510(17). The Facebook website serves as a backup for Facebook members of all communications between Facebook members and PII posted to member profiles. 46. Pursuant to 18 U.S.C. § 2701(a), absent exceptions inapplicable here,

"whoever...intentionally exceeds an authorization to access that facility; and thereby obtains...[an] electronic communication while it is in electronic storage in such system" has violated the ECPA. 47. The ECPA, at 18 U.S.C. § 2702(a), provides that "a person or entity providing an

electronic communication service to the public shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service." 48. Facebook intentionally and knowingly exceeded its authorization to access and

control confidential and private information relating to Plaintiff and Class members' electronic communications without the consent, knowledge or authorization of Plaintiff and members of the Class in violation of the ECPA. 49. Facebook intentionally and knowingly disclosed to Plaintiff's and the Class members'

electronic communication contents and user information, in violation of the ECPA.
-9CLASS ACTION COMPLAINT

1 50. 2 intercepted communications to enhance its profitability and revenue through advertising. This 3 disclosure was not necessary for the operation of Facebook's system or to protect Facebook's rights 4 or property. 5 51. 6 intercepted ... or intentionally used in violation of this chapter" within the meaning of 18 U.S.C. § 7 2520. 8 52. 9 Facebook member is a separate and distinct violation of the ECPA. Plaintiff and members of the 10 Class therefore seek remedy as provided for by 18 U.S.C. § 2520, including such preliminary and 11 other equitable or declaratory relief as may be appropriate, damages consistent with subsection (c) of 12 that section to be proven at trial, punitive damages to be proven at trial, and a reasonable attorney's 13 fee and other litigation costs reasonably incurred. 14 53. 15 equitable, and declaratory relief, in addition to statutory damages of the greater of $10,000 or $100 a 16 day for each day of violation, actual and punitive damages, reasonable attorneys' fees, and 17 Facebook's profits obtained from the above-described violations. 18 19 20 21 22 23 24 25 26 27 28 herein. 55. Pursuant to 18 U.S.C. § 2701(a), absent exceptions inapplicable here, 54. COUNT IV (Violation of the Stored Communications Act) Plaintiff repeats and realleges each of the preceding paragraphs, as if set forth fully Plaintiff and the Class, pursuant to 18 U.S.C. §2520, are entitled to preliminary, Each incident in which Facebook provided personally identifiable information of a Plaintiff and Class members are "person[s] whose ... electronic communication is Facebook unlawfully accessed and used, and voluntarily disclosed, the contents of the

"whoever...intentionally exceeds an authorization to access that facility; and thereby obtains...[an] electronic communication while it is in electronic storage in such system" has violated the ECPA. 56. The ECPA, at 18 U.S.C. § 2702(a), provides that "a person or entity providing an

electronic communication service to the public shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service." 57. Facebook intentionally and knowingly exceeded its authorization to access and

control confidential and private information relating to Plaintiff and Class members' electronic
-10CLASS ACTION COMPLAINT

1 communications without the consent, knowledge or authorization of Plaintiff and members of the 2 Class in violation of the SCA. 3 58. 4 electronic communication contents and user information, in violation of the SCA. 5 59. 6 Facebook member is a separate and distinct violation of the SCA, subject to the remedies provided 7 under the SCA, and specifically pursuant to 18 U .S.C. § 2707(a). 8 60. 9 U.S.C. § 2707(b) and (c), including such preliminary and other equitable or declaratory relief as may 10 be appropriate, damages consistent with subsection (c) of that section to be proven at trial, punitive 11 damages to be proven at trial, and a reasonable attorney's fee and other litigation costs reasonably 12 incurred. 13 61. 14 equitable, and declaratory relief, in addition to statutory damages of no less than $1,000 per 15 violation, , actual and punitive damages, reasonable attorneys' fees, and Facebook's profits obtained 16 from the above-described violations. 17 18 19 20 21 22 23 24 25 26 27 28 herein. 63. A benefit has been conferred upon Facebook by Plaintiffs and the Class. On 62. COUNT V (Unjust Enrichment) Plaintiff repeats and realleges each of the preceding paragraphs, as if set forth fully Plaintiff and the Class, pursuant to 18 U.S.C. §2707(c), are entitled to preliminary, Plaintiff and members of the Class therefore seek remedy as provided for by 18 Each incident in which Facebook provided personally identifiable information of a Facebook intentionally and knowingly disclosed to Plaintiff's and the Class members'

information and belief, Facebook, directly or indirectly, has received and retains information regarding the affiliation and business relationships between Plaintiffs and internet product and service providers, and has received and retains information regarding specific purchase and transactional information that is otherwise private, confidential, and not of public record 64. 65. Facebook appreciates or has knowledge of said benefit. Under principles of equity and good conscience, Facebook should not be permitted to

retain the information which it has acquired by virtue of its unlawful conduct. All funds, revenues,

-11CLASS ACTION COMPLAINT

1 and benefits received by Facebook through its advertiser programs rightfully belong to Plaintiff and 2 the Class, which Facebook has unjustly received as a result of its actions. 3 66. 4 collected pursuant to this unlawful business practice. 5 6 7 judgment against Facebook as follows: 8 1. 9 Class, and appointing the law firm representing Plaintiff as counsel for the Class; 10 2. 11 Class resulting from Facebook's unlawful practices as described above, in an amount to be proven at 12 trial; 13 3. 14 4. 15 described above; 16 5. 17 has acquired from Plaintiff and the Class as a result of unlawful practices described above, to avoid 18 dissipation, fraudulent transfers, and/or concealment of such assets by Facebook; 19 6. 20 information to advertisers without consent; 21 7. 22 8. 23 9. 24 10. 25 26 27 28 For such other and further relief that this Court may deem just and proper. Attorney's fees, costs and expenses; Pre-judgment and post-judgment interest on amounts awarded; Payment of costs of suit herein incurred; The issuance of injunctive orders enjoining Facebook from transmitting PII Ordering an accounting and imposing a constructive trust upon all assets Facebook Restitution of all monies acquired by Facebook as a result of its unlawful practices Exemplary and punitive damages; Damages, including statutory damages where applicable, suffered by Plaintiff and the An order certifying the Class, appointing the named Plaintiff as representative of the VIII. PRAYER FOR RELIEF WHEREFORE, Plaintiff, individually and on behalf of all others similarly situated, prays for Plaintiff and the Class are entitled to and hereby request restitution of the fees

-12CLASS ACTION COMPLAINT