Low v. Linkedin Corporation

Filing 31

AMENDED COMPLAINT against Linkedin Corporation. Filed byKevin Low, Alan Masand. (Attachments: # 1 Exhibit A)(Seidman, Peter) (Filed on 12/2/2011)

1 REESE RICHMAN LLP
Michael R. Reese (Cal. Bar No. 206773)
2 Kim E. Richman
Belinda L. Williams
3 875 Avenue of the Americas, 18th Floor
New York, NY 10001
4 Telephone: [phone]
Facsimile: [phone]
5 Email: [e-mail]
[e-mail]
6
[e-mail]
7 - and 8 MILBERG LLP
Sanford P. Dumain
9 Peter E. Seidman (pro hac vice)
Melissa Ryan Clark (pro hac vice)
10 Charles Slidders
One Pennsylvania Plaza, 49th Floor
11 New York, NY 10119
Telephone: [phone]
12 Facsimile: [phone]
Email: [e-mail]
13
[e-mail]
[e-mail]
14
[e-mail]
15 Attorneys for Plaintiffs
16

UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
(SAN JOSE DIVISION)

17
18

KEVIN LOW, individually and on behalf of
19 all others similarly situated,
Plaintiff,

20
21

v.

22 LINKEDIN CORPORATION, a California
Corporation,
23
Defendant.
24

)
)
)
)
)
)
)
)
)
)
)
)

CASE NO. CV 11-01468 (LHK)
AMENDED COMPLAINT
CLASS ACTION
JURY TRIAL DEMANDED

25
26
27
28
AMENDED CLASS ACTION COMPLAINT

-

1

Plaintiffs Kevin Low and Alan Masand bring this action individually and on behalf of all

2 others similarly situated (the “Class,” as defined below), by their undersigned counsel, against
3 defendant LinkedIn Corporation (“LinkedIn,” the “Company,” or “Defendant”).
4

This case arises from Defendant’s intentional and knowing transmission of Plaintiffs’ and

5 the other Class members’ personally identifiable information, browsing history among LinkedIn
6 profiles (“LinkedIn Browsing History”), and other personal information to advertisers, Internet
7 marketing companies, data brokers, web tracking companies, and other third parties
8 (collectively, “Third Parties”), without the consent or knowledge of LinkedIn users, in violation
9 of federal and state laws, and in violation of the Company’s published privacy policy. Plaintiffs
10 and the Class seek damages and equitable relief.
11

Plaintiffs allege the following upon personal knowledge as to their own acts and upon

12 information and belief based on the investigation conducted by Plaintiffs’ counsel, including
13 consultation with a technology expert, as to all other matters.
14
15
16

PARTIES
Plaintiffs
1.

Plaintiff Kevin Low resides in San Francisco, California. Mr. Low was a

17 registered user of LinkedIn during the time relevant to this action.
18

2.

Plaintiff Alan Masand resides in Astoria, New York. Mr. Masand was a

19 registered user of LinkedIn during the time relevant to this action. In November 2011, also
20 during the relevant time period, Mr. Masand became a paid user of LinkedIn when he purchased
21 a “Job Seeker Premium” subscription.
22

3.

Plaintiffs’ LinkedIn Browsing Histories and their LinkedIn user identification

23 numbers (“LinkedIn IDs”)—sent in connection with third party cookie identification numbers
24 (“cookie IDs”)—were transmitted to Third Parties by LinkedIn. For example:
25

•

On or about March 24, 2011, via Mr. Low’s computer, located at his home
in San Francisco, California, LinkedIn provided Mr. Low's personal
identity to Scorecard Research, linking it to Scorecard's secretly embedded
tracking device that surreptitiously recorded Mr. Low’s internet browsing
history.

•

On or about March 24, 2011, via Mr. Low’s computer located at his home

26
27
28

AMENDED CLASS ACTION COMPLAINT

-1

-

1

in San Francisco, California, LinkedIn provided Mr Low's personal
identity to Quantcast, linking to it to Quantcast's secretly embedded
tracking device that surreptitiously recorded Mr. Low’s internet browsing
history.

2
3

•

4
5
6
7

See Exhibit A for transmission detail; see ¶36 for a test transmission involving Mr. Masand’s
account.

8
9
10

4.

13
14
15
16
17
18
19
20
21
22
23

a LinkedIn profile page.
5.

LinkedIn disclosed Plaintiffs’ personally identifiable information without their

consent. In particular, LinkedIn provided Third Parties their LinkedIn IDs (which corresponds to
their profiles) and their LinkedIn Browsing History. This information gave the Third Parties the
ability to correlate Plaintiffs’ actual identities with their broader Internet browsing histories.
Plaintiffs’ browsing histories include visits to websites that they consider private, including
political, religious, and health-related websites. Had they known of these practices and been
given the choice, Plaintiffs would not have disclosed this information to the Third Parties.
Plaintiffs were embarrassed and humiliated by the disclosure of their personally identifiable
browsing history. Moreover, Plaintiffs’ browsing histories and personal identities are valuable
personal property with a market value. The market value of Plaintiffs’ browsing histories and
personally identifiable information increase when the two types of personal information are
correlated with one another. As a result of Defendant’s unlawful conduct, Plaintiffs relinquished
this valuable personal property without the compensation to which they were each due.

24
25

In addition to these examples, LinkedIn’s wrongful disclosure of information was

ongoing; on information and belief, this wrongful conduct occurred every time Plaintiffs visited

11
12

On or about March 24, 2011, via Mr. Low’s computer located at home in
San Francisco, California, LinkedIn provided Mr. Low's identity to
Nielsen Netratings (“imrworldwide”), linking it to Nielsen's secretly
embedded tracking device that surreptitiously recorded Mr. Low’s internet
browsing history.

6.

The Plaintiff Class consists of all persons who reside in the United States and who

signed up for and used LinkedIn’s services any time after March 25, 2007.1 The Class includes

26
1

Excluded from the Class are Defendant; any parent, subsidiary, or affiliate of Defendant; or
any employees, officers, or directors of Defendant; legal representatives, successors, or assigns
28 of Defendant; and any justice, judge or magistrate judge of the United States who may hear the
case, and all persons related to any such judicial officer, as defined in 28 U.S.C. § 455(b).
27

AMENDED CLASS ACTION COMPLAINT

-2

-

1 members who had a free subscription as well as members who paid a fee for LinkedIn’s
2 “premium” services.
3

7.

Plaintiffs and the Class were injured by Defendant’s unauthorized and public

4 disclosure of their personally identifiable information.
5 Defendant
6

8.

Defendant LinkedIn is a consumer-oriented web-based social networking site

7 that presents itself as an online community offering professionals ways to network via e-mail and
8 instant messaging. It was founded in 2002 and, in February 2008, announced “LinkedIn mobile”
9 for web-enabled wireless phones that use wireless application protocol. LinkedIn mobile allows
10 users to access LinkedIn from any mobile device. LinkedIn also provides services to advertisers
11 and marketers. It sells premium marketing services to individuals and organizations seeking to
12 utilize the vast database of LinkedIn user data, thereby monetizing its users’ personal
13 information.
14

9.

LinkedIn is a California corporation with its principal place of business in the San

15 Jose Division of the Northern District of California. Specifically, LinkedIn is located at 2029
16 Stierlin Court, Mountain View, California, which is located within Santa Clara County,
17 California. It conducts business throughout California and the United States. LinkedIn reported
18 more than 90 million registered users as of January 1, 2011, spanning more than 200 countries
19 and territories worldwide. The Company states that “on average, a new member joins every
20 second

of

every

day,

or

approximately

one

million

every

12

days.”

(See

21 http://press.linkedin.com/about/). In January 2011, LinkedIn filed for an initial public offering
22 and is reportedly valued at $2.51 billion.
23
24

JURISDICTION AND VENUE
10.

This Court has subject matter jurisdiction pursuant to the Class Action Fairness

25 Act of 2005, 28 U.S.C. § 1332 (a) and 1332 (d), because the amount in controversy exceeds
26 $5,000,000 exclusive of interests and costs and more than two-thirds of the members of the Class
27 are citizens of states different from that of Defendant. This Court also has federal question
28
AMENDED CLASS ACTION COMPLAINT

-3

-

1 jurisdiction as this Complaint alleges violations of the Stored Communications Act, 18 U.S.C.
2 § 2701 et seq.
3

11.

Venue for this action properly lies in this District pursuant to 28 U.S.C. § 1391 as

4 Defendant LinkedIn’s principal executive office and headquarters are located in California.
5
6

TECHNICAL BACKGROUND
12.

This case, in part, is about the linkage of personally identifiable information with

7 personal data obtained through cookies. Cookies are files of data and/or text sent by a website to
8 an Internet user’s computer (and stored on his or her hard drive) to track the user’s movements
9 on the Internet. Many websites place cookies that track an Internet user’s movement within their
10 own websites. Amazon.com, for example, might use a cookie to improve its users’ online
11 experience, e.g., to remember a user’s login and password, the user’s preferences for viewing the
12 website, the content of the user’s shopping cart, or recommend items related to the user’s
13 previous purchases or page views.
14

13.

A third-party cookie, also known as a tracking cookie, is a type of cookie placed

15 by a marketing company, advertising company, data aggregator, or the like (i.e., a “Third
16 Party”). These cookies track a broader type of behavior than just movement within a single
17 website. Third Party cookies collect personal data; they track Internet behavior and record
18 patterns, Internet surfing habits, and demographic information from data across thousands of
19 websites (the “Private Browsing History”), and then, inter alia, tailor and target advertisements
20 based on this data or use the data for other purposes the Internet user neither intended nor
21 consented to. For example, because of Third Party cookies, someone who browses various sports
22 websites and makes sports-related purchases might see an advertisement for ESPN on a
23 webpage, while someone who frequents furniture websites and decorating blogs might see an
24 advertisement for West Elm on the same webpage. Or, the data might be sold to a political
25 campaign organization or interest group.
26

14.

A cookie is placed on a user’s computer upon his or her first visit to a website,

27 or, in the case of a Third Party cookie, during the user’s first visit to a website within the Third
28 Party’s network. Once the cookie is placed, the user’s Internet browsing information is stored
AMENDED CLASS ACTION COMPLAINT

-4

-

1 on the cookie, and later transmitted to the cookie owner’s server to update the file associated
2 with its anonymous cookie ID. The transmission between the cookie and the server occurs
3 through invisible code embedded in various parts of a website. For example, a Third Party’s
4 advertisement may have code that calls information from a cookie to its server. A website
5 might also have small, 1 pixel x 1 pixel, transparent images—called a web beacons—that cause
6 a user’s computer to send cookie information to the website’s or Third Party’s server. The
7 tracking devices are invisible, and transmit information about an Internet user’s browsing
8 history and behavior without any prompting by the user.
9

15.

Before any cookie data can be transmitted to a Third Party, the website that the

10 user is visiting must initiate a command telling the Internet user’s computer to communicate with
11 that Third Party. The website uses the Internet user’s browser as a tool to cause this
12 communication, and dictates which servers the Internet user’s browsers should communicate
13 with, and what information it should send to those servers.
14

16.

15

For example, with regard to LinkedIn’s conduct:
1. An Internet user visits a LinkedIn profile page while logged in to
LinkedIn.

16

2. LinkedIn loads the LinkedIn-related content of that webpage;
Spaces are left open on the page for advertisements and other
content (such as beacons) to be provided by Third Parties.

17
18

3. LinkedIn invisibly sends a command to the Internet user’s browser
to initiate the loading of advertisements and other content on the
webpage. The LinkedIn command:

19
20

•

Designates the Third Party with which the browser should
communicate and from which the browser should obtain
the advertisements and other content.

•

21

Requires that the communication include:

22
23

o From the Internet user’s hard drive, the cookie
identification number of any cookie that is
associated with the designated Third Party; with

24
25

o The URL2 of the LinkedIn profile the user is
viewing, which includes a LinkedIn ID.

26
27

2

A URL (Uniform Resource Locator), more commonly known as a web address, is the
unique, global address of each resource and file on the Web. A URL combines the domain name
28
(e.g., google.com) with additional information like the protocol (e.g., http) and/or the path
AMENDED CLASS ACTION COMPLAINT

-5

-

1

4. The Third Party receives, bundled together in a single
communication prompted by LinkedIn, the Third Party’s cookie
identification number and the LinkedIn ID of the page being
viewed.

2
3

5. The Third Party sends information back to the browser to load
advertising and other content in the designated areas of the
LinkedIn webpage, and continues to track the user and
communicate with the cookie through that content.

4
5
6

17.

Below is an excerpt from a relevant test transmission associated with a test

7 profile, that demonstrates the type of information sent to the Third Party:
8

GET /cgi-bin/m1?ci=us603751h&cg=0&cc=1&si=http%3A//www.linkedin.com/profile/view%3Fid%3D110
198243%26authType%3Dname%26authToken%3D2uu_%26goback%3D%252Enmp
_*1_*1_*1_*1_*1%26trk%3Dnus_variable_vname&rp=http%3A//www.linkedin.co
m/home%3Ftrk%3Dhb_tab_home_top&ts=compact&rnd=1300470040318&ja=1
HTTP/1.1
Host: secure-us.imrworldwide.com
Referer:
http://www.linkedin.com/profile/view?id=110198243&authType=name&authToken=
2uu_&goback=%2Enmp_*1_*1_*1_*1_*1&trk=nus_variable_vname

9
10
11
12
13

HTTP/1.1 200 OK
Set-Cookie: V5=AStfNjA7EigrEhowDBgjIy06GyAHO1InHlL9uQ; expires=Mon,
15-Mar-2021 17:40:40 GMT; domain=.imrworldwide.com; path=/cgi-bin
Set-Cookie: IMRID=TYOZGIpsDDwAADNSOeY; expires=Mon, 15-Mar-2021
17:40:40 GMT; path=/cgi-bin; domain=.imrworldwide.com3

14
15
16
17
18
19
20
21
22

(Emphasis added.) In the example above, the LinkedIn ID and the corresponding cookie
identifier are indicated in bold. Thus, merely logging in and looking at a profile page caused
LinkedIn to transmit the ID bundled with the viewer’s tracking cookie ID to
IMRWorldwide/Nielsen Netratings. During testing, LinkedIn also sent the test profile’s LinkedIn
ID to Quantcast, Scorecard Research, and Doubleclick.
18.

LinkedIn could have designed its URL structures so that they did not contain the

LinkedIn ID, or could use embedding techniques, such as “iframes,” that would deliberately

23
24 (information regarding the particular sub-part of the website). For example, the URL to reach
Google’s main search page is http://www.google.com. One of the URLs to reach Google’s email
25 service is http://www.google.com/mail (and “mail” is the “path” of the URL). Both of these
URLs are at the same “domain name.”
3
This shows that LinkedIn is communicating with IMR Worldwide/Nielsen Ratings. The
26
bolded lettering is the cookie ID number of the cookie on the user’s computer. Notably, the
27 cookie is not set to expire, and will continue tracking the user’s Private Browsing History (unless
deleted), for another decade. The cookie is used to collect the user’s browsing habits on other,
28 non-LinkedIn sites, but it is the LinkedIn transmission that allows the browsing history to
become linked with the ID.
AMENDED CLASS ACTION COMPLAINT

-6

-

1 remove the user ID when it is being transferred to a Third Party. LinkedIn failed to use these
2 security measures to protect its users’ information.
3

FACTUAL ALLEGATIONS

4 LinkedIn Allows Third Party Data Aggregators to Match Plaintiffs’ and Class members’
Actual Identities with Their Previously-Anonymous Private Browsing History
5
19.
LinkedIn’s privacy policy states that the Company uses cookies “[i]n the course
6
of serving advertisements,” but assured Plaintiffs and Class members that “[a]ny information
7
provided to third parties through cookies will not be personally identifiable” and “LinkedIn
8
does not store unencrypted personally identifiable information in the cookies.” (emphasis
9
added).
10
20.
Contrary to these representations, LinkedIn provides additional, detailed
11
information that gives these Third Parties the ability to 1) match Plaintiffs’ and Class members’
12
actual identities, by name and LinkedIn profile, with their previously-anonymous Private
13
Browsing History; 2) view Plaintiffs’ and Class members’ LinkedIn Browsing History, i.e.,
14
determine which particular profiles within LinkedIn each Plaintiff and class member viewed, and
15
3) identify the personal relationships maintained by Plaintiffs and Class members. In short,
16
because LinkedIn divulges information about its users and their LinkedIn Browsing Histories,
17
the Third Parties are able to place a LinkedIn user’s actual identity with his/her personal, Private
18
Browsing History.
19
21.
LinkedIn failed to take steps to encrypt its users’ LinkedIn IDs or eliminate them
20
from transmissions to Third Parties. The Company did not have proper security in place and
21
failed to use commercially reasonable methods to prevent its users’ LinkedIn IDs (and thus
22
identities) from being associated with their Private Browsing History. As a result of this failure,
23
LinkedIn provided personally identifiable information to Third Parties that possess extensive,
24
private information about users.
25
22.
By placing names with personal, private data, LinkedIn violated its promises in its
26
privacy policy that it would keep such information private. LinkedIn connected its users’
27
identities with cookie ID numbers without their informed consent, and in a manner that has
28
AMENDED CLASS ACTION COMPLAINT

-7

-

1 caused or is likely to cause substantial injury to subscribers, was not outweighed by
2 countervailing benefits to consumers or to competition, and was not reasonably avoidable by
3 subscribers. LinkedIn caused its subscribers’ personal browsing history to be associated with
4 them by name, thereby exposing potentially controversial political views or other sensitive
5 information.
6

23.

LinkedIn also exposed its subscribers’ interactions and connections with other

7 profiles, thereby exposing potentially sensitive affiliations, that could, in turn, reveal a user’s
8 political views, sexual orientation, or business relationships.
9 The Sign-Up Process and LinkedIn ID
10

24.

When Plaintiffs first signed up for LinkedIn, they were required to provide their

11 first name, last name, and email address; create a password; provide their country and zip code;
12 indicate whether they are currently employed, looking for a job, or a student; and provide details
13 about their employment or school (e.g., job title and company; general industry (if unemployed);
14 or their education and field of interest). Then, also during the set-up process, LinkedIn offered to
15 search Plaintiffs’ email contacts to locate people the Plaintiffs already knew on LinkedIn. Even if
16 they or anyone else had chosen to “skip this step,” they would have been asked on the next page
17 to confirm their email account, and told that “we’ll also check your [email] contacts to see who
18 you already known [sic] on LinkedIn.” After confirming his/her email address, LinkedIn will
19 prompt the user to identify people with whom s/he wishes to connect and offer a “premium
20 account with plans starting from $24.99.”
21

25.

After Plaintiffs provided this detailed, private information, LinkedIn processed

22 that information and stored it as a user profile for each Plaintiff. It also stored records of any
23 LinkedIn connections Plaintiffs identified during the set-up process. And LinkedIn assigned each
24 Plaintiff a unique user identification number that is associated with their names and LinkedIn
25 profiles (the “LinkedIn ID”).
26

26.

The LinkedIn ID was then correlated with the profile and made visible to those

27 who viewed Plaintiffs’ profiles. For example, when viewing a LinkedIn profile, the URL will
28 read, in part, as follows:
AMENDED CLASS ACTION COMPLAINT

-8

-

1

http://www.linkedin.com/profile/view?id=12345678....

2 In the URL, “12345678” would be the LinkedIn ID of the user’s page that is being viewed.
3

27.

LinkedIn has apparently acknowledged the significance of the LinkedIn ID, and

4 recently changed the way the ID can be used to locate a profile page. Prior to the filing of the
5 initial complaint, anyone could insert a LinkedIn ID into a URL and visit the corresponding
6 LinkedIn member’s public profile. Now, since the filing of the initial complaint, the LinkedIn ID
7 can only be used in a URL to access the profile of someone with whom a member already has a
8 LinkedIn connection.
9 The Process that Divulged Plaintiffs’ and Class members’ Personal, Private Information
10

28.

Every time Plaintiffs visited a LinkedIn profile page when logged in, LinkedIn

11 caused the Internet user’s browser to transmit information to a third party. Part of that
12 transmission included the URL of the profile page the user was viewing (the “Viewed Page”). By
13 including the profile’s LinkedIn ID in the transmission, LinkedIn enabled Third Parties to
14 identify Plaintiff by name and determine which LinkedIn profiles Plaintiffs had viewed (the
15 “LinkedIn Browsing History”).
16

29.

Moreover, LinkedIn divulged this personal, private information together with a

17 Third Party cookie identification number, which corresponds to the Third Party’s (otherwise18 anonymous) record of webpages that the user has visited in the previous minutes, months, or
19 years—no matter how personal or private.
20

30.

LinkedIn provides detail that goes far beyond what a Third Party would normally

21 obtain through a cookie, providing “social information”—such as the name of the user and the
22 other LinkedIn profiles they view and interact with—to the otherwise anonymous tracking
23 process.
24 LinkedIn Allows Third Parties to De-Anonymize its User IDs
25

31.

In addition to receiving information about what pages a LinkedIn user viewed,

26 LinkedIn’s misconduct provided the Third Parties with means to determine which LinkedIn IDs
27 correspond to which profiles, and in particular, which LinkedIn ID corresponds to the Plaintiffs
28 (and thus, their cookie IDs).
AMENDED CLASS ACTION COMPLAINT

-9

-

1

32.

Before the complaint was filed, Third Parties could determine which LinkedIn ID

2 corresponded to which user simply by inserting an ID in the appropriate place within the
3 LinkedIn

profile

URL.

The

essential

form

of

the

LinkedIn

profile

URL

is:

4 http://www.linkedin/com/profile/view?id=[insert ID number here]. LinkedIn thus provided an
5 extremely simple avenue by which the Third Parties could translate the LinkedIn ID into to
6 names and other personal information.
7

33.

Even now, it is a simple matter for a Third Party to associate a LinkedIn ID with

8 the user. The Third Party need only wait until any one person, who is not connected to the user
9 on LinkedIn (a “stranger”), visits the user’s public profile. Although one cannot input a
10 stranger’s LinkedIn ID directly into a URL to visit his/her profile page, one can view a stranger’s
11 profile in various circumstances, e.g., by searching for that stranger’s name or clicking a link to
12 the stranger’s profile. When visiting a stranger’s profile, the URL created by LinkedIn includes
13 parameters, used to control access to strangers’ profiles, that act like passwords. Because
14 LinkedIn transmits profile URLs to Third Parties, a URL containing the user’s LinkedIn ID, and
15 the password-like parameters, will be transmitted to the Third Party after any one visit to the
16 user’s profile by a stranger. In other words, if the Third Party received a LinkedIn ID, but was
17 unable to de-anonymize it, as soon as a stranger visited the profile page associated with that ID,
18 the Third Party would receive a working link to the ID’s corresponding profile.
19

34.

The Third Parties can also determine which profile among the Viewed Pages

20 belongs to the user (cookie ID holder). For example, because LinkedIn users generally view their
21 own page more than any other, Third Parties can determine which LinkedIn ID corresponds with
22 each Plaintiff or Class member based simply on the frequency that the LinkedIn ID is transmitted
23 with their cookie IDs.
24

35.

In addition, certain of LinkedIn’s URL structures correspond only to the Internet

25 user’s own profile. For example, when a user is signed in to his/her own LinkedIn account and
26 clicks “View Profile,” LinkedIn will generate a URL that appears as follows:
27 “http://www.linkedin.com/profile/view?id=[LinkedIn ID number]&trk=tab_pro.” This URL
28 structure is only generated when one clicks the “View Profile” link. Accordingly, a Third Party
AMENDED CLASS ACTION COMPLAINT

- 10

-

1 receiving a URL in this form would know that the LinkedIn ID it includes corresponds to the
2 user’s own profile. The “View Profile” URL thus definitively and easily correlates a LinkedIn
3 user with its own LinkedIn ID number.
4

36.

In a test run with Mr. Masand’s account, the following transmission was

5 prompted by LinkedIn:
6

GET /adi/linkedin.dart/nprofile-viewsuccess;optout=false;lang=en;tile=1;sz=300x250;v=4;u=16iB1Kt5t5lAVnhQJhp7ES;mo
d=400;title=ic;func=finc;coid=10602;ind=80;csize=e;zip=11732;cntry=us;reg=70;sub=1;
jpos=0;con=i;edu=18946;gy=2009;gdr=m;age=23;seg=278;seg=454;seg=230;grp=1153;
grp=126907;grp=43643;grp=958;grp=1227037;grp=1852200;grp=86621;grp=1889180;g
rp=874127;grp=678237;sjt=2019;dcopt=ist;uprofile%3D36277434%3Bcompany%3D10
602%3Bpcntry%3Dus;s=0;ord=526988775? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Connection: keep-alive
Referer: http://www.linkedin.com/profile/view?id=XXXXXXXX4&trk=tab_pro
Cookie:
id=2235194150010079|3385069/1043781/15296|t=1315849600|et=730|cs=002213fd480
5441dcdaad43eed

7
8
9
10
11
12
13
14
15

(Emphasis added.) In this test transmission, LinkedIn caused the browser to send a transmission
16
to Doubleclick. The transmission included a URL that had a unique structure signifying that it
17
corresponded to Mr. Masand’s own profile and which contained Mr. Masand’s LinkedIn ID; and
18
the cookie ID number of the cookie that corresponded to Mr. Masand’s browsing history.
19
LinkedIn’s Conduct is a Meaningful Invasion of Plaintiffs’ and Class members’ Privacy
20
37.

In a year-long investigation into online tracking, the Wall Street Journal recently

21
“exposed a fast-growing network of hundreds of companies that collect highly personal details
22
about Internet users—their online activities, political views, health worries, shopping habits,
23
financial situations and even, in some cases, their real names—to feed the $26 billion U.S.
24
online-advertising industry,” thereby demonstrating how lucrative this industry has become.
25
Available at http://online.wsj.com/article_email/SB10001424052748703529004576
26
160764037920274 -lMyQjAxMTAxMDIwODEyNDgyWj.html (last visited March 25, 2011).
27
28

4

“XXXXXXXX” is the redacted LinkedIn ID.

AMENDED CLASS ACTION COMPLAINT

- 11

-

1

38.

Third Parties, like Scorecard Research, Quantcast, and Nielsen Netratings

2 (“imrworldwide”), track consumer and Internet behavior to compile marketable, demographic
3 profiles and statistics. The Third Parties market themselves based on the level of detail about a
4 consumer that they are able to ascertain, analyze, and compile. These companies are
5 technologically sophisticated and are able to analyze and cross-reference data from various
6 sources, distinguish between multiple users of the same computer, and even identify when a
7 single user utilizes various computers.
8

39.

9

People Versus Cookies

10
11

For example, Quantcast’s website states, in part:

Quantcast provides audience data for both unique cookies counts and people. The
Quantcast statistical direct measurement model takes into account numerous factors to
build a translation of cookies to people that is unique to each digital media property.

12 (Emphasis added.).
13

40.

The Quantcast website also includes a white paper entitled “Cookie Corrected

14 Audience Data,” which states, in part:
15
16
17
18
19

Addressing this challenge requires innovation in bridging the inherent differences
between the directly measureable cookies and estimates of people. This is not unlike
challenges that the media industry has previously faced in bridging the “what” (raw
traffic) and the “who” (actual people) in Print. The magazine industry provides an
analogy to the challenges in the digital space in that circulation is a “census” level data
point (it represents the reported number of magazines printed and distributed) which is
coupled with panel data for people-based adjustments (readers per copy, demographics,
etc). . . .

21

The Quantcast model leverages census level data, directly measured in cooperation
with online media publishers, integrated with panel sources in a hybrid statistical
model that accounts for the complicating factors of online media measurement,
namely cookie deletion and multiple machine usage.

22

*

23

25

This whitepaper provides an overview of Quantcast’s approach to translating raw cookie
data into actionable, people-based audience intelligence as part of our broader pixel
and panel methodology. It explains of how we model cookies, account for deletion and
non-acceptance, and incorporate this data within the broader set of audience measurement
challenges.

26

*

27

The Quantcast Approach

20

24

*

*

*

*

28
AMENDED CLASS ACTION COMPLAINT

- 12

-

1

6

Quantcast has a hybrid approach to web site audience measurement that leverages access
to multiple complementary data sources. The Quantcast Quantified Publisher program
captures over 75 billion media consumption events every month, generated by more than
1.4 billion cookies (data as of June, 2008). What’s more, many of our Quantified
Publisher partners share anonymous identifiers with us that are independent of
cookies. Our model also includes several panels which provide for people-based
reference points and calibration which are free of cookie deletion. We triangulate
across this mass of data with different collection processes, biases and issues. Our
models take into account visit frequency, time periods, the likelihood of multiple
computer usage and even the impact of multiple people using the same computer to
deliver people based estimates. . . .

7

Translating Unique Cookie Counts to People

8

. . . Quantcast statisticians are dedicated to understanding the dynamic, property-driven
factors that impact cookie per machine, number of unique users per machine, as well as
the number of machines that are used by people. The primary factors impacting
translation from cookies to people are: • Time period under analysis – . . . • Typical visit
frequency –. . . • Percentage of usage from work or public machines – . . . • Type of site –
....

2
3
4
5

9
10
11

(Emphasis added).
12

41.

Similarly, Nielsen Netratings’ website states, in part:

13
14
15
16

Nielsen’s comprehensive and innovative online measurement methodologies analyze
consumer behavior and trends, advertising effectiveness, brand advocacy, social media
buzz and more to provide a 360 degree view of how consumers engage with online
media. Our approach doesn’t stop at the computer screen because we understand that
online audiences don’t just consume digital “cookies” -- they’re a shopper, a carpooling power mom, a TV watcher, a tweeter and a texter.

17 (Emphasis added.)
18

42.

Many if not all of the Third Parties compensate LinkedIn to place advertisements

19 on or collect data from the Company’s website. In turn, LinkedIn commands Plaintiffs’ and
20 Class members’ computers to reach out to these Third Parties to pull advertisements and beacons
21 to display on LinkedIn webpages, and causes Plaintiffs’ and Class members’ computers to
22 transmit the LinkedIn ID of the Viewed Page contemporaneously with the cookie ID of the
23 cookie placed by the Third Party. Through this invisible action, which occurs without the
24 knowledge or consent of Plaintiffs or Class members, and which does not require Plaintiffs or
25 Class members to click on or interact with any advertisement or Third Party, LinkedIn allows the
26 Third Parties to ascertain marketable, private information about LinkedIn’s members.
27

43.

Consequently, Plaintiffs, who have used the Internet to search and view webpages

28 regarding any number of personal, sensitive topics, have profiles of their browsing history
AMENDED CLASS ACTION COMPLAINT

- 13

-

1 maintained by Third Parties, together with the demographics inferable by his or her search
2 history, that can be marketed and sold in order to provide targeted advertising among a variety of
3 mediums. That information is typically anonymous, correlated only with a cookie ID or IP
4 address, but if the user is on LinkedIn, that profile and Private Browsing History can be
5 identified by name; the users’ work, educational, and other LinkedIn profile information can be
6 added; and it can also include the users’ friends, family, real-life connections, and information
7 about who that person is interested in observing on LinkedIn.
8 Personally Identifiable Information and Internet Browsing Behaviors Are Valuable,
9 Marketable Commodities
44.

10
11
12
13
14
15
16
17
18
19
20
21

“[w]ebsites and stores can . . . easily buy and sell information on visitors with the intention of
merging behavioral with demographic and geographic data in ways that will create social
categories that advertisers covet and target with ads tailored to them or people like them.” Joseph
Turow, Jennifer King, Chris Jay Hoofnagle, Amy Bleakley, and Michael Hennessy, Americans
Reject Tailored Advertising and Three Activities that Enable It (Sept. 29, 2009), available at
http://ssrn.com/abstract=1478214. Multiple marketers have touted the high market value of this
information in targeting consumers based on the data mined from their computers and mobile
devices giving credence to the statement, “the more information that is known about a consumer,
the more a company will pay to deliver a precisely-targeted advertisement to him.” Federal
Trade Commission Preliminary Staff Report, Protecting Consumer Privacy in an Era of Rapid
Change, (Dec. 2010) at 24 (“FTC Report”).
45.

22
23
24
25
26
27

By collecting personal information from the computers and mobile devices

One data aggregator, Audience Science, states that its work involves “recording

billions of behavioral events daily and reaching over 385 million unique Internet users” and then
making such data available to its clients: “web publishers, marketers, networks, exchanges, and
agencies[,] to create intelligent audience segments to connect people with relevant advertising
driving

the

transition

to

data-driven

audience

marketing

online.”

See

MediaPost, http://mediapost.com/events/?/showID/OMMAGlobalNewYork.09.NewYorkCity/

28
AMENDED CLASS ACTION COMPLAINT

- 14

-

1 type/Exhibitor/itemID/647/OMMAGlobalNewYork-Exhibitors%20and%20Sponsors.html

(last

2 visited Mar. 25, 2011).
3

46.

On March 7, 2011, the Wall Street Journal published an article under the

4 headline, “Web’s Hot New Commodity: Privacy” in which it highlighted a company called
5 “Allow Ltd.,” one of nearly a dozen companies that offer to sell people’s personal information
6 on their behalf, and given them 70% of the sale. One Allow Ltd. customer received payment of
7 $8.95 for letting Allow tell a credit-card company he is shopping for new plastic. Id. In January
8 2011, at the World Economic Forum in Davos, Switzerland, one discussion centered on turning
9 personal data into an “asset class.” During the course of the discussion, Michele Luzi, director at
10 consulting firm Bain & Co. stated, “We are trying to shift the focus from purely privacy to what
11 we call property rights.” Id.
12

47.

LinkedIn has profited handsomely from its customers and from the wrongful

13 distribution of their data. From January 2010 to September 2010 the Company earned $161.4
14 million in revenue from three products: marketing solutions (advertising), premium
15 subscriptions, and hiring solutions (job listings). Advertising accounted for 32% of the
16 Company’s revenue ($51.37 million) during that period, and 30% of revenue ($23.8 million) in
17 2009. Premium subscriptions accounted for 27% of revenue ($44.1 million) from January to
18 September

2010,

and

41%

of

revenue

($33.2

million)

in

2009.

(See

19 http://mashable.com/2011/01/28/linkedins-ipo-an-overview/).
20

48.

Personal information is property. There is a market for personal data and

21 data regarding individuals’ opinions and interests. Individuals can market their own personal
22 information for profit, through, for example, focus groups (which pay individuals to express their
23 interests and opinions), or companies like Allow Ltd., which allow users to sell information to
24 marketers regarding their name, address, employment, and shopping interests and intent (e.g.,
25 products the individual is interested in; whether the user is interested in applying for a credit
26 card). The value of such information is diminished, if not eliminated, if that information is
27 publicly distributed or leaked. In addition, personal information has value to companies, like
28 Defendant and the Third Parties, because it can be compiled and sold as demographic data and
AMENDED CLASS ACTION COMPLAINT

- 15

-

1 advertising analytics, or sold on a per-name basis (for example, companies like infoUSA compile
2 lists of consumer information, and sell name and contract information categorized by
3 demographic data, interests, or other behavioral information).
4 LinkedIn Violates Its Own Privacy Policy
5

49.

LinkedIn’s privacy policy fails to inform LinkedIn users that the Company

6 transmits its members’ LinkedIn-related browsing history or that it allows Third Parties to link
7 their personal identity or LinkedIn profile information with their Private Browsing History. On
8 the contrary, LinkedIn states unequivocally that: “We do not sell, rent, or otherwise provide
9 your personal identifiable information to any third parties for marketing purposes.”
10

50.

LinkedIn fails to disclose that it allows marketers to identify otherwise-

11 anonymous cookie information. Instead, it gives users comfort that LinkedIn will not provide
12 any personally identifiably information to third parties or store it with cookies:
13

F.

14

In the course of serving advertisements or optimizing the Services to our Users,
we may allow authorized third parties to place or recognize a unique cookie on
your browser. Any information provided to third parties through cookies will
not be personally identifiable but may provide general segment information
(e.g., your industry or geography, career field, or information about your
professional or educational background) for greater customization of your
user experience. Most browsers are initially set up to accept cookies, but you can
reset your browser to refuse all cookies or to indicate when a cookie is being sent.
LinkedIn does not store unencrypted personally identifiable information in
the cookies.

15
16
17
18
19
20
21
22
23
24
25
26
27
28

Cookies

See Exhibit B (emphasis added).
51.

Regarding “Advertising and Web Beacons,” LinkedIn states that advertisements

may be targeted to users “based on anonymized information,” and states that: “LinkedIn does
not provide personally identifiable information to any third party ad network.” See Exhibit
B (emphasis added).
52.

Regarding the use of “Log files, IP addresses and information about your

computer and mobile device,” LinkedIn represented to Plaintiffs and Class members that: “The
linkage between your IP address and your personally identifiable information is not shared
with third parties without your permission,” providing exceptions only for consent and

AMENDED CLASS ACTION COMPLAINT

- 16

-

1 compliance with subpoena or other legal process, investigation, or enforcement. See Ex. B
2 (emphasis added).
3

53.

With respect to “Sharing Information with Third Parties,” LinkedIn makes the

4 following representations:
5
6
7
8
9
10

LinkedIn takes the privacy of our Users very seriously, and we do not sell,
rent, or otherwise provide your personally identifiable information to third
parties for marketing purposes. Further, we will only share your personally
identifiable information with third parties to carry out your instructions or to
provide the Services or information unless compelled by law, or as necessary to
enforce our User Agreement or protect the rights, property, or personal safety of
LinkedIn, its Users, and the public. For example, we use a credit card processing
company to bill Users for subscription fees. These third parties do not retain,
share, or store any personally identifiable information except to provide these
services, and they are bound by confidentiality agreements limiting the use of
your information.

11 Ex. B (emphasis added).
12

54.

LinkedIn’s statements that: “maintaining your trust is our top concern” and

13 “LinkedIn takes the privacy of our Users very seriously, and we do not sell, rent, or otherwise
14 provide your personally identifiable information to third parties for marketing purposes”; and its
15 representations that it is a licensee of the “TRUSTe Privacy Program” and that it participates in
16 the EU Safe Harbor Privacy Framework as set forth by the U.S. Department of Commerce;
17 falsely indicated to Plaintiffs and Class members that LinkedIn was guarding their personal
18 information.
19

55.

Here, LinkedIn’s privacy policy explicitly assures that its members’ personally

20 identifiable information will not be provided to Third Parties (but it is). Even had the privacy
21 policy not made such plain assurances, or had it accurately described LinkedIn’s divulgement of
22 members’ personally identifiable information and LinkedIn-related browsing history, LinkedIn
23 could not be excused from its misconduct as a result of any part of its privacy policy.
24

56.

LinkedIn’s privacy policy, which has been described as a “6,250-word essay” (see

25 http://www.pcadvisor.co.uk/news/index.cfm?newsid=3223258&pn=2), is dense and confusing. It
26 is widely accepted that such privacy policies are ineffective when it comes to providing
27 consumers with useful and accurate information or disclosure. In a preliminary staff report
28 prepared by the Federal Trade Commission, entitled, Protecting Consumer Privacy in an Era of
AMENDED CLASS ACTION COMPLAINT

- 17

-

1 Rapid Change, the Federal Trade Commission stated that, “[T]he notice-and-choice model, as
2 implemented, has led to long, incomprehensible privacy policies that consumers typically do not
3 read, let alone understand” and that they are wholly inadequate in an age in which companies
4 “collect and use consumers’ information in ways that often are invisible to consumers.” FTC
5 Report at iii. The FTC also found that “privacy notices are often opaque, lack uniformity, and are
6 too long and difficult to navigate. Too frequently they bury disclosures of important information.
7 . . . A particularly strong illustration of where privacy policies have been ineffective is in the
8 mobile context where, because of the small size of the device, a privacy notice can be spread out
9 over 100 separate screens. Indeed, it is difficult to imagine consumers scrolling through each
10 screen or making informed choices based on the information contained in them.” Id. at 70. See
11 also, Aleecia M. McDonald & Lorrie Faith Cranor, The Cost of Reading Privacy Policies, 4 I/S
12 L.J. & Pol’y for Info. Soc’y 543, 565 (2008) (estimating that it would take consumers hundreds
13 of hours to read the privacy policies they might typically encounter in one year on the Internet).
14

57.

LinkedIn’s customers, including Plaintiffs and the Class, pay for LinkedIn’s

15 services either monetarily, or by providing their personally identifiable information. Personally
16 identifiable information constitutes valuable property that was exchanged not only for
17 Defendant’s services, but also in exchange for Defendant’s promises that it would not make
18 “[a]ny information provided to third parties through cookies. . . personally identifiable” and that
19 it “does not provide personally identifiable information to any third party ad network.” As a
20 result of LinkedIn’s misconduct, and its role in contributing to the breach of Plaintiffs’
21 personally identifiable information and association of that information with otherwise22 anonymous browsing history, LinkedIn caused Plaintiffs and the Class to lose the value of their
23 personally identifiable information.
24
25

CLASS ACTION ALLEGATIONS
58.

Plaintiffs bring this action pursuant to Fed. R. Civ. P. 23 on behalf of a Class

26 defined as follows: All persons who reside in the United States and who, any time after March
27 25, 2007, signed up for LinkedIn’s services.
28
AMENDED CLASS ACTION COMPLAINT

- 18

-

1

59.

Excluded from the Class are Defendant; any parent, subsidiary, or affiliate of

2 Defendant or any employees, officers, or directors of Defendant; legal representatives,
3 successors, or assigns of Defendant; and any justice, judge or magistrate judge of the United
4 States who may hear the case, and all persons related to any such judicial officer, as defined in
5 28 U.S.C. § 455(b).
6

60.

Numerosity. The Class members are so numerous and dispersed nationwide that

7 joinder of all members is impracticable. Upon information and belief, the Class members number
8 in the hundreds of thousands, if not millions. The exact number of Class members is unknown,
9 but can be determined from Defendant’s computerized and other records. Plaintiffs reasonably
10 estimate and believe that there are thousands of persons in the Class.
11

61.

Commonality. There are numerous and substantial questions of law and fact that

12 are common to all members of the Class, which predominate over any question affecting only
13 individual Class members. The members of the Class were and continue to be subjected to the
14 same practices of the Defendant. The common questions and issues raised by Plaintiffs’ claims
15 include:
16

•

whether Defendant shared Plaintiffs’ and the Class’s personal information with
third-party advertisers and online tracking companies;

•

whether LinkedIn violated its own Terms and Privacy Policies by sharing of
Plaintiffs’ personal information with third-party advertisers, and online tracking
companies;

•

whether LinkedIn breached its contract with consumers, and if so, the appropriate
measure of damages and remedies against Defendant for such breach;

•

whether LinkedIn breached the covenants of good faith and fair dealing, and if so,
the appropriate measure of damages and remedies against Defendant for such
breach;

•

whether Defendant violated the SCA; California Business and Professions Code §
17200 et seq.; California Business and Professions Code § 17500 et seq.;
Consumer Legal Remedies Act, California Civil Code § 1750; Article I, Section 1
of the California Constitution; and other violations of common law;

•

whether Plaintiffs and the Class have been damaged as a result of Defendant’
alleged violations as alleged herein; and, if so, the appropriate relief for
Defendant’ violations; and

•

whether Defendant have been unjustly enriched as a result of its unlawful
conduct, and, if so, whether Defendant should disgorge inequitably obtained

17
18
19
20
21
22
23
24
25
26
27
28

AMENDED CLASS ACTION COMPLAINT

- 19

-

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

money that they have been unjustly enriched by; and, the nature and extent of any
other remedies, and injunctive relief, to which Plaintiffs and the Class are entitled.
62.

Typicality. Plaintiffs’ claims are typical of the claims of all of the other members

of the Class, because their claims are based on the same legal and remedial theories as the claims
of the Class and arise from the same course of conduct by Defendant.
63.

Adequacy. Plaintiffs will fairly and adequately protect the interests of all

members of the class in the prosecution of this Action and in the administration of all matters
relating to the claims stated herein. Plaintiffs are each similarly situated with, and have suffered
similar injuries as, the members of the Class he seeks to represent. Plaintiffs have retained
counsel experienced in handling class action lawsuits. Neither Plaintiffs nor their counsel have
any interest that might cause them not to vigorously pursue this action.
64.

Superiority. A class action is superior to other available methods for the fair and

efficient adjudication of the controversy, since individual joinder of the Class members is
impracticable. Even if individual Class members were able to afford individual litigation, it
would be unduly burdensome to the Courts in which the individual litigation would proceed.
Defendant have subjected the Class to the same violations as referenced herein. Accordingly,
class certification is appropriate under Rule 23 because common issues of law and fact regarding
Defendant’ uniform violations predominate over individual issues, and class certification is a
superior method of resolving these claims. No unusual difficulties are likely to be encountered in
the management of this action as a class action. Defendant acted and continue to act in a manner
that is generally applicable to all members of the Class, making final injunctive relief
appropriate.

22
FIRST CAUSE OF ACTION
(Stored Communications Act, 18 U.S.C. § 2701 et seq.)

23
24
25

65.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

preceding paragraphs of this complaint.

26
27
28
AMENDED CLASS ACTION COMPLAINT

- 20

-

1

66.

Defendant violated the Stored Communications Act (SCA) by disclosing

2 Plaintiffs’ and Class members’ LinkedIn-related browsing history. Plaintiffs and Class members
3 suffered injury-in-fact, and the SCA provides for statutory damages.
4

67.

Defendant also violated the SCA by disclosing information regarding the Viewed

5 Page. Plaintiffs and Class members suffered injury-in-fact, and the SCA provides for statutory
6 damages.
7

68.

Defendant also violated the SCA by disclosing Plaintiffs’ and Class members’

8 LinkedIn IDs. Plaintiffs and Class members suffered injury-in-fact, and the SCA provides for
9 statutory damages.
10

69.

Defendant provides electronic communication service to the public via their

11 LinkedIn accounts. 18 U.S.C. § 2510(15).
12

70.

Defendant provides remote computing service to the public because they provide

13 computer storage and processing services by means of an electronic communications system. 18
14 U.S.C. § 2711(2).
15

71.

The LinkedIn users’ personal identification numbers and personal information

16 that are stored by Defendant are electronic communications within the meaning of 18 U.S.C.
17 § 2510 (12).
18

72.

Defendant holds their users’ personal identification number and personal

19 information in electronic storage within the meaning of 18 U.S.C. § 2510(17).
20

73.

Defendant knowingly divulged confidential and private information relating to

21 Plaintiffs’ electronic communications in violation of 18 U.S.C. § 2701 et seq. of the SCA.
22

74.

In part, 18 U.S.C. § 2702(a)(1)-(2) of the SCA provides that a person or entity

23 shall not: “(1) . . . knowingly divulge to any person or entity the contents of a communication . . .
24 ; and (2) . . . shall not knowingly divulge to any person or entity the contents of any
25 communication . . . .”
26

75.

Section 2707 of the SCA provides for a civil cause of action and allows for

27 damages, and declaratory and equitable relief.
28
AMENDED CLASS ACTION COMPLAINT

- 21

-

1

76.

By engaging in the foregoing acts, Defendant knowingly divulge the contents of

2 communication carried and maintained by Defendant on behalf of and received by transmissions
3 from their users in violation of 18 U.S.C. § 2702(a)(2).
4

77.

Defendant engaged in the foregoing acts without obtaining the lawful consent of

5 the user.
6

78.

Plaintiffs and the Class are entitled to statutory damages of no less than $1,000.00

7 (one thousand dollars) per violation. Because Defendant’ violations were willful and intentional,
8 Plaintiffs and the Class are entitled to recover punitive damages as provided by 18 U.S.C.
9 § 2702(c).
10

SECOND CAUSE OF ACTION
(Article I, Section 1 of the California Constitution)

11
12

79.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

13 preceding paragraphs of this complaint.
14

80.

Defendant disclosed Plaintiffs’ and Class members’ personal information,

15 including their LinkedIn-related browsing history. Accordingly, Plaintiffs’ and Class members’
16 personal privacy rights were violated; they suffered injury-in-fact and are entitled to damages.
17

81.

Defendant disclosed Plaintiffs’ and Class members’ personal information by

18 causing the transmission of their LinkedIn IDs (which conveyed their actually identities) along
19 with a cookie identifier that correlated with their previously-anonymous, Private Browsing
20 History. Accordingly, Plaintiffs’ and Class members’ personal privacy rights were infringed
21 upon; they suffered injury-in-fact and/or were harmed and are entitled to damages.
22

82.

The California Constitution expressly grants an inalienable right to privacy.

23

83.

Plaintiffs had a legally protected informational privacy interest in the confidential

24 and sensitive information that Defendant obtained from them and unlawfully disseminated.
25

84.

Plaintiffs had a legally protected autonomy privacy interest in making intimate

26 personal decisions regarding their use of the Internet without observation, intrusion or
27 interference.
28
AMENDED CLASS ACTION COMPLAINT

- 22

-

1

85.

Plaintiffs reasonably expected that their confidential and sensitive information

2 and intimate personal decisions would be kept private.
3

86.

Defendant committed a “serious invasion of privacy” by revealing Plaintiffs’ PII

4 in conjunction with data tracking cookies, thereby enabling third parties to collect and stockpile
5 information—about individuals who can be identified by name—without the individuals’
6 consent or control.
7

THIRD CAUSE OF ACTION
(Violation of California Business and Professions Code § 17500, et seq.
Untrue and Misleading Statements)

8
9

87.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

10 preceding paragraphs of this Complaint.
11

88.

Plaintiffs assert this cause of action against Defendant for violations of California

12 Business and Professions Code § 17500 et seq. for untrue and misleading statements.
13

89.

At all relevant times, Defendant engaged in a scheme of offering its LinkedIn

14 services to Plaintiffs by way of, inter alia, commercial marketing and advertising, the World
15 Wide Web (Internet), product packaging and labeling, and other promotional materials. These
16 materials misrepresented and/or omitted the truth about the extent to which Defendant would
17 share valuable personal information with third parties. Defendant knew, or should have known,
18 that these statements were deceptive, misleading, or untrue.
19

90.

Said advertisements and inducements were made within the State of California

20 and come within the definition of advertising as contained in Business and Professions Code
21 § 17500 et seq. in that such promotional materials were intended as inducements to purchase and
22 use products and services offered by Defendant and are statements disseminated by Defendant to
23 Plaintiffs and were intended to reach Plaintiffs. Defendant knew, or should have known, that
24 these statements were misleading and deceptive.
25

91.

In furtherance of said plan and scheme, Defendant have prepared and distributed

26 within the State of California via commercial marketing and advertising, the World Wide Web
27 (Internet), product packaging and labeling, and other promotional materials, statements that
28
AMENDED CLASS ACTION COMPLAINT

- 23

-

1 misleadingly and deceptively represent the truth about personal information that LinkedIn users
2 entrust to Defendant.
3

92.

Consumers, including Plaintiff, were among the intended targets of such

4 representations.
5

93.

The above acts of Defendant, in disseminating said misleading and deceptive

6 statements throughout the State of California to consumers, including Plaintiff, were and are
7 likely to deceive reasonable consumers, including Plaintiff, by obfuscating the truth about
8 Defendant’ use of their personal information.
9

As a result of the above violations, Plaintiffs have suffered injury in fact and lost money

10 or property. Plaintiffs and the Members of the Class, pursuant to Business and Professions Code
11 § 17535, are entitled to an order of this Court enjoining such future conduct on the part of
12 Defendant, and such other orders and judgments that may be necessary to return Defendant’ ill13 gotten gains and restore to any person in interest any money paid for Defendant’ services as a
14 result of the wrongful conduct of Defendant.
15

FOURTH CAUSE OF ACTION
(Breach of Contract)

16
94.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

17
preceding paragraphs of this complaint.
18
95.

Plaintiffs submit personal information to LinkedIn and LinkedIn promises that it

19
will not share this information with third-party advertisers without Plaintiffs’ consent, and the
20
consent of each Class member, respectively.
21
96.

The LinkedIn Privacy Policy states that LinkedIn will not divulge personal

22
information to outside advertising companies without the user’s consent. Despite this promise,
23
LinkedIn did in fact knowingly share users’ personal information with third-party advertisers in
24
violation of its own Agreement with its users.
25
97.

Plaintiffs never consented to the sharing of their personal information to third-

26
party advertisers.
27
98.

Plaintiffs have performed their obligations under the contract.

28
AMENDED CLASS ACTION COMPLAINT

- 24

-

1

99.

LinkedIn materially breached its contractual obligations through its conduct as

2 alleged herein, including its transmission of Plaintiffs’ personal information to third-party
3 advertisers, as well as Plaintiffs’ personal identification numbers without consent.
4

100.

Plaintiffs and the Class have been damaged as a direct and proximate result of

5 LinkedIn’s breach of their agreements with Plaintiffs and the Members of the Class.
6

FIFTH CAUSE OF ACTION
(Common Law Invasion of Privacy)

7
8

101.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

9 preceding paragraphs of this complaint.
10

102.

Defendant disclosed Plaintiffs’ and Class members’ personal information,

11 including their LinkedIn-related browsing history. Accordingly, Plaintiffs’ and Class members’
12 personal privacy rights were infringed upon; they suffered injury-in-fact and/or were harmed and
13 are entitled to damages.
14

103.

Defendant disclosed Plaintiffs’ and Class members’ personal information by

15 causing the transmission of their LinkedIn IDs (which conveyed their actually identities) along
16 with a cookie identifier that correlated with their previously-anonymous, Private Browsing
17 History. Accordingly, Plaintiffs’ and Class members’ personal privacy rights were infringed
18 upon; they suffered injury-in-fact and/or were harmed and are entitled to damages.
19

104.

Plaintiffs each had a legally protected informational privacy interest in the

20 confidential and sensitive information that Defendant obtained and unlawfully disseminated.
21

105.

Plaintiffs and the Class members had a legally protected autonomy privacy

22 interest in making intimate personal decisions regarding their use of their computers and mobile
23 devices without observation, intrusion or interference.
24

106.

Plaintiffs and the Class members reasonably expected that their confidential and

25 sensitive information and intimate personal decisions would be kept private.
26

107.

Defendant intentionally committed a “serious invasion of privacy” that would be

27 highly offensive to a reasonable person by making public Plaintiffs’ personally identifying
28 information in conjunction with her personal identification number and data tracking cookies.
AMENDED CLASS ACTION COMPLAINT

- 25

-

1

108.

As a consequence, Plaintiffs were personally injured and suffered emotional

2 distress damages.
3

SIXTH CAUSE OF ACTION
(Conversion)

4
5

109.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

6 preceding paragraphs of this complaint.
7

110.

Plaintiffs’ personal browsing history and other personally identifiable information

8 – including full name, email address, mailing address, zip code, telephone number, and credit
9 card number – is valuable property owned by Plaintiffs.
10

111.

Defendant unlawfully exercised dominion over said property and thereby

11 converted Plaintiffs’ and the Class members’ respective personal information by providing it to
12 third parties in violation of the Stored Communications Act, 18 U.S.C. § 2701 et seq., and in
13 violation of its contracts with Plaintiffs and the respective Class members.
14

112.

Plaintiffs and the Class were damaged thereby.

15

SEVENTH CAUSE OF ACTION

16

(Unjust Enrichment)

17

113.

Plaintiffs hereby incorporate by reference the allegations contained in all of the

18 preceding paragraphs of this complaint.
19

114.

By engaging in the conduct described in this Complaint, Defendant have

20 knowingly obtained benefits from Plaintiffs under circumstances that make it inequitable and
21 unjust for Defendant to retain them.
22

115.

Defendant has received a benefit from Plaintiffs and Defendant have received and

23 retained money from advertisers and other third parties as a result of sharing the personal
24 information of Defendant’s users’ with those advertisers without Plaintiffs’ knowledge or
25 consent as alleged in this Complaint.
26

116.

Plaintiffs did not expect that Defendant would seek to gain commercial advantage

27 from third parties by using their personal information without their consent.
28
AMENDED CLASS ACTION COMPLAINT

- 26

-

1

117.

Defendant knowingly used Plaintiffs’ personal information without their

2 knowledge or consent to gain commercial advantage from third parties and had full knowledge
3 of the benefits they have received from Plaintiffs. If Plaintiffs had known Defendant was not
4 keeping their personal information from third parties, they would not have consented and
5 Defendant would not have gained commercial advantage from third parties.
6

118.

Defendant will be unjustly enriched if Defendant is permitted to retain the money

7 paid to them by third parties, or resulting from the commercial advantage they gained, in
8 exchange for Plaintiffs’ personal information.
9

119.

Defendant should be required to provide restitution of all money obtained from

10 their unlawful conduct.
11

120.

Plaintiffs and the members of the Class are entitled to an award of compensatory

12 and punitive damages in an amount to be determined at trial or to the imposition of a
13 constructive trust upon the wrongful revenues and/or profits obtained by and benefits conferred
14 upon Defendant as a result of the wrongful actions as alleged in this complaint.
15

121.

Plaintiffs and the Class have no remedy at law to prevent Defendant from

16 continuing the inequitable conduct alleged in this complaint and the continued unjust retention of
17 the money Defendant received from third-party advertisers.
18

EIGHTH CAUSE OF ACTION
(Negligence)

19
122.

Plaintiffs incorporate the above allegations by reference as if fully set forth

123.

LinkedIn owed a duty to Plaintiffs and Class members to comply with its stated

20
herein.
21
22
privacy policy and terms of service, and to protect its users’ information from disclosure to or
23
access by unauthorized third parties.
24
124.

LinkedIn breached its duty by allowing Referer Headers—send to Third Parties

25
that include data aggregators and marketers—to include unencrypted LinkedIn IDs. LinkedIn
26
also breached its duty by allowing unauthorized third parties to access users’ LinkedIn profiles
27
28
AMENDED CLASS ACTION COMPLAINT

- 27

-

1 by using their IDs. This exposure and transfer of Plaintiffs’ and class members’ information was
2 done without customers’ knowledge or permission.
3

125.

LinkedIn’s negligent actions directly and proximately caused Plaintiffs and Class

4 members harm.
5

REQUEST FOR RELIEF

6

WHEREFORE, Plaintiff Low, on behalf of himself and the Class, requests the following

7 relief:
8

A.

An order certifying that this action is properly brought and may be maintained as

9 a class action under Rule 23 of the Federal Rules of Civil Procedure, that Plaintiffs be appointed
10 as Class Representatives, and that Plaintiffs’ counsel be appointed Class Counsel;
11

B.

An award of damages as alleged above;

12

C.

Restitution of all monies unjustly obtained or to be obtained from Plaintiffs and

13 members of the Class;
14

D.

Declaratory and injunctive relief;

15

E.

An award of reasonable attorneys’ fees and costs; and

16

F.

Such other relief at law or equity as this court may deem just and proper.

17
18

DEMAND FOR JURY TRIAL
Plaintiffs hereby demand trial of their claims by jury to the extent authorized by law.

19
20

DATED: December 2, 2011

Respectfully submitted,
MILBERG LLP
/s/ Peter E. Seidman
Sanford P. Dumain
Peter E. Seidman (pro hac vice)
Melissa Ryan Clark (pro hac vice)
Charles Slidders
One Pennsylvania Plaza, 49th Floor
New York, New York 10119
Telephone:
[phone]
Facsimile:
[phone]
E-mail: [e-mail]
[e-mail]

21
22
23
24
25
26
27

- and REESE RICHMAN LLP

28
AMENDED CLASS ACTION COMPLAINT

- 28

-

1
Michael R. Reese (Cal. Bar No. 206773)
Kim E. Richman
Belinda L. Williams
875 Avenue of the Americas, 18th Floor
New York, New York 10001
Telephone: [phone]

2
3
4
5

Attorneys for Plaintiffs

6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
AMENDED CLASS ACTION COMPLAINT

- 29

-

1
2
3
4
5

CERTIFICATE OF SERVICE
I HEREBY CERTIFY that, on December 2, 2011, I electronically filed the foregoing
with the Clerk of the Court using CM/ECF. I also certify that the foregoing document is being
served this day on all counsel of record via transmission of Notices of Electronic Filing
generated by the ECF System.

6
/s/
Peter E. Seidman
PETER E. SEIDMAN

7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
AMENDED CLASS ACTION COMPLAINT