Ung et al v. Facebook, Inc.

Filing 16

RESPONSE (re 10 MOTION to Dismiss FACEBOOK, INC.S MOTION TO DISMISS PLAINTIFFS CLASS ACTION COMPLAINT ) filed byChi Cheng, Alice Rosen, Ryan Ung. (Vu, Anne Marie) (Filed on 9/1/2011)

1
2
3
4
5

Sanford P. Dumain
Peter E. Seidman
Melissa Ryan Clark
Charles Slidders
Anne Maire Vu (SBN 238771)
MILBERG LLP
One Pennsylvania Plaza
New York, NY 10119
Telephone:
[phone]
Facsimile:
[phone]

6
7
8
9

Michael R. Reese (SBN 206773)
Kim E. Richman
REESE RICHMAN LLP
875 Avenue of the Ameircas
New York, NY 10001
Telephone:
[phone]
Facsimile:
[phone]

10
11

Attorneys for Plaintiffs

12
13

UNITED STATES DISTRICT COURT

14

NORTHERN DISTRICT OF CALIFORNIA

15

SAN JOSE DIVISION

16
17

RYAN UNG, CHI CHENG, and ALICE
ROSEN, on Behalf of Themselves and All
Others Similarly Situated,

18
19
20
21
22

23
24
25
26
27
28

Plaintiffs,
v.
FACEBOOK, INC.,
Defendant.

) Case No. CV-11-02829
)
) PLAINTIFFS' OPPOSITION TO
) FACEBOOK INC.'S MOTION TO
) DISMISS CLASS ACTION
) COMPLAINT
)
) FED. R. CIV. P. 12(b)(1), 12 (b)(6)
)
) DATE:
) TIME:
) JUDGE:
) COURTROOM:
)

)

TBD
TBD
HON. JEREMY FOGEL

3

1

TABLE OF CONTENTS

2

Page

3

STATEMENT OF ISSUES TO BE DECIDED

1

4

INTRODUCTION AND STATEEMNT OF FACTS

1

5

ARGUMENT

4

6

I.

PLAINTIFFS HAVE ESTABLISHED ARTICLE In STANDING

4

7

II.

FACEBOOK VIOLATED THE RIGHT TO PRIVACY ARISING FROM
CALIFORNIA'S STATE CONSTITUTION

6

Plaintiffs Have a Legally Protected Pirvacy Interest in
Their Personal Browsing History

7

Plaintiffs Have a Legally Protected Interest in the Whole
of Their Browsing History

7

8
9
10

A.
1.

11
12
13

2.
3.

14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

B.
III.

Plaintiffs Adequately Alleged That Facebook Collected Sensitive Information
from Them as a Result of Their Visits to Specific Websites

10

Plaintiffs Reasonably Expected That Their Internet Searches
Would Remain Private

10

Plaintiffs Allege Conduct by Defendant that Constitutes a Serious
Invasion of Privacy

12

PLAINTIFFS HAVE ALLEGED A CLAIM FOR UNJUST ENRICHMENT

13

1
TABLE OF AUTHORITIES

2

Page(s)

3
CASES

4
5
6
7
8

Council of Ins. Agents & Brokers v. Molasky-Arman,
522 F.3d 925 (9th Cir. 2008)

4, 5

Danvers Motor Co. v. Ford Motor Co.,
432 F.3d 286 (3d Cir. 2005)

4

Edwards v. First Am. Corp.,
610 F.3d 514 (9th Cir. 2010)

4

Fulfillment Servs. Inc. v. UPS Inc.,
528 F.3d 614 (9th Cir. 2008)

4

Gest v. Bradbury,
443 F.3d 1177 (9th Cir. 2006)

4

9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

Hill v. NCAA,
7 Cal. 4th 1(1994)

6, 7, 11

Holmes v. Petrovich Dev. Co.,
191 Cal. App. 4th 1047 (2011)

11

In re DoubleClick Inc. Privacy Litig.,
154 F. Supp. 2d 497 (S.D.N.Y. 2001)
In re Facebook Privacy Litig.,
No. 10-02389, --- F. Supp. 2d

5

, 2011 WL 2039995 (N.D. Cal. May 12, 2011)

In re Historical Cell-Site Info.,
No. 10-MC-897, 2011 WL 3678934 (E.D.N.Y. Aug. 22, 2011)
In re Jetblue Airways Corp. Privacy Litig.,
379 F. Supp. 2d 299 (E.D.N.Y. 2005)

4, 14, 15
8
15

Krottner v. Starbucks Corp.,
628 F.3d 1139 (9th Cir. 2010)

6

LaCourt v. Specific Media, Inc.,
No. 10-1256, 2011 WL 1661532 (C.D. Cal. Apr. 28, 2011)

5

Matracia v. JP Morgan Chase Bank, NA,
2011 WL 3319721 (E.D. Cal. Aug. 1, 2011)
Monet v. Chase Home Fin., LLC,
No. 10-0135, 2010 WL 2486376 (N.D. Cal. June 16, 2010)
- ii -

13
13, 14

NAACP v. Alabama,
People v. Stipo,
People v. Weaver,
Pettus v. Cole,
Pisciotta v. Old Nat'l Bancorp,
Ruiz v. Gap, Inc.
SOAProjects, Inc. v. SCM Microsystems, Inc.,
State v. Jackson,
Thompson v. Home Depot, Inc.,
United States Dep't of Justice v. Reporters Comm. for Freedom of the Press,
United States v. Forrester,
United States v. Maynard,
United States v. Pineda—Moreno,
STATUTES

et seq

1

OTHER AUTHORITIES

2

Cal. Const. Art. I, § I

3

3, 6

4

Charles Alan Wirght, Arthur R. Miller, et al., Federal Practice and Procedure §3531.4
(3d ed. 2011)

5

Fed. R. Civ. P. 8

10

6

Fed. R. Civ. P. 15

15

7

Jeff Jarvis, Buzz Machine, Disliking "Like" in Germany (Aug. 19, 2011),
http://www.buzzmachine.com/2011/08/19/disliking-like-in-germany/

12

Unabhängiges Landeszentrum fiir Datenschutz Schleswig-Holstein [The Data Protection
Commissioner's Office (Independent Centre for Privacy Protection - ULD)], Press
Release, ULD to website owners: "Deactivate Facebook web analytics" (Aug. 19,
2011), https://www.datenschutzzentrum.de/presse/20110819-facebook-en.htm.

12

8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

- iv -

4

1

Plaintiffs Ryan Ung, Chi Cheng, and Alice Rosen ("Plaintiffs") respectfully submit the

2

following in opposition to the motion to dismiss filed by defendant Facebook, Inc.

3

("Defendant"). Defendant' s motion is without merit and should be denied.

4

STATEMENT OF ISSUES TO BE DECIDED

5

1)

Does the complaint meet the minimal standards of Article III standing?

6

2)

Does the complaint state a cause of action for violation the right to privacy

7
8
9

guaranteed by California's constitution?
3)

Does the complaint state a cause of action for unjust enrichment?
INTRODUCTION AND STATEMENT OF FACTS

10

The ubiquitous Facebook Like button is an image, found on millions of websites, that

11

displays a thumbs-up symbol accompanied by the word "Like. " When a Facebook member

12

clicks the Like button, an item appears on the member's Facebook profile page with a link back

13

to the website. Thus, by "Liking" a website, the Facebook member recommends the website to

14

his or her Facebook "friends."

15

Unbeknownst to Intenret users, the Like button is also a component of what might aptly

16

be called Facebook's Like button surveillance and personal information collection program

17

("Like Button Surveillance Program"). Facebook uses the Like button to track Facebook

18

members and non-members alike as they browse the Internet. Facebook then links its records of

19

each new page a user visits into Facebook's record of all the Like button pages that the user has

20

visited in the previous minutes, months, and years. The Like Button Surveillance Program

21

thereby records discrete bits of sensitive personal information deirved from users' visits to

22

particular websites and also obtains information sufficient to construct and update a long-term

23

profile based on the users' choice of website destinations over a prolonged peirod.

24

information is collected even if the website visitor does not click on the Like button, and

25

Internet users have no way

26

Comp1.1 14. Therefore, unless a person forgoes use of the Intenret altogether, the Like buttons,

27

and all they entail, are unavoidable. Id. atl 12.

The

of knowing in advance which websites contain Like buttons.

28
-1-

1

Facebook begins to collect information about an Internet user

whether they are a

2

Facebook member or not—as soon as the Intenret user creates a Facebook account or simply

3

visits a page that contains a Like Button. Facebook's processes for tracking members and non-

4

members, and associating their browsing history with their personal identity and information, are

5

as follows:

6

(a)

7
8
9
10
11
12
13

Facebook Members: Upon registration, Facebook implants tracking devices (e.g.,

"cookies") on a member's computer. Each time the member visits a site displaying the Facebook
Like button, the updated Facebook tracked information, including the member's most recent
browsing history, is sent to Facebook. Facebook can then link the tracked information with the
member's actual identity and the personally-sensitive information associated with the particular
user's account and/or profile. This occurs regardless of whether the Facebook member clicks
the Like button.
If a Facebook member had visited a webpage (or several) with a Like button before
becoming a Facebook member, all of her browsing history, before she became a Facebook

14

member, would also become associated with her account (and thus actual identity) at the time of

15

registration.

16

If a Facebook member deactivates her account through the process Facebook provides,

17

the entire account is nevertheless kept by Facebook, which can continue to link browsing data to

18

the Internet user's closed account (and thus actual identity) just as when the account was active.

19

If the member wishes to delete the account entirely, such that Facebook no longer has access to

20

his or her personal data, she must make a specific request to Facebook that takes two weeks to

21

process. Id.

22

(b)

1 15.
Non-Facebook Members: Facebook implants tracking devices (e.g., cookies) on

23

the computers of non-Facebook members when the non-Facebook members visit one of the

24

million websites in the Facebook Connect network! Thereafter, Facebook's anonymous profile

25

of the non-members is updated each time a non-member visits a site displaying the Facebook

26
27
28

1 Facebook Connect enables Facebook members to log onto third-party websites, applications,
mobile devices, and gaming systems with their Facebook identities. While logged on, users can
connect with friends via these media and post information and updates to their Facebook
profiles. Id. 13.

1

-2-

Facebook thus tracks

1

"Like" button, even if the non-member does not click the "Like" button.

2

and collects extensive information about individuals who consciously choose not to become

3

Facebook members. Furthermore, if and when a non-member subsequently joins Facebook,

4

Facebook can associate the previously anonymous file with the member and her account

5

information, which includes, at a minimum, the member's name and address. And from that

6

time on, all subsequent requests for Facebook content are associated with the Facebook account

7

and, thus, the Facebook member's identity. Id. atl 15.
Defendant's motion to dismiss is based on three arguments, each of which ignores salient

8
9
10
11

facts of this case. First, Defendant argues that Plaintiffs lack Article III standing because they
have not alleged injury in fact. Defendant, however, violated Plaintiffs' inalienable right to
pirvacy, as guaranteed by Article I, Section I of the California Constitution. Id. IN 1, 28-33. This
is more than sufficient harm to confer Article III standing. Pt. I.

12
13

Second, Defendant argues that Plaintiffs have not alleged facts sufficient to establish a
violation of the California constitutional right to privacy. This argument, however, cannot avoid

14

the fact that courts have held that far less egregious surveillance programs are unconstitutional.

15

Pt. ll.

16

Finally, Defendant argues that Plaintiffs' unjust enrichment claim should be dismissed

17

because California courts do not recognize unjust enirchment as an independent cause of action.

18

Defendant, however, acknowledges, as have courts in this Distirct, that litigants may seek

19

restitution using an unjust enrichment claim. Defendant then argues that, even if a restitution

20

claim were acknowledged, Plaintiffs have not alleged that they have suffered any detriment to a

21

property irght as a result of Defendant's unjust conduct. The cited precedent does not apply to

22

the circumstances of this case and, moreover, Plaintiffs have clearly alleged that Defendant's

23

conduct has caused Plaintiffs to lose money through the sale of Plaintiffs' personal information

24

to third parties without Plaintiffs' knowledge. Pt. III

25
26
27

In short, Plaintiffs have adequately pleaded that Facebook has stripped them of their
constitutional irght to control the personal information they reveal about themselves and to
whom they reveal it and that Facebook unjustly obtains and divulges personal and embarrassing

28
-3-

1

information to data aggregators for its own enirchment. Accordingly, Defendant's motion to

2

dismiss must be denied.
ARGUMENT

3
4

I.

PLAINTIFFS HAVE ESTABLISHED ARTICLE III STANDING
Article III standing limits the subject matter juirsdiction of a federal court to cases or

5
controversies that are "justiciable"—i.e., capable of being appropirately decided by resolution of
6
the particular case or controversy before the court. 2 Defendant argues that Plaintiffs lack
7
standing in this case because Plaintiffs have not alleged harm that constitutes injury in fact, Def.
8
Mem. 8, but Plaintiffs have in fact alleged such harm.
9
To satisfy the standing requirements of Article III, a plaintiff must show that he has
10
suffered an "injury in fact" that is (a) concrete and particularized and (b) actual or imminent, not
11
conjectural or hypothetical. Gest v. Bradbury, 443 F.3d 1177, 1181 (9th Cir. 2006). "The injury
12
required by Article III can exist solely by virtue of 'statutes creating legal rights, the invasion of
13
which creates standing.'" Fulfillment Servs. Inc. v. UPS, Inc., 528 F.3d 614, 618-19 (9th Cir.
14
2008); Edwards v. First Am. Corp., 610 F.3d 514, 517 (9th Cir. 2010). In such cases, the
15
"'standing question . . . is whether the constitutional or statutory provision on which the claim
16
rests properly can be understood as granting persons in the plaintiff s position a right to judicial
17
relief. "' Edwards, 610 F.3d at 517 (citation omitted); see also In re Facebook Privacy Litig., No.
18
10-02389, --- F. Supp. 2d

, 2011 WL 2039995, at *4 (N.D. Cal. May 12, 2011) (Ware, J.)

19
(holding that the plaintiffs had standing).
20
"Injury-in-fact is not Mount Everest." Danvers Motor Co. v. Ford Motor Co., 432 F.3d
21
286, 294 (3d Cir. 2005). To the contrary, it suffices for federal standing purposes to allege some
22
specific, "'identifiable trilfe'" of injury. Council of Ins. Agents & Brokers v. Molasky-Arman,
23
522 F.3d 925, 932 (9th Cir. 2008) (quoting United States v. Students Challenging Regulatory
24
Agency Procedures (SCRAP), 412 U.S. 669, 689 n.14 (1973)). The U.S. Supreme Court has
25
allowed important interests to be vindicated by plaintiffs with "no more at stake in the outcome
26
27
See 13A Charles Alan Wright, Arthur R. Miller, et al., Federal Practice and Procedure
§ 3531.4 (3d ed. 2011).

2

28

-4-

1

of an action than a fraction of a vote, a $5 fine and costs, and a $1.50 poll tax." Id. (internal

2

quotations omitted). "'The basic idea that comes out in numerous cases is that an identifiable

3

trifle is enough to ifght out a question of principle;

4

principle provides the motivation. '" Id. (emphasis added) (quoting SCRAP, 412 U.S. at 689

5

n.14). Here, where constitutionally-protected rights to privacy have been violated, Plaintiffs'

6

alleged injuires are certainly more than a "trilfe." Compl. TI 1, 28-33.

the tirfle is the basis for standing and the

7

Because Plaintiffs can establish standing based on the alleged infringement of their

8

privacy rights under the California Constitution, Defendant's arguments regarding economic loss

9

are irrelevant.

See Def. Mem. 10-11. Likewise, Defendant erroneously relies on precedent

10

addressing economic loss and personally-identifiable information.

11

DoubleClick Inc. Privacy Litig., 154 F. Supp. 2d 497, 525 (S.D.N.Y. 2001); LaCourt v. Specific

12

Media, Inc., No. 10-1256, 2011 WL 1661532, at *3-5 (C.D. Cal. Apr. 28, 2011)). As the court in

13

Specific Media specifically stated, the discussion in the DoubleClick case regarding economic

14

loss was "not in the context of evaluating Article III standing."

15

1661532, at *53 Furthermore, the Specific Media decision clearly rested on a deficiency of facts

16

in the complaint indicating that any named plaintiff was affected by the defendant's alleged

17

conduct. See Specific Media, 2011 WL 1661532, at *4. 4 In contrast, the named Plaintiffs here

18

have alleged sufficient facts to indicate they were affected by the defendant's alleged conduct, as

19

they have each alleged an invasion of a constitutional irght to pirvacy. Compl. IN 1, 28-33.

See id. (citing In re

Specific Media, 2011 WL

20

The recent Ninth Circuit case of Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir.

21

2010), is on point here. In Krottner, the plaintiffs alleged that defendant Starbucks had violated

22
23
24
25
26
27
28

3 Moreover, the portion of the decision in DoubleClick that Defendant cites discusses a claim by
plaintiffs under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030 et seq., which
imposes a $5,000 threshold. See DoubleClick, 154 F. Supp. 2d at 523-26 (finding that the
plaintiffs had failed to allege facts that could support the inference that the damages and losses
they incurred from the defendant's access to the plaintiffs' computers could meet
§ 1030(e)(8)(A)'s damage threshold). Here, Plaintiffs are not relying on the CFAA.
4 While noting the inadequacy of the plaintiffs' complaint, the Specific Media court did
recognize the viability in the abstract of such concepts as "opportunity costs, " "value-for-value
exchanges," " consumer choice," and other concepts referred to in the plaintiffs' opposition brief,
and, therefore, the court allowed the plaintiffs to amend their complaint to allege facts related to
such theories. 2011 WL 2473399, at *4; see also id. at *6.

-5-

1

their pirvacy when the defendant failed to encrypt personal information regarding the plaintiffs

2

on a company laptop that was stolen from a Starbucks store. Id. at 1140. The defendant moved

3

to dismiss, arguing that the plaintiffs did not have Article III standing. The Ninth Circuit rejected

4

this argument, stating: "we hold that Plaintiffs-Appellants, whose personal information has been

5

stolen but not misused, have suffered an injury sufficient to confer standing under Article III,

6

Section 2 of the U.S. Constitution. " Id.; see also Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629,

7

634 (7th Cir. 2007) (reasoning that person who had his private information taken without

8

plaintiff s permission, but not misused, had standing under Article BI).

9

governing authority of Krottner, Plaintiffs clearly have Article III standing.

10
11

II.

Hence, under the

FACEBOOK VIOLATED THE RIGHT TO PRIVACY ARISING FROM
CALIFORNIA'S STATE CONSTITUTION
Try as it might, Facebook cannot get around the fact that its Like Button Surveillance

12
Program involves precisely the type of conduct proscribed by Article 1, Section 1 of the
13
California Constitution.
14
Article 1, Section 1 was amended on November 7, 1972, following a ballot initiative to
15
create an express right to privacy. The "Privacy Initiative"—i.e., the privacy amendment

"is to

16
be interpreted and applied in a manner consistent with the probable intent of the body enacting it:
17
the voters of the State of California. " Hill v. NCAA, 7 Cal. 4th 1, 16 (1994). The intent of the
18
voters is clear:
19
20
21
22
23
24

The principal focus of the Privacy Initiative is readily discernable.
The Ballot Argument warns of unnecessary information gathering,
use, and dissemination by public and private entities -- images of
"government snooping,"computer stored and generated "dossiers"
and "`cradle-to-grave' profiles on every American" dominate the
framers' appeal to the voters
The evil addressed is ... business
conduct in "collecting and stockpiling unnecessary information ...
and misusing information ... "

25

Id. at 21 (quoting Ballot Pamp., Proposed Stats. and Amends. to Cal. Const. with arguments to

26

voters, Gen. Elec. (Nov. 7, 1972), at 26, 27).

27
28

This is exactly what Facebook's Like Button Surveillance Program does

it uses the

ubiquitous Like button to "collect and store sensitive, private, and personally identifiable
-6-

1

information," Compl. 1 1, and "to track Internet users as they browse the web and thereby

2

collect[] private and, in some cases, sensitive information about them," id. 1 14.

3

California courts have held that a plaintiff must satisfy three elements to establish a

4

violation of the Privacy Initiative: "(1) a legally protected privacy interest; (2) a reasonable

5

expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious

6

invasion of privacy." Ruiz v. Gap, Inc., 380 F. App'x 689, 692 (9th Cir. 2010) (quoting Hill, 7

7

Cal. 4th at 26). As set forth herein, Plaintiffs satisfy each of these elements.5

8

A.

9

Plaintiffs Have a Legally Protected Privacy Interest in Their Personal
Browsing History
1.

10

Plaintiffs Have a Legally Protected Interest in the Whole of Their
Browsing History

11

Defendant asserts that Plaintiffs failed to allege a legally protected privacy interest

12

because "the Complaint does not allege that Facebook has either collected - or disclosed - any

13

such highly personal information from any of the Plaintiffs or that any of the Plaintiffs even have

14

such interests to protect." Def. Mem. 12 (emphasis in original). However, Plaintiffs have a

15

legally protected privacy interest in their browsing history regardless of whether they visited any

16

single web site from which sensitive information about them could be inferred.

17

The Supreme Court addressed this situation—in which the whole of the information

18

obtained is something different from the sum of its parts—in United States Department of Justice

19

v. Reporters Committee for Freedom of the Press, 489 U.S. 749 (1989).6 In upholding the FBI's

20
21
22
23
24
25
26

5

Legally recognized privacy interests are generally of two classes: (1) interests in precluding
the dissemination or misuse of sensitive and confidential information (`informational privacy');
and (2) interests in making intimate personal decisions or conducting personal activities without
observation, intrusion or interference (`autonomy privacy')." Hill, 7 Cal. 4th at 35.
"Informational privacy is the core value furthered by the Privacy Initiative." Id. (citing White v.
Davis, 13 Cal. 3d 757, 774 (1975)); see also Pettus v. Cole, 49 Cal. App. 4th 402, 440-41 (1996)
(with regard to the protection afforded by the Privacy Initiative, "[t]he right to control
circulation of personal information is fundamental." (internal citations omitted)). Facebook has
also compromised Plaintiffs' privacy interests in "autonomy privacy" because tracking a
person's use of the Internet to browse websites—often from the privacy of the person's home
and, in almost all cases, outside of public view—is a form of "observation, intrusion or
interference" in her decisions regarding which websites to visit.
44

6

27
28

See United States v. Maynard, 615 F.3d 544, 561 n.*[4] (D.C. Cir. 2010), cert. granted, U.S. v.
Jones, No. 10-1259, 2011 WL 1456728 (June 27, 2011) ("The colloquialism that 'the whole is
greater than the sum of its parts' is not quite correct. 'It is more correct to say that the whole is
something different than the sum of its parts.' Kurt Koffa, Principles of Gestalt Psychology 176
-7-

1

invocation of the pirvacy exception of the Freedom of Information Act, the Court explained that

2

the appellant had a privacy interest in the whole of his rap sheet even though the individual

3

events in the summary were matters of public record. Id. at 764. The court in Maynard also

4

recognized a distinct privacy interest in the whole of collected information. 615 F.3d at 568

5

(holding that the prolonged GPS tracking of an individual without a warrant defeated his

6

expectation of privacy and violated the Fourth Amendment). The court noted that "[w]hen it

7

comes to pnvacy, . . . precedent suggests that the whole may be more revealing than the parts."

8

Id. at 561. The court explained its rationale as follows:

9

18

. . . Prolonged surveillance reveals types of information not
revealed by short-term surveillance, such as what a person does
repeatedly, what he does not do, and what he does ensemble. These
types of information can each reveal more about a person than
does any individual trip viewed in isolation. Repeated visits to a
church, a gym, a bar, or a bookie tell a story not told by any
single visit, as does one's not visiting any of these places over the
course of a month. The sequence of a person's movements can
reveal still more; a single tirp to a gynecologist's office tells little
about a woman, but that trip followed a few weeks later by a visit
to a baby supply store tells a different story. A person who knows
all of another' s travels can deduce whether he is a weekly church
goer, a heavy drinker, a regular at the gym, an unfaithful husband,
an outpatient receiving medical treatment, an associate of
particular individuals or political groups—and not just one such
fact about a person, but all such facts.

19

Id. at 562 (emphasis added; footnote omitted). See also In re Historical Cell-Site Info., No. 10-

20

MC-897, 2011 WL 3678934, at *5 (E.D.N.Y. Aug. 22, 2011); People v. Weaver, 12 N.Y.3d 433,

21

442 (2009) (prolonged monitoring "yields . . . a highly detailed profile, not simply of where we

22

go, but by easy inference, of our associations - - political, religious, amicable and amorous, to

23

name only a few -- and of the pattern of our professional and avocational pursuits."); State v.

24

Jackson, 150 Wash. 2d 251, 262 (2003) (en banc) ("In this age, vehicles are used to take people

25

to a vast number of places that can reveal preferences, alignments, associations, personal ails and

10
11
12
13
14
15
16
17

26
27
28

(1935). That is what the Court was saying in Reporters Committee and what we mean to convey
throughout this opinion.").
-8-

1

foibles. The GPS tracking devices record all of these travels, and thus can provide a detailed

2

picture of one's life.").7

3

This case is no different. In this age, the Intenret takes people to a vast number of web

4

sites just as vehicles take them to a vast number of physical locations, and the Internet

5

destinations they choose are at least as revealing and in the same way. 8 Thus, "[r]epeated visits to

6

a church [website], a gym [website], a bar [website], or [an online] bookie tell a story not told by

7

any single visit, as does one's not visiting any of these [websites] over the course of a month",

8

and "[a] person who knows all of another's [web browsing history] can deduce whether he is a

9

weekly church goer, a heavy drinker, a regular at the gym, an unfaithful husband, an outpatient

10

receiving medical treatment, an associate of particular individuals or political groups—and not

11

just one such fact about a person, but all such facts." Maynard, 615 F.3d at 562. Likewise here, it

12

is the aggregation of information, the profile or dossier of an individual, created from that

13

person's web browsing history, in which there is a legally protected interest. Moreover, this is

14

precisely the type of "stockpiling" of information to create a personal "profile" or "dossier" that

15

the Privacy Initiative was specifically intended to prevent.9

16
7

17
18
19
20
21
22
23
24
25
26
27
28

Cf Cal. Penal Code § 637.7, Stats. 1998, c. 449 (S.B. 1667), §§ 1-2 (making it unlawful for
anyone but a law enforcement agency to "use an electronic tracking device to determine the
location or movement of a person" and specifically declairng that "electronic tracking of a
person's location without that person's knowledge violates that person's reasonable expectation
of privacy.").
8 If anything, surveillance of Internet "travel" is much more revealing than vehicle travel;
Intenret travel is much speedier than vehicular travel and, therefore, surveillance of Intenret
travel allows for the collection of much larger data sets in a much shorter time period.
9
Defendant might try to argue that the Ninth Circuit rejected this approach in United States v.
Pineda–Moreno, 591 F.3d 1212 (9th Cir. 2010). But Pineda-Moreno is distinguishable in several
important aspects. First, the travel that police tracked occurred "on public thoroughfares" and the
GPS tracking data "could have [been] obtained by following the car. " The court held that, for
this reason, a person "has no reasonable expectation of privacy in his movements from one place
to another. " 591 F.3d at 1216. In contrast, Internet transmissions are not over public
thoroughfares (but rather invisible or through cables buired deep underground), and a person's
Internet browsing is not open to public view. Moreover, Intenret browsing often occurs on
computers that are password protected for the very purpose of keeping Intenret search histoires
secret. Second, the state had a substantial countervailing interest in the information collected—it
was to be used to obtain a felony conviction on drug charges. In contrast, there is no such state
interest (if any legitimate interest whatsoever) in Facebook's Like Button Surveillance Program
Finally, the appellant in Pineda-Moreno did not squarely raise the issue of, and the Court did not
perceive, a distinction between the pirvacy interest compromised by short-term surveillance on
the one hand and long-term surveillance on the other. Consequently, it did not address the issue,
-9-

1
2

2.

Plaintiffs Adequately Alleged That Facebook Collected Sensitive
Information from Them as a Result of Their Visits to Specific
Websites

3

In any event, Plaintiffs adequately alleged having visited sites of a sensitive nature. The

4

Complaint alleges that Facebook tracks sensitive and personal information about, for example,

5

"[a]nyone who has used the Intenret to seek advice about hemorrhoids, sexually transmitted

6

diseases, abortion, drug rehabilitation, dementia. " Compl. 1 14. The full extent of personally

7

sensitive web pages that contain Like buttons is a fact question to be ascertained through

8

discovery (indeed, the Facebook Like button is pervasive, and Facebook exercises no control

9

over, and has no approval process for, the websites that contain Like buttons), but by way of

10

example, the websites for Jews for Jesus, the Tea Party, the John Birch Society, RevLetf - the

11

Home of the Revolutionary Left, Americans for Tax Reform, NORML (a drug law reform

12

group), Students for a Sensible Drug Policy, the Human Rights Commission's website promoting

13

gay rights, and Glenn Beck's home page are among the millions of websites that feature the

14

Facebook Like button. A visit to any of these websites will reveal, at the very least, Plaintiffs'

15

interest in potentially highly sensitive material. While Plaintiffs have indeed visited websites

16

regarding medical concerns, politics, and other sensitive topics, the specific websites were not

17

enumerated in the complaint for the same reason that it was a violation of California's

18

constitutional protections when Facebook tracked Plaintiffs' visits to those sites: Plaintiffs have a

19

legally protected pirvacy interest in that browsing history. 10
3.
Plaintiffs Reasonably Expected That Their Internet Searches Would
Remain Private

20
21

An Internet user does not expect Facebook to monitor and retain a record of his Internet

22

travel any more than he expects "anyone to monitor and retain a record of every time he drives

23

his car, including his origin, route, destination, and each place he stops and how longs he stays

24
25
26
27
28

present here, of whether appellant had a privacy interest that precluded prolonged as opposed to
short-term surveillance.
10 Plaintiffs were required to plead their allegations in accordance with Fed. R. Civ. P. 8, which
requires only "ashort and plain statement of the claim" to put Defendant on notice of the claims
against it; Plaintiffs have done so. If Defendant's contentions were accepted as true, see Def.
Mem. at 8, Plaintiffs would be held to a much higher, inapplicable pleading standard, that would
require them to compromise the privacy irghts they have asserted.
- 10 -

1

there," Maynard, 615 F.3d at 563

and contrary to Facebook's assertion, Def. Mem. 13,

2

Facebook's pirvacy policy provides no notice that this is what is going on. Instead, it simply

3

states that Facebook uses cookies "to make Facebook easier to use, to make our advertising

4

better, and to protect both you and Facebook" and "to know when you are interacting with

5

Facebook platform applications and websites, our widgets and Share buttons, and our

6

advertisements." Id.

7

Even if Facebook provided real or even constructive notice generally (which it does not),

8

such notice was wholly ineffective and meaningless with respect to any given website. The

9

millions of sites that host Like buttons all record a user's visit the moment she "arrives" at the

10

website, regardless of whether the user clicks on the Like button.

Comp1.1 14. There is no

11

way Plaintiffs could have known in advance that the website they were about to visit had a Like

12

button tracking device, and that their visit to that site would be recorded and associated with

13

them and their other website visits. 11 Plaintiffs' only alternative to disclosing pirvate information

14

to Facebook, therefore, would be to avoid using the Internet altogether—a high price to pay in an

15

age in which many people consider the Intenret a utility that is no less necessary than electric or

16

phone service, and a price that Facebook has no irght to impose.12

17

Defendant argues with regard to the subclass of non-Facebook members, whom

18

Facebook cannot immediately identify, that "[a] person cannot be said to have a reasonable

19

expectation of pirvacy in anonymous data about the pages he or she has visited on the Internet,

20

particularly because data on the Intenret is routinely routed through the multiple third-party

21
22
23
24
25
26
27
28

11 For this reason, among others, Defendant's reliance on Hill and Holmes v. Petrovich
Development Co., 191 Cal. App. 4th 1047, 1068 (2011), are inapt; in both of those cases,
plaintiff had ample notice that the matter at issue was public. Hill, 7 Cal. 4th at 35-36; Holmes,
191 Cal. App. 4th at 1068-72.
12 Defendant's reliance on United States v. Forrester, 512 F.3d 500 (9th Cir. 2008), and People
v. Stipo, 195 Cal. App. 4th 664 (2011), Def. Mem. 14 n.6, to establish that users of the Internet
do not have a reasonable expectation of privacy for similar Internet activity, is misplaced
because the Intenret activity in both cases was not at all similar. In Forrester, the issue was
disclosure of email addresses, and in Stipo, disclosure of subscriber information. Neither case
involved browsing history, and, indeed, Forrester recognized that a plaintiff has a reasonable
expectation to privacy in the content of web searches. 512 F.3d at 510 n.6 (distinguishing
between disclosure of the IP address of the Internet user, on the one hand, and URLs that reveal,
e.g., the particular newspaper articles a person viewed, on the other hand).

- 11 -

1

servers as anonymous data packets." Def. Mem. 14. But it cannot deny that an anonymous user's

2

identity, and dossier of associated information, will be correlated with the user's actual identity,

3

without notice, if she joins Facebook at a later date. The Complaint plainly alleges that, at the

4

time a non-member joins Facebook, "Facebook can associate the previously anonymous Tile'

5

with the member and his or her account information, which includes, at a minimum, the

6

members' names and addresses. " Comp1.1 15(c). Non-members have a reasonable expectation

7

that their search history is, and will remain, anonymous.

8

B.

9

Plaintiffs Allege Conduct by Defendant that Constitutes a Serious Invasion of
Privacy

Defendant tries to trivialize the effects of Facebook's invasion of privacy by suggesting
10
that it is nothing more than "routine commercial behavior" to secretly track Plaintiffs' "website
11
browsing history" and stockpile information about the Plaintiffs. Def. Mem. 14. But Facebook's
12
surveillance via the Like button—regardless of whether it is clicked or the Internet user is a
13
Facebook member—is a new technology the impact of which is untested. Therefore, the alleged
14
misconduct cannot be "routine commercial behavior" and will only become so if courts allow it
15
to continue. 13 And courts cannot permit such conduct because it is the very type of "seirous"
16
invasion of privacy that the Privacy Initiative was intended to prevent. Pt. WA)(1), supra. The
17
purpose and intent of privacy legislation make clear the seriousness of Facebook's misconduct.
18
For instance, the voters of California intended that the right to privacy protect "our freedom to
19
associate with the people we choose. " Official Ballot Pamphlet at 28. The Supreme Court has
20
also "recognized the vital relationship between freedom to associate and privacy in one's
21
associations. " NAACP v. Alabama, 357 U.S. 449, 462 (1958) ("Inviolability of privacy in group
22
13

23
24
25
26
27
28

It clearly is not routine commercial behavior in Germany. Indeed, Thilo Weichert, head of the
office for data protection in the German state of Schleswig-Holstein, condemned the Facebook
Like button, stating that it violates German and European privacy laws and called "on all
institutions in the federal state of Schleswig-Holstein, Germany to shut down their fan pages on
Facebook and remove social plug-ins such as the 'like' button from their websites."
Unabhängiges Landeszentrum fur Datenschutz Schleswig-Holstein [The Data Protection
Commissioner's Office (Independent Centre for Privacy Protection - ULD)], Press Release, ULD
to website owners: "Deactivate Facebook web analytics" (Aug. 19, 2011),
https://www.datenschutzzentrum.de/presse/20110819-facebook-en.htm . See also Jeff Jarvis,
Buzz
2011),
Machine,
Disliking
"Like"
in
Germany
(Aug.
19,
http://www.buzzmachine.com/2011/08/19/disliking-like-in-germany/.
- 12 -

1

association may in many circumstances be indispensable to preservation of freedom of

2

association, particularly where a group espouses dissident beliefs." Id.). Here, Facebook is

3

stockpiling information connected to a web browsing history that discloses information about the

4

users' associations, including membership in, or an interest in, dissident groups—when Plaintiffs

5

and Class members have made no choice to reveal their associations to Facebook, and, in the

6

case of non-members, have made no choice to associate with Facebook itself.

7

III.

PLAINTIFFS HAVE ALLEGED A CLAIM FOR UNJUST ENRICHMENT

8

Defendant asserts that Plaintiffs' unjust enrichment claim should be dismissed because

9

"there is no such independent cause of action in California." Def. Mem. 15. "[C]ourts have held

10

that unjust enrichment is equivalent to restitution and have allowed litigants to seek restitution

11

using an unjust enrichment claim. " SOAProjects, Inc. v. SCM Microsystems, Inc., No. 10-1773,

12

2010 WL 5069832, at *9 (N.D. Cal. Dec. 7, 2010) (Koh, J.) (internal citations omitted); see also

13

Matracia v. JP Morgan Chase Bank, NA, No. 11-190, 2011 WL 3319721, at *4 (E.D. Cal. Aug.

14

1, 2011) ("A party is required to make restitution if he or she is unjustly enirched at the expense

15

of another. A person is enirched if the person receives a benefit at another's expense."

16

(quotations and citations omitted)). "Given the appropirate facts . . . , a plaintiff advances a basis

17

for obtaining restitution if he or she demonstrates defendant's receipt and unjust retention of a

18

benefit. " Monet v. Chase Home Fin., LLC, No. 10-0135, 2010 WL 2486376, at *3 (N.D. Cal.

19

June 16, 2010).

20

In Monet, the court discussed three traditional factual scenairos where a theory of unjust

21

enrichment has historically supported a restitution remedy in California: (1) when the parties

22

have a contract that was procured by fraud or is for some reason unenforceable, giving irse to an

23

unjust enrichment claim as an altenrative to breach of contract damages; (2) when the plaintiff

24

cannot assert title or right to possession of particular property but nevertheless can show just

25

grounds for recoveirng money to pay for some benefit the defendant received from him, thus

26

implying a contract at law or a quasi-contract and giving rise to a right to restitution at law

27

through an action derived from the common-law writ of assumpsit; and (3) when money or

28

property identified as belonging in good conscience to the plaintiff could clearly be traced to
- 13 -

1

particular funds or property in the defendant' s possession, giving rise to restitution in equity,

2

ordinarily in the form of a constructive trust or an equitable lien. Id. Plaintiffs' allegations most

3

clearly relate to the third scenairo. Specifically, Plaintiffs' personal information that Defendant

4

collected and stored, Comp1.1 35, is property that belongs to Plaintiffs. See infra. In addition, the

5

money allegedly obtained by Defendant from sales of that information to third parties,

6

Comp1.1 35, is clearly money that can be traced to that property.

7

Defendant argues that Plaintiffs have not suffered any detirment to Facebook's benefit

8

because "Plaintiffs [do not] have property rights in their personal information that would be

9

harmed had Facebook collected that information."

Def. Mem. 16. This argument is

10

unpersuasive. Plaintiffs have alleged that Defendant has done more than merely collect personal

11

information; Plaintiffs have alleged that Defendant sold that information to third parties without

12

Plaintiffs' knowledge. Compl. 35. 14

13

Moreover, the cited precedent is not as supportive as it may seem. The Facebook

14

Privacy opinion Defendant relies upon in tunr relied on Thompson v. Home Depot, Inc., No. 07-

15

1058, 2007 WL 2746603 (S.D. Cal. Sept. 18, 2007). In Thompson, the plaintiff alleged he was

16

required to fill out a form that prompted him to provide personal identification, but he did not

17

allege that "filling out the form caused him to lose any money or property." Id. at *3. Similarly,

18

the plaintiffs in the Facebook Privacy case did not allege that they lost money as a result of the

19

defendant's conduct. 2011 WL 2039995, at *6. Here, Plaintiffs have alleged that Defendant' s

20

conduct caused Plaintiffs to lose money. Compl. (1[ 35 ("Facebook has received and retained

21

money belonging to Plaintiffs and the Class." (emphasis added)). Additionally, the dismissals of

22

the plaintiffs' unjust enrichment claims in the Facebook Privacy case and the Thompson case

23

rested on the failure of the plaintiffs to provide any support for the contention that personal

24

information constitutes valuable property. See Thompson, 2007 WL 2746603, at *3; 15 Facebook

25
26
27
28

14 In its later argument that "Plaintiffs also fail to plead that Facebook' s alleged collection of their
browsing histoires was unjust," Defendant makes the same error of omitting Plaintiff s
allegations of selling Plaintiffs' information. Def. Mem. 16.

15 The Thompson court, in tunr, cited In re Jetblue Airways Corp. Privacy Litig., 379 F. Supp. 2d
299, 327 (E.D.N.Y. 2005) ("There is . . . no support for the proposition that an individual
- 14 -

1

Privacy Litig., 2011 WL 2039995, at *10 n.10. In contrast, Plaintiffs in this case have provided

2

several sources of scholarly and governmental research discussing the economic value of

3

Plaintiffs' personal information. See Compl.

4

alleged that their personal information is a valuable commodity that was sold by Defendant to

5

the financial detriment of Plaintiffs.

6

16-18. As a result, Plaintiffs have sufficiently

Last, Defendant is incorrect that Plaintiffs have not pleaded that Defendant's conduct was

7

unjust. Def. Mem. 16-17. It is patently unjust to use very private and sensitive information of

8

consumers to make profits without the consumers' knowledge that this private information is

9

being disseminated to complete strangers, and Plaintiffs have adequately pleaded this. See, e.g.,

10

Compl.

11

DATED:

1, 14, 32, 35. 16
September 1, 2011

Respectfully Submitted,

12

MILBERG LLP
/s/ Anne Marie Vu

13

Sanford P. Dumain
Peter E. Seidman
Melissa Ryan Clark
Charles Slidders
MILBERG LLP
One Pennsylvania Plaza
New York, NY 10119
Telephone:
[phone]
[phone]
Facsimile:

14
15
16
17
18
19

Michael R. Reese
Kim Richman
REESE RICHMAN LLP
875 Avenue of the Americas
New York, NY 10001
Telephone:
[phone]
Facsimile:
[phone]

20
21
22
23
24

Attorneys for Plaintiffs

25
26
27
28

passenger's personal information has or had any compensable value in the economy at large."
(emphasis added)).
16 Should this Court dismiss any give[n] part of Plaintiffs' case, Plaintiffs respectfully request
leave to amend, which should be "freely give[n]" pursuant to Fed. R. Civ. P. 15.
- 15 -