Ung et al v. Facebook, Inc.

Filing 16

RESPONSE (re 10 MOTION to Dismiss FACEBOOK, INC.S MOTION TO DISMISS PLAINTIFFS CLASS ACTION COMPLAINT ) filed byChi Cheng, Alice Rosen, Ryan Ung. (Vu, Anne Marie) (Filed on 9/1/2011)

Download PDF
1 2 3 4 5 Sanford P. Dumain Peter E. Seidman Melissa Ryan Clark Charles Slidders Anne Maire Vu (SBN 238771) MILBERG LLP One Pennsylvania Plaza New York, NY 10119 Telephone: (212) 594-5300 Facsimile: (212) 868-1229 6 7 8 9 Michael R. Reese (SBN 206773) Kim E. Richman REESE RICHMAN LLP 875 Avenue of the Ameircas New York, NY 10001 Telephone: (212) 579-4625 Facsimile: (212) 253-4272 10 11 Attorneys for Plaintiffs 12 13 UNITED STATES DISTRICT COURT 14 NORTHERN DISTRICT OF CALIFORNIA 15 SAN JOSE DIVISION 16 17 RYAN UNG, CHI CHENG, and ALICE ROSEN, on Behalf of Themselves and All Others Similarly Situated, 18 19 20 21 22 23 24 25 26 27 28 Plaintiffs, v. FACEBOOK, INC., Defendant. ) Case No. CV-11-02829 ) ) PLAINTIFFS' OPPOSITION TO ) FACEBOOK INC.'S MOTION TO ) DISMISS CLASS ACTION ) COMPLAINT ) ) FED. R. CIV. P. 12(b)(1), 12 (b)(6) ) ) DATE: ) TIME: ) JUDGE: ) COURTROOM: ) ) TBD TBD HON. JEREMY FOGEL 3 1 TABLE OF CONTENTS 2 Page 3 STATEMENT OF ISSUES TO BE DECIDED 1 4 INTRODUCTION AND STATEEMNT OF FACTS 1 5 ARGUMENT 4 6 I. PLAINTIFFS HAVE ESTABLISHED ARTICLE In STANDING 4 7 II. FACEBOOK VIOLATED THE RIGHT TO PRIVACY ARISING FROM CALIFORNIA'S STATE CONSTITUTION 6 Plaintiffs Have a Legally Protected Pirvacy Interest in Their Personal Browsing History 7 Plaintiffs Have a Legally Protected Interest in the Whole of Their Browsing History 7 8 9 10 A. 1. 11 12 13 2. 3. 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 B. III. Plaintiffs Adequately Alleged That Facebook Collected Sensitive Information from Them as a Result of Their Visits to Specific Websites 10 Plaintiffs Reasonably Expected That Their Internet Searches Would Remain Private 10 Plaintiffs Allege Conduct by Defendant that Constitutes a Serious Invasion of Privacy 12 PLAINTIFFS HAVE ALLEGED A CLAIM FOR UNJUST ENRICHMENT 13 1 TABLE OF AUTHORITIES 2 Page(s) 3 CASES 4 5 6 7 8 Council of Ins. Agents & Brokers v. Molasky-Arman, 522 F.3d 925 (9th Cir. 2008) 4, 5 Danvers Motor Co. v. Ford Motor Co., 432 F.3d 286 (3d Cir. 2005) 4 Edwards v. First Am. Corp., 610 F.3d 514 (9th Cir. 2010) 4 Fulfillment Servs. Inc. v. UPS Inc., 528 F.3d 614 (9th Cir. 2008) 4 Gest v. Bradbury, 443 F.3d 1177 (9th Cir. 2006) 4 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Hill v. NCAA, 7 Cal. 4th 1(1994) 6, 7, 11 Holmes v. Petrovich Dev. Co., 191 Cal. App. 4th 1047 (2011) 11 In re DoubleClick Inc. Privacy Litig., 154 F. Supp. 2d 497 (S.D.N.Y. 2001) In re Facebook Privacy Litig., No. 10-02389, --- F. Supp. 2d 5 , 2011 WL 2039995 (N.D. Cal. May 12, 2011) In re Historical Cell-Site Info., No. 10-MC-897, 2011 WL 3678934 (E.D.N.Y. Aug. 22, 2011) In re Jetblue Airways Corp. Privacy Litig., 379 F. Supp. 2d 299 (E.D.N.Y. 2005) 4, 14, 15 8 15 Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010) 6 LaCourt v. Specific Media, Inc., No. 10-1256, 2011 WL 1661532 (C.D. Cal. Apr. 28, 2011) 5 Matracia v. JP Morgan Chase Bank, NA, 2011 WL 3319721 (E.D. Cal. Aug. 1, 2011) Monet v. Chase Home Fin., LLC, No. 10-0135, 2010 WL 2486376 (N.D. Cal. June 16, 2010) - ii - 13 13, 14 NAACP v. Alabama, People v. Stipo, People v. Weaver, Pettus v. Cole, Pisciotta v. Old Nat'l Bancorp, Ruiz v. Gap, Inc. SOAProjects, Inc. v. SCM Microsystems, Inc., State v. Jackson, Thompson v. Home Depot, Inc., United States Dep't of Justice v. Reporters Comm. for Freedom of the Press, United States v. Forrester, United States v. Maynard, United States v. Pineda—Moreno, STATUTES et seq 1 OTHER AUTHORITIES 2 Cal. Const. Art. I, § I 3 3, 6 4 Charles Alan Wirght, Arthur R. Miller, et al., Federal Practice and Procedure §3531.4 (3d ed. 2011) 5 Fed. R. Civ. P. 8 10 6 Fed. R. Civ. P. 15 15 7 Jeff Jarvis, Buzz Machine, Disliking "Like" in Germany (Aug. 19, 2011), http://www.buzzmachine.com/2011/08/19/disliking-like-in-germany/ 12 Unabhängiges Landeszentrum fiir Datenschutz Schleswig-Holstein [The Data Protection Commissioner's Office (Independent Centre for Privacy Protection - ULD)], Press Release, ULD to website owners: "Deactivate Facebook web analytics" (Aug. 19, 2011), https://www.datenschutzzentrum.de/presse/20110819-facebook-en.htm. 12 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 - iv - 4 1 Plaintiffs Ryan Ung, Chi Cheng, and Alice Rosen ("Plaintiffs") respectfully submit the 2 following in opposition to the motion to dismiss filed by defendant Facebook, Inc. 3 ("Defendant"). Defendant' s motion is without merit and should be denied. 4 STATEMENT OF ISSUES TO BE DECIDED 5 1) Does the complaint meet the minimal standards of Article III standing? 6 2) Does the complaint state a cause of action for violation the right to privacy 7 8 9 guaranteed by California's constitution? 3) Does the complaint state a cause of action for unjust enrichment? INTRODUCTION AND STATEMENT OF FACTS 10 The ubiquitous Facebook Like button is an image, found on millions of websites, that 11 displays a thumbs-up symbol accompanied by the word "Like. " When a Facebook member 12 clicks the Like button, an item appears on the member's Facebook profile page with a link back 13 to the website. Thus, by "Liking" a website, the Facebook member recommends the website to 14 his or her Facebook "friends." 15 Unbeknownst to Intenret users, the Like button is also a component of what might aptly 16 be called Facebook's Like button surveillance and personal information collection program 17 ("Like Button Surveillance Program"). Facebook uses the Like button to track Facebook 18 members and non-members alike as they browse the Internet. Facebook then links its records of 19 each new page a user visits into Facebook's record of all the Like button pages that the user has 20 visited in the previous minutes, months, and years. The Like Button Surveillance Program 21 thereby records discrete bits of sensitive personal information deirved from users' visits to 22 particular websites and also obtains information sufficient to construct and update a long-term 23 profile based on the users' choice of website destinations over a prolonged peirod. 24 information is collected even if the website visitor does not click on the Like button, and 25 Internet users have no way 26 Comp1.1 14. Therefore, unless a person forgoes use of the Intenret altogether, the Like buttons, 27 and all they entail, are unavoidable. Id. atl 12. The of knowing in advance which websites contain Like buttons. 28 -1- 1 Facebook begins to collect information about an Internet user whether they are a 2 Facebook member or not—as soon as the Intenret user creates a Facebook account or simply 3 visits a page that contains a Like Button. Facebook's processes for tracking members and non- 4 members, and associating their browsing history with their personal identity and information, are 5 as follows: 6 (a) 7 8 9 10 11 12 13 Facebook Members: Upon registration, Facebook implants tracking devices (e.g., "cookies") on a member's computer. Each time the member visits a site displaying the Facebook Like button, the updated Facebook tracked information, including the member's most recent browsing history, is sent to Facebook. Facebook can then link the tracked information with the member's actual identity and the personally-sensitive information associated with the particular user's account and/or profile. This occurs regardless of whether the Facebook member clicks the Like button. If a Facebook member had visited a webpage (or several) with a Like button before becoming a Facebook member, all of her browsing history, before she became a Facebook 14 member, would also become associated with her account (and thus actual identity) at the time of 15 registration. 16 If a Facebook member deactivates her account through the process Facebook provides, 17 the entire account is nevertheless kept by Facebook, which can continue to link browsing data to 18 the Internet user's closed account (and thus actual identity) just as when the account was active. 19 If the member wishes to delete the account entirely, such that Facebook no longer has access to 20 his or her personal data, she must make a specific request to Facebook that takes two weeks to 21 process. Id. 22 (b) 1 15. Non-Facebook Members: Facebook implants tracking devices (e.g., cookies) on 23 the computers of non-Facebook members when the non-Facebook members visit one of the 24 million websites in the Facebook Connect network! Thereafter, Facebook's anonymous profile 25 of the non-members is updated each time a non-member visits a site displaying the Facebook 26 27 28 1 Facebook Connect enables Facebook members to log onto third-party websites, applications, mobile devices, and gaming systems with their Facebook identities. While logged on, users can connect with friends via these media and post information and updates to their Facebook profiles. Id. 13. 1 -2- Facebook thus tracks 1 "Like" button, even if the non-member does not click the "Like" button. 2 and collects extensive information about individuals who consciously choose not to become 3 Facebook members. Furthermore, if and when a non-member subsequently joins Facebook, 4 Facebook can associate the previously anonymous file with the member and her account 5 information, which includes, at a minimum, the member's name and address. And from that 6 time on, all subsequent requests for Facebook content are associated with the Facebook account 7 and, thus, the Facebook member's identity. Id. atl 15. Defendant's motion to dismiss is based on three arguments, each of which ignores salient 8 9 10 11 facts of this case. First, Defendant argues that Plaintiffs lack Article III standing because they have not alleged injury in fact. Defendant, however, violated Plaintiffs' inalienable right to pirvacy, as guaranteed by Article I, Section I of the California Constitution. Id. IN 1, 28-33. This is more than sufficient harm to confer Article III standing. Pt. I. 12 13 Second, Defendant argues that Plaintiffs have not alleged facts sufficient to establish a violation of the California constitutional right to privacy. This argument, however, cannot avoid 14 the fact that courts have held that far less egregious surveillance programs are unconstitutional. 15 Pt. ll. 16 Finally, Defendant argues that Plaintiffs' unjust enrichment claim should be dismissed 17 because California courts do not recognize unjust enirchment as an independent cause of action. 18 Defendant, however, acknowledges, as have courts in this Distirct, that litigants may seek 19 restitution using an unjust enrichment claim. Defendant then argues that, even if a restitution 20 claim were acknowledged, Plaintiffs have not alleged that they have suffered any detriment to a 21 property irght as a result of Defendant's unjust conduct. The cited precedent does not apply to 22 the circumstances of this case and, moreover, Plaintiffs have clearly alleged that Defendant's 23 conduct has caused Plaintiffs to lose money through the sale of Plaintiffs' personal information 24 to third parties without Plaintiffs' knowledge. Pt. III 25 26 27 In short, Plaintiffs have adequately pleaded that Facebook has stripped them of their constitutional irght to control the personal information they reveal about themselves and to whom they reveal it and that Facebook unjustly obtains and divulges personal and embarrassing 28 -3- 1 information to data aggregators for its own enirchment. Accordingly, Defendant's motion to 2 dismiss must be denied. ARGUMENT 3 4 I. PLAINTIFFS HAVE ESTABLISHED ARTICLE III STANDING Article III standing limits the subject matter juirsdiction of a federal court to cases or 5 controversies that are "justiciable"—i.e., capable of being appropirately decided by resolution of 6 the particular case or controversy before the court. 2 Defendant argues that Plaintiffs lack 7 standing in this case because Plaintiffs have not alleged harm that constitutes injury in fact, Def. 8 Mem. 8, but Plaintiffs have in fact alleged such harm. 9 To satisfy the standing requirements of Article III, a plaintiff must show that he has 10 suffered an "injury in fact" that is (a) concrete and particularized and (b) actual or imminent, not 11 conjectural or hypothetical. Gest v. Bradbury, 443 F.3d 1177, 1181 (9th Cir. 2006). "The injury 12 required by Article III can exist solely by virtue of 'statutes creating legal rights, the invasion of 13 which creates standing.'" Fulfillment Servs. Inc. v. UPS, Inc., 528 F.3d 614, 618-19 (9th Cir. 14 2008); Edwards v. First Am. Corp., 610 F.3d 514, 517 (9th Cir. 2010). In such cases, the 15 "'standing question . . . is whether the constitutional or statutory provision on which the claim 16 rests properly can be understood as granting persons in the plaintiff s position a right to judicial 17 relief. "' Edwards, 610 F.3d at 517 (citation omitted); see also In re Facebook Privacy Litig., No. 18 10-02389, --- F. Supp. 2d , 2011 WL 2039995, at *4 (N.D. Cal. May 12, 2011) (Ware, J.) 19 (holding that the plaintiffs had standing). 20 "Injury-in-fact is not Mount Everest." Danvers Motor Co. v. Ford Motor Co., 432 F.3d 21 286, 294 (3d Cir. 2005). To the contrary, it suffices for federal standing purposes to allege some 22 specific, "'identifiable trilfe'" of injury. Council of Ins. Agents & Brokers v. Molasky-Arman, 23 522 F.3d 925, 932 (9th Cir. 2008) (quoting United States v. Students Challenging Regulatory 24 Agency Procedures (SCRAP), 412 U.S. 669, 689 n.14 (1973)). The U.S. Supreme Court has 25 allowed important interests to be vindicated by plaintiffs with "no more at stake in the outcome 26 27 See 13A Charles Alan Wright, Arthur R. Miller, et al., Federal Practice and Procedure § 3531.4 (3d ed. 2011). 2 28 -4- 1 of an action than a fraction of a vote, a $5 fine and costs, and a $1.50 poll tax." Id. (internal 2 quotations omitted). "'The basic idea that comes out in numerous cases is that an identifiable 3 trifle is enough to ifght out a question of principle; 4 principle provides the motivation. '" Id. (emphasis added) (quoting SCRAP, 412 U.S. at 689 5 n.14). Here, where constitutionally-protected rights to privacy have been violated, Plaintiffs' 6 alleged injuires are certainly more than a "trilfe." Compl. TI 1, 28-33. the tirfle is the basis for standing and the 7 Because Plaintiffs can establish standing based on the alleged infringement of their 8 privacy rights under the California Constitution, Defendant's arguments regarding economic loss 9 are irrelevant. See Def. Mem. 10-11. Likewise, Defendant erroneously relies on precedent 10 addressing economic loss and personally-identifiable information. 11 DoubleClick Inc. Privacy Litig., 154 F. Supp. 2d 497, 525 (S.D.N.Y. 2001); LaCourt v. Specific 12 Media, Inc., No. 10-1256, 2011 WL 1661532, at *3-5 (C.D. Cal. Apr. 28, 2011)). As the court in 13 Specific Media specifically stated, the discussion in the DoubleClick case regarding economic 14 loss was "not in the context of evaluating Article III standing." 15 1661532, at *53 Furthermore, the Specific Media decision clearly rested on a deficiency of facts 16 in the complaint indicating that any named plaintiff was affected by the defendant's alleged 17 conduct. See Specific Media, 2011 WL 1661532, at *4. 4 In contrast, the named Plaintiffs here 18 have alleged sufficient facts to indicate they were affected by the defendant's alleged conduct, as 19 they have each alleged an invasion of a constitutional irght to pirvacy. Compl. IN 1, 28-33. See id. (citing In re Specific Media, 2011 WL 20 The recent Ninth Circuit case of Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 21 2010), is on point here. In Krottner, the plaintiffs alleged that defendant Starbucks had violated 22 23 24 25 26 27 28 3 Moreover, the portion of the decision in DoubleClick that Defendant cites discusses a claim by plaintiffs under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030 et seq., which imposes a $5,000 threshold. See DoubleClick, 154 F. Supp. 2d at 523-26 (finding that the plaintiffs had failed to allege facts that could support the inference that the damages and losses they incurred from the defendant's access to the plaintiffs' computers could meet § 1030(e)(8)(A)'s damage threshold). Here, Plaintiffs are not relying on the CFAA. 4 While noting the inadequacy of the plaintiffs' complaint, the Specific Media court did recognize the viability in the abstract of such concepts as "opportunity costs, " "value-for-value exchanges," " consumer choice," and other concepts referred to in the plaintiffs' opposition brief, and, therefore, the court allowed the plaintiffs to amend their complaint to allege facts related to such theories. 2011 WL 2473399, at *4; see also id. at *6. -5- 1 their pirvacy when the defendant failed to encrypt personal information regarding the plaintiffs 2 on a company laptop that was stolen from a Starbucks store. Id. at 1140. The defendant moved 3 to dismiss, arguing that the plaintiffs did not have Article III standing. The Ninth Circuit rejected 4 this argument, stating: "we hold that Plaintiffs-Appellants, whose personal information has been 5 stolen but not misused, have suffered an injury sufficient to confer standing under Article III, 6 Section 2 of the U.S. Constitution. " Id.; see also Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629, 7 634 (7th Cir. 2007) (reasoning that person who had his private information taken without 8 plaintiff s permission, but not misused, had standing under Article BI). 9 governing authority of Krottner, Plaintiffs clearly have Article III standing. 10 11 II. Hence, under the FACEBOOK VIOLATED THE RIGHT TO PRIVACY ARISING FROM CALIFORNIA'S STATE CONSTITUTION Try as it might, Facebook cannot get around the fact that its Like Button Surveillance 12 Program involves precisely the type of conduct proscribed by Article 1, Section 1 of the 13 California Constitution. 14 Article 1, Section 1 was amended on November 7, 1972, following a ballot initiative to 15 create an express right to privacy. The "Privacy Initiative"—i.e., the privacy amendment "is to 16 be interpreted and applied in a manner consistent with the probable intent of the body enacting it: 17 the voters of the State of California. " Hill v. NCAA, 7 Cal. 4th 1, 16 (1994). The intent of the 18 voters is clear: 19 20 21 22 23 24 The principal focus of the Privacy Initiative is readily discernable. The Ballot Argument warns of unnecessary information gathering, use, and dissemination by public and private entities -- images of "government snooping,"computer stored and generated "dossiers" and "`cradle-to-grave' profiles on every American" dominate the framers' appeal to the voters The evil addressed is ... business conduct in "collecting and stockpiling unnecessary information ... and misusing information ... " 25 Id. at 21 (quoting Ballot Pamp., Proposed Stats. and Amends. to Cal. Const. with arguments to 26 voters, Gen. Elec. (Nov. 7, 1972), at 26, 27). 27 28 This is exactly what Facebook's Like Button Surveillance Program does it uses the ubiquitous Like button to "collect and store sensitive, private, and personally identifiable -6- 1 information," Compl. 1 1, and "to track Internet users as they browse the web and thereby 2 collect[] private and, in some cases, sensitive information about them," id. 1 14. 3 California courts have held that a plaintiff must satisfy three elements to establish a 4 violation of the Privacy Initiative: "(1) a legally protected privacy interest; (2) a reasonable 5 expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious 6 invasion of privacy." Ruiz v. Gap, Inc., 380 F. App'x 689, 692 (9th Cir. 2010) (quoting Hill, 7 7 Cal. 4th at 26). As set forth herein, Plaintiffs satisfy each of these elements.5 8 A. 9 Plaintiffs Have a Legally Protected Privacy Interest in Their Personal Browsing History 1. 10 Plaintiffs Have a Legally Protected Interest in the Whole of Their Browsing History 11 Defendant asserts that Plaintiffs failed to allege a legally protected privacy interest 12 because "the Complaint does not allege that Facebook has either collected - or disclosed - any 13 such highly personal information from any of the Plaintiffs or that any of the Plaintiffs even have 14 such interests to protect." Def. Mem. 12 (emphasis in original). However, Plaintiffs have a 15 legally protected privacy interest in their browsing history regardless of whether they visited any 16 single web site from which sensitive information about them could be inferred. 17 The Supreme Court addressed this situation—in which the whole of the information 18 obtained is something different from the sum of its parts—in United States Department of Justice 19 v. Reporters Committee for Freedom of the Press, 489 U.S. 749 (1989).6 In upholding the FBI's 20 21 22 23 24 25 26 5 Legally recognized privacy interests are generally of two classes: (1) interests in precluding the dissemination or misuse of sensitive and confidential information (`informational privacy'); and (2) interests in making intimate personal decisions or conducting personal activities without observation, intrusion or interference (`autonomy privacy')." Hill, 7 Cal. 4th at 35. "Informational privacy is the core value furthered by the Privacy Initiative." Id. (citing White v. Davis, 13 Cal. 3d 757, 774 (1975)); see also Pettus v. Cole, 49 Cal. App. 4th 402, 440-41 (1996) (with regard to the protection afforded by the Privacy Initiative, "[t]he right to control circulation of personal information is fundamental." (internal citations omitted)). Facebook has also compromised Plaintiffs' privacy interests in "autonomy privacy" because tracking a person's use of the Internet to browse websites—often from the privacy of the person's home and, in almost all cases, outside of public view—is a form of "observation, intrusion or interference" in her decisions regarding which websites to visit. 44 6 27 28 See United States v. Maynard, 615 F.3d 544, 561 n.*[4] (D.C. Cir. 2010), cert. granted, U.S. v. Jones, No. 10-1259, 2011 WL 1456728 (June 27, 2011) ("The colloquialism that 'the whole is greater than the sum of its parts' is not quite correct. 'It is more correct to say that the whole is something different than the sum of its parts.' Kurt Koffa, Principles of Gestalt Psychology 176 -7- 1 invocation of the pirvacy exception of the Freedom of Information Act, the Court explained that 2 the appellant had a privacy interest in the whole of his rap sheet even though the individual 3 events in the summary were matters of public record. Id. at 764. The court in Maynard also 4 recognized a distinct privacy interest in the whole of collected information. 615 F.3d at 568 5 (holding that the prolonged GPS tracking of an individual without a warrant defeated his 6 expectation of privacy and violated the Fourth Amendment). The court noted that "[w]hen it 7 comes to pnvacy, . . . precedent suggests that the whole may be more revealing than the parts." 8 Id. at 561. The court explained its rationale as follows: 9 18 . . . Prolonged surveillance reveals types of information not revealed by short-term surveillance, such as what a person does repeatedly, what he does not do, and what he does ensemble. These types of information can each reveal more about a person than does any individual trip viewed in isolation. Repeated visits to a church, a gym, a bar, or a bookie tell a story not told by any single visit, as does one's not visiting any of these places over the course of a month. The sequence of a person's movements can reveal still more; a single tirp to a gynecologist's office tells little about a woman, but that trip followed a few weeks later by a visit to a baby supply store tells a different story. A person who knows all of another' s travels can deduce whether he is a weekly church goer, a heavy drinker, a regular at the gym, an unfaithful husband, an outpatient receiving medical treatment, an associate of particular individuals or political groups—and not just one such fact about a person, but all such facts. 19 Id. at 562 (emphasis added; footnote omitted). See also In re Historical Cell-Site Info., No. 10- 20 MC-897, 2011 WL 3678934, at *5 (E.D.N.Y. Aug. 22, 2011); People v. Weaver, 12 N.Y.3d 433, 21 442 (2009) (prolonged monitoring "yields . . . a highly detailed profile, not simply of where we 22 go, but by easy inference, of our associations - - political, religious, amicable and amorous, to 23 name only a few -- and of the pattern of our professional and avocational pursuits."); State v. 24 Jackson, 150 Wash. 2d 251, 262 (2003) (en banc) ("In this age, vehicles are used to take people 25 to a vast number of places that can reveal preferences, alignments, associations, personal ails and 10 11 12 13 14 15 16 17 26 27 28 (1935). That is what the Court was saying in Reporters Committee and what we mean to convey throughout this opinion."). -8- 1 foibles. The GPS tracking devices record all of these travels, and thus can provide a detailed 2 picture of one's life.").7 3 This case is no different. In this age, the Intenret takes people to a vast number of web 4 sites just as vehicles take them to a vast number of physical locations, and the Internet 5 destinations they choose are at least as revealing and in the same way. 8 Thus, "[r]epeated visits to 6 a church [website], a gym [website], a bar [website], or [an online] bookie tell a story not told by 7 any single visit, as does one's not visiting any of these [websites] over the course of a month", 8 and "[a] person who knows all of another's [web browsing history] can deduce whether he is a 9 weekly church goer, a heavy drinker, a regular at the gym, an unfaithful husband, an outpatient 10 receiving medical treatment, an associate of particular individuals or political groups—and not 11 just one such fact about a person, but all such facts." Maynard, 615 F.3d at 562. Likewise here, it 12 is the aggregation of information, the profile or dossier of an individual, created from that 13 person's web browsing history, in which there is a legally protected interest. Moreover, this is 14 precisely the type of "stockpiling" of information to create a personal "profile" or "dossier" that 15 the Privacy Initiative was specifically intended to prevent.9 16 7 17 18 19 20 21 22 23 24 25 26 27 28 Cf Cal. Penal Code § 637.7, Stats. 1998, c. 449 (S.B. 1667), §§ 1-2 (making it unlawful for anyone but a law enforcement agency to "use an electronic tracking device to determine the location or movement of a person" and specifically declairng that "electronic tracking of a person's location without that person's knowledge violates that person's reasonable expectation of privacy."). 8 If anything, surveillance of Internet "travel" is much more revealing than vehicle travel; Intenret travel is much speedier than vehicular travel and, therefore, surveillance of Intenret travel allows for the collection of much larger data sets in a much shorter time period. 9 Defendant might try to argue that the Ninth Circuit rejected this approach in United States v. Pineda–Moreno, 591 F.3d 1212 (9th Cir. 2010). But Pineda-Moreno is distinguishable in several important aspects. First, the travel that police tracked occurred "on public thoroughfares" and the GPS tracking data "could have [been] obtained by following the car. " The court held that, for this reason, a person "has no reasonable expectation of privacy in his movements from one place to another. " 591 F.3d at 1216. In contrast, Internet transmissions are not over public thoroughfares (but rather invisible or through cables buired deep underground), and a person's Internet browsing is not open to public view. Moreover, Intenret browsing often occurs on computers that are password protected for the very purpose of keeping Intenret search histoires secret. Second, the state had a substantial countervailing interest in the information collected—it was to be used to obtain a felony conviction on drug charges. In contrast, there is no such state interest (if any legitimate interest whatsoever) in Facebook's Like Button Surveillance Program Finally, the appellant in Pineda-Moreno did not squarely raise the issue of, and the Court did not perceive, a distinction between the pirvacy interest compromised by short-term surveillance on the one hand and long-term surveillance on the other. Consequently, it did not address the issue, -9- 1 2 2. Plaintiffs Adequately Alleged That Facebook Collected Sensitive Information from Them as a Result of Their Visits to Specific Websites 3 In any event, Plaintiffs adequately alleged having visited sites of a sensitive nature. The 4 Complaint alleges that Facebook tracks sensitive and personal information about, for example, 5 "[a]nyone who has used the Intenret to seek advice about hemorrhoids, sexually transmitted 6 diseases, abortion, drug rehabilitation, dementia. " Compl. 1 14. The full extent of personally 7 sensitive web pages that contain Like buttons is a fact question to be ascertained through 8 discovery (indeed, the Facebook Like button is pervasive, and Facebook exercises no control 9 over, and has no approval process for, the websites that contain Like buttons), but by way of 10 example, the websites for Jews for Jesus, the Tea Party, the John Birch Society, RevLetf - the 11 Home of the Revolutionary Left, Americans for Tax Reform, NORML (a drug law reform 12 group), Students for a Sensible Drug Policy, the Human Rights Commission's website promoting 13 gay rights, and Glenn Beck's home page are among the millions of websites that feature the 14 Facebook Like button. A visit to any of these websites will reveal, at the very least, Plaintiffs' 15 interest in potentially highly sensitive material. While Plaintiffs have indeed visited websites 16 regarding medical concerns, politics, and other sensitive topics, the specific websites were not 17 enumerated in the complaint for the same reason that it was a violation of California's 18 constitutional protections when Facebook tracked Plaintiffs' visits to those sites: Plaintiffs have a 19 legally protected pirvacy interest in that browsing history. 10 3. Plaintiffs Reasonably Expected That Their Internet Searches Would Remain Private 20 21 An Internet user does not expect Facebook to monitor and retain a record of his Internet 22 travel any more than he expects "anyone to monitor and retain a record of every time he drives 23 his car, including his origin, route, destination, and each place he stops and how longs he stays 24 25 26 27 28 present here, of whether appellant had a privacy interest that precluded prolonged as opposed to short-term surveillance. 10 Plaintiffs were required to plead their allegations in accordance with Fed. R. Civ. P. 8, which requires only "ashort and plain statement of the claim" to put Defendant on notice of the claims against it; Plaintiffs have done so. If Defendant's contentions were accepted as true, see Def. Mem. at 8, Plaintiffs would be held to a much higher, inapplicable pleading standard, that would require them to compromise the privacy irghts they have asserted. - 10 - 1 there," Maynard, 615 F.3d at 563 and contrary to Facebook's assertion, Def. Mem. 13, 2 Facebook's pirvacy policy provides no notice that this is what is going on. Instead, it simply 3 states that Facebook uses cookies "to make Facebook easier to use, to make our advertising 4 better, and to protect both you and Facebook" and "to know when you are interacting with 5 Facebook platform applications and websites, our widgets and Share buttons, and our 6 advertisements." Id. 7 Even if Facebook provided real or even constructive notice generally (which it does not), 8 such notice was wholly ineffective and meaningless with respect to any given website. The 9 millions of sites that host Like buttons all record a user's visit the moment she "arrives" at the 10 website, regardless of whether the user clicks on the Like button. Comp1.1 14. There is no 11 way Plaintiffs could have known in advance that the website they were about to visit had a Like 12 button tracking device, and that their visit to that site would be recorded and associated with 13 them and their other website visits. 11 Plaintiffs' only alternative to disclosing pirvate information 14 to Facebook, therefore, would be to avoid using the Internet altogether—a high price to pay in an 15 age in which many people consider the Intenret a utility that is no less necessary than electric or 16 phone service, and a price that Facebook has no irght to impose.12 17 Defendant argues with regard to the subclass of non-Facebook members, whom 18 Facebook cannot immediately identify, that "[a] person cannot be said to have a reasonable 19 expectation of pirvacy in anonymous data about the pages he or she has visited on the Internet, 20 particularly because data on the Intenret is routinely routed through the multiple third-party 21 22 23 24 25 26 27 28 11 For this reason, among others, Defendant's reliance on Hill and Holmes v. Petrovich Development Co., 191 Cal. App. 4th 1047, 1068 (2011), are inapt; in both of those cases, plaintiff had ample notice that the matter at issue was public. Hill, 7 Cal. 4th at 35-36; Holmes, 191 Cal. App. 4th at 1068-72. 12 Defendant's reliance on United States v. Forrester, 512 F.3d 500 (9th Cir. 2008), and People v. Stipo, 195 Cal. App. 4th 664 (2011), Def. Mem. 14 n.6, to establish that users of the Internet do not have a reasonable expectation of privacy for similar Internet activity, is misplaced because the Intenret activity in both cases was not at all similar. In Forrester, the issue was disclosure of email addresses, and in Stipo, disclosure of subscriber information. Neither case involved browsing history, and, indeed, Forrester recognized that a plaintiff has a reasonable expectation to privacy in the content of web searches. 512 F.3d at 510 n.6 (distinguishing between disclosure of the IP address of the Internet user, on the one hand, and URLs that reveal, e.g., the particular newspaper articles a person viewed, on the other hand). - 11 - 1 servers as anonymous data packets." Def. Mem. 14. But it cannot deny that an anonymous user's 2 identity, and dossier of associated information, will be correlated with the user's actual identity, 3 without notice, if she joins Facebook at a later date. The Complaint plainly alleges that, at the 4 time a non-member joins Facebook, "Facebook can associate the previously anonymous Tile' 5 with the member and his or her account information, which includes, at a minimum, the 6 members' names and addresses. " Comp1.1 15(c). Non-members have a reasonable expectation 7 that their search history is, and will remain, anonymous. 8 B. 9 Plaintiffs Allege Conduct by Defendant that Constitutes a Serious Invasion of Privacy Defendant tries to trivialize the effects of Facebook's invasion of privacy by suggesting 10 that it is nothing more than "routine commercial behavior" to secretly track Plaintiffs' "website 11 browsing history" and stockpile information about the Plaintiffs. Def. Mem. 14. But Facebook's 12 surveillance via the Like button—regardless of whether it is clicked or the Internet user is a 13 Facebook member—is a new technology the impact of which is untested. Therefore, the alleged 14 misconduct cannot be "routine commercial behavior" and will only become so if courts allow it 15 to continue. 13 And courts cannot permit such conduct because it is the very type of "seirous" 16 invasion of privacy that the Privacy Initiative was intended to prevent. Pt. WA)(1), supra. The 17 purpose and intent of privacy legislation make clear the seriousness of Facebook's misconduct. 18 For instance, the voters of California intended that the right to privacy protect "our freedom to 19 associate with the people we choose. " Official Ballot Pamphlet at 28. The Supreme Court has 20 also "recognized the vital relationship between freedom to associate and privacy in one's 21 associations. " NAACP v. Alabama, 357 U.S. 449, 462 (1958) ("Inviolability of privacy in group 22 13 23 24 25 26 27 28 It clearly is not routine commercial behavior in Germany. Indeed, Thilo Weichert, head of the office for data protection in the German state of Schleswig-Holstein, condemned the Facebook Like button, stating that it violates German and European privacy laws and called "on all institutions in the federal state of Schleswig-Holstein, Germany to shut down their fan pages on Facebook and remove social plug-ins such as the 'like' button from their websites." Unabhängiges Landeszentrum fur Datenschutz Schleswig-Holstein [The Data Protection Commissioner's Office (Independent Centre for Privacy Protection - ULD)], Press Release, ULD to website owners: "Deactivate Facebook web analytics" (Aug. 19, 2011), https://www.datenschutzzentrum.de/presse/20110819-facebook-en.htm . See also Jeff Jarvis, Buzz 2011), Machine, Disliking "Like" in Germany (Aug. 19, http://www.buzzmachine.com/2011/08/19/disliking-like-in-germany/. - 12 - 1 association may in many circumstances be indispensable to preservation of freedom of 2 association, particularly where a group espouses dissident beliefs." Id.). Here, Facebook is 3 stockpiling information connected to a web browsing history that discloses information about the 4 users' associations, including membership in, or an interest in, dissident groups—when Plaintiffs 5 and Class members have made no choice to reveal their associations to Facebook, and, in the 6 case of non-members, have made no choice to associate with Facebook itself. 7 III. PLAINTIFFS HAVE ALLEGED A CLAIM FOR UNJUST ENRICHMENT 8 Defendant asserts that Plaintiffs' unjust enrichment claim should be dismissed because 9 "there is no such independent cause of action in California." Def. Mem. 15. "[C]ourts have held 10 that unjust enrichment is equivalent to restitution and have allowed litigants to seek restitution 11 using an unjust enrichment claim. " SOAProjects, Inc. v. SCM Microsystems, Inc., No. 10-1773, 12 2010 WL 5069832, at *9 (N.D. Cal. Dec. 7, 2010) (Koh, J.) (internal citations omitted); see also 13 Matracia v. JP Morgan Chase Bank, NA, No. 11-190, 2011 WL 3319721, at *4 (E.D. Cal. Aug. 14 1, 2011) ("A party is required to make restitution if he or she is unjustly enirched at the expense 15 of another. A person is enirched if the person receives a benefit at another's expense." 16 (quotations and citations omitted)). "Given the appropirate facts . . . , a plaintiff advances a basis 17 for obtaining restitution if he or she demonstrates defendant's receipt and unjust retention of a 18 benefit. " Monet v. Chase Home Fin., LLC, No. 10-0135, 2010 WL 2486376, at *3 (N.D. Cal. 19 June 16, 2010). 20 In Monet, the court discussed three traditional factual scenairos where a theory of unjust 21 enrichment has historically supported a restitution remedy in California: (1) when the parties 22 have a contract that was procured by fraud or is for some reason unenforceable, giving irse to an 23 unjust enrichment claim as an altenrative to breach of contract damages; (2) when the plaintiff 24 cannot assert title or right to possession of particular property but nevertheless can show just 25 grounds for recoveirng money to pay for some benefit the defendant received from him, thus 26 implying a contract at law or a quasi-contract and giving rise to a right to restitution at law 27 through an action derived from the common-law writ of assumpsit; and (3) when money or 28 property identified as belonging in good conscience to the plaintiff could clearly be traced to - 13 - 1 particular funds or property in the defendant' s possession, giving rise to restitution in equity, 2 ordinarily in the form of a constructive trust or an equitable lien. Id. Plaintiffs' allegations most 3 clearly relate to the third scenairo. Specifically, Plaintiffs' personal information that Defendant 4 collected and stored, Comp1.1 35, is property that belongs to Plaintiffs. See infra. In addition, the 5 money allegedly obtained by Defendant from sales of that information to third parties, 6 Comp1.1 35, is clearly money that can be traced to that property. 7 Defendant argues that Plaintiffs have not suffered any detirment to Facebook's benefit 8 because "Plaintiffs [do not] have property rights in their personal information that would be 9 harmed had Facebook collected that information." Def. Mem. 16. This argument is 10 unpersuasive. Plaintiffs have alleged that Defendant has done more than merely collect personal 11 information; Plaintiffs have alleged that Defendant sold that information to third parties without 12 Plaintiffs' knowledge. Compl. 35. 14 13 Moreover, the cited precedent is not as supportive as it may seem. The Facebook 14 Privacy opinion Defendant relies upon in tunr relied on Thompson v. Home Depot, Inc., No. 07- 15 1058, 2007 WL 2746603 (S.D. Cal. Sept. 18, 2007). In Thompson, the plaintiff alleged he was 16 required to fill out a form that prompted him to provide personal identification, but he did not 17 allege that "filling out the form caused him to lose any money or property." Id. at *3. Similarly, 18 the plaintiffs in the Facebook Privacy case did not allege that they lost money as a result of the 19 defendant's conduct. 2011 WL 2039995, at *6. Here, Plaintiffs have alleged that Defendant' s 20 conduct caused Plaintiffs to lose money. Compl. (1[ 35 ("Facebook has received and retained 21 money belonging to Plaintiffs and the Class." (emphasis added)). Additionally, the dismissals of 22 the plaintiffs' unjust enrichment claims in the Facebook Privacy case and the Thompson case 23 rested on the failure of the plaintiffs to provide any support for the contention that personal 24 information constitutes valuable property. See Thompson, 2007 WL 2746603, at *3; 15 Facebook 25 26 27 28 14 In its later argument that "Plaintiffs also fail to plead that Facebook' s alleged collection of their browsing histoires was unjust," Defendant makes the same error of omitting Plaintiff s allegations of selling Plaintiffs' information. Def. Mem. 16. 15 The Thompson court, in tunr, cited In re Jetblue Airways Corp. Privacy Litig., 379 F. Supp. 2d 299, 327 (E.D.N.Y. 2005) ("There is . . . no support for the proposition that an individual - 14 - 1 Privacy Litig., 2011 WL 2039995, at *10 n.10. In contrast, Plaintiffs in this case have provided 2 several sources of scholarly and governmental research discussing the economic value of 3 Plaintiffs' personal information. See Compl. 4 alleged that their personal information is a valuable commodity that was sold by Defendant to 5 the financial detriment of Plaintiffs. 6 16-18. As a result, Plaintiffs have sufficiently Last, Defendant is incorrect that Plaintiffs have not pleaded that Defendant's conduct was 7 unjust. Def. Mem. 16-17. It is patently unjust to use very private and sensitive information of 8 consumers to make profits without the consumers' knowledge that this private information is 9 being disseminated to complete strangers, and Plaintiffs have adequately pleaded this. See, e.g., 10 Compl. 11 DATED: 1, 14, 32, 35. 16 September 1, 2011 Respectfully Submitted, 12 MILBERG LLP /s/ Anne Marie Vu 13 Sanford P. Dumain Peter E. Seidman Melissa Ryan Clark Charles Slidders MILBERG LLP One Pennsylvania Plaza New York, NY 10119 Telephone: (212) 594-5300 (212) 868-1229 Facsimile: 14 15 16 17 18 19 Michael R. Reese Kim Richman REESE RICHMAN LLP 875 Avenue of the Americas New York, NY 10001 Telephone: (212) 579-4625 Facsimile: (212) 253-4272 20 21 22 23 24 Attorneys for Plaintiffs 25 26 27 28 passenger's personal information has or had any compensable value in the economy at large." (emphasis added)). 16 Should this Court dismiss any give[n] part of Plaintiffs' case, Plaintiffs respectfully request leave to amend, which should be "freely give[n]" pursuant to Fed. R. Civ. P. 15. - 15 -

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.

Why Is My Information Online?