In Re FACEBOOK INTERNET TRACKING LITIGATION
Filing
104
Administrative Motion to File Under Seal filed by Perrin Aikens Davis, Brian K. Lentz, Cynthia D. Quinn, Matthew J. Vickery. (Attachments: #1 Proposed Order, #2 Declaration of David A. Straite, #3 Exhibit 1: Memorandum in Opposition to Motion to Dismiss (Redacted Version), #4 Exhibit 2: Memorandum in Opposition to Motion to Dismiss (Unredacted Version) - FILED UNDER SEAL)(Straite, David) (Filed on 2/18/2016)
EXHIBIT 1
TO
DECLARATION OF
DAVID A. STRAITE
1
2
3
4
5
Stephen G. Grygiel (admitted pro hac vice)
SILVERMAN THOMPSON
SLUTKIN WHITE LLC
201 N. Charles Street, 26TH Floor
Baltimore, MD 21201
Tel.: (410) 385-2225
Fax: (410) 547-2432
sgrygiel@mdattorney.com
6
Frederic S. Fox (admitted pro hac vice)
David A. Straite (admitted pro hac vice)
KAPLAN FOX & KILSHEIMER LLP
850 Third Avenue, 14th Floor
New York, NY 10022
Tel.: (212) 687-1980
Fax: (212) 687-7714
dstraite@kaplanfox.com
Laurence D. King (206423)
Mario Choi (243409)
KAPLAN FOX & KILSHEIMER LLP
350 Sansome Street, 4th Floor
San Francisco, CA 94104
Tel.: (415) 772-4700
Fax: (415) 772-4707
lking@kaplanfox.com
7
8
9
10
11
12
13
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
SAN JOSE DIVISION
14
No. 5:12-md-02314-EJD
15
16
17
18
19
20
21
IN RE: FACEBOOK, INC. INTERNET
TRACKING LITIGATION
PLAINTIFFS’ MEMORANDUM OF POINTS
AND AUTHORITIES IN OPPOSITION TO
FACEBOOK’S MOTION TO DISMISS
Date:
Time:
Place:
Judge:
April 28, 2016
9:00am
Courtroom 4
Hon. Edward J. Davila
22
23
24
REDACTED PUBLIC VERSION
25
26
27
28
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
TABLE OF CONTENTS
1
2
I.
INTRODUCTION ............................................................................................................................. 1
3
II.
FACTUAL AND PROCEDURAL BACKGROUND....................................................................... 1
4
III. LEGAL STANDARDS ..................................................................................................................... 3
5
A. Pleading Standards ....................................................................................................................... 3
6
B. Collateral Estoppel ....................................................................................................................... 3
7
IV. ARGUMENT ..................................................................................................................................... 4
8
A. Plaintiffs Have Article III Standing ............................................................................................. 4
9
10
1. Standing May Exist Solely by Virtue of Statutes .................................................................. 4
11
2. Viable State-Law Claims are a Basis for Standing ................................................................ 4
12
3. Plaintiffs Have Pled Actual Injury to Them .......................................................................... 7
13
4. In the Alternative, Standing Should Be Resolved at a Later Stage ....................................... 9
14
B. Plaintiffs Have Adequately Pled Federal Claims Under the ECPA ............................................ 9
15
1. Specificity of Pleadings ......................................................................................................... 9
16
2. The Wiretap Act ................................................................................................................... 10
17
3. The Stored Communications Act ......................................................................................... 18
18
19
C. Plaintiffs Have Adequately Pled California Law Claims .......................................................... 22
20
1. The California Invasion of Privacy Act (“CIPA”) ............................................................... 22
21
2. Invasion of Privacy and Intrusion Upon Seclusion.............................................................. 24
22
3. California Statutory Larceny................................................................................................ 28
23
4. Breach of Contract and Implied Covenant of Good Faith and Fair Dealing ....................... 30
24
5. California Penal Code 502 ................................................................................................... 33
25
6. Fraud .................................................................................................................................... 34
26
7. Trespass to Chattels ............................................................................................................. 38
27
28
V.
CONCLUSION ................................................................................................................................ 40
i
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
TABLE OF AUTHORITIES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
Cases
Alliance Mortgage Co. v. Rothwell,
10 Cal. 4th 1226 (1995) ......................................................................................................................... 37
Amchem Prods., Inc. v. Windsor,
521 U.S. 591 (1997) ................................................................................................................................ 9
Anthony v. Yahoo, Inc.,
421 F. Supp. 2d 1257 (N.D. Cal. 2006) ................................................................................................ 36
Ashcoft v. Iqbal,
556 U.S. 662 (2009) ............................................................................................................................ 3, 8
Atl. Recording Corp. v. Serrano,
2007 WL 46128921 (S.D. Cal. Dec. 28, 2007)..................................................................................... 40
Baker v. Aubry,
216 Cal.App.3d 1259 (1989) ................................................................................................................ 31
Barnes & Noble, Inc. v. LSI Corp.,
849 F. Supp. 2d 925 (N.D. Cal. 2012) .................................................................................................. 37
Bell Atlantic Corp. v. Twombly,
550 U.S. 544 (2007) ................................................................................................................................ 3
Bennett-wofford v. Bayview Loan Servicing, LLC,
2015 WL 8527333 (N.D. Cal. Dec. 11, 2015) ...................................................................................... 32
18
19
20
21
22
23
24
Brodheim v. Cry,
584 F.3d 1262 (9th Cir. 2009) ................................................................................................................ 3
Brown v. Waddell,
50 F.3d 285 (4th Cir. 1995) ................................................................................................................... 12
Campbell v. Facebook, Inc.,
77 F. Supp. 3d 836 (N.D. Cal. 2014) .................................................................................................... 32
Cantrell v. City of Long Beach,
241 F.3d 674 (9th Cir. 2001) ................................................................................................................... 5
25
26
27
28
Careau & Co. v. Security Pacific Business Credit, Inc.,
22 Cal. App.3d 1371 (1990) ................................................................................................................. 33
Chan v. Drexel Burnham Lambert, Inc.,
178 Cal.App.3d 632 (1986) .................................................................................................................. 31
ii
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
2
3
4
5
6
Chance v. Avenue A,
165 F.Supp.2d 1153 (W.D. Wash. 2001) .............................................................................................. 19
Clear Solutions, Inc. v. Clear Channel Comm.,
365 F. 3d 835 (9th Cir. 2004) ................................................................................................................ 37
Cohen v. Facebook, Inc.,
798 F. Supp. 2d 1090 (N.D. Cal. 2011) ................................................................................................ 32
Coupons, Inc. v. Stottlemire,
2008 WL 3245006 (N.D. Cal. July 2, 2008) ......................................................................................... 40
7
8
9
10
11
12
13
Craigslist Inc. v. 3Taps Inc.,
942 F. Supp. 2d 962 (N.D. Cal. 2013) .................................................................................................. 39
Crispin v. Audigier,
717 F.Supp.2d 965 (C.D. Cal. 2010) .................................................................................................... 19
Crowley v. Cybersource Corp.,
166 F.Supp.2d 1263 (N.D. Cal. 2001) ............................................................................................ 14, 16
CTC Real Estate Services v. Lepe,
140 Cal.App.4th 856 (App. 2 Dist. 2006) ............................................................................................. 28
14
15
16
17
18
19
20
eBay, Inc. v. Bidder’s Edge, Inc.,
100 F. Supp. 2d 1058 (N.D. Cal. 2000) ................................................................................................ 39
Edwards v. First American Corp.,
610 F.3d 514 (9th Cir. 2010) .................................................................................................................. 4
Ehling v. Monmouth,
961 F.Supp.2d 659 (D. N.J. 2013) ........................................................................................................ 19
Engalla v. Permanente,
15 Cal. 4th 951 (1997) ........................................................................................................................... 35
21
22
23
24
25
26
27
Erickson v. Pardus,
551 U.S. 89 (2007) .................................................................................................................................. 8
Erie Railroad Co. v. Tompkins,
304 U.S. 64 (1938) .................................................................................................................................. 5
Flanagan v. Flanagan,
27 Cal. 4th 766 (2002) ........................................................................................................................... 23
FMC Corp. v. Boesky,
852 F.2d 981 (7th Cir. 1988) ................................................................................................................... 5
28
iii
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
2
3
4
5
6
Freedman v. AOL,
325 F.Supp.2d 638 (E.D. Va. 2004) ..................................................................................................... 19
Gonsalves v. Hodgson,
38 Cal.2d 91 (Cal. 1951) ....................................................................................................................... 35
Guaranty Trust Co. v. York,
326 U.S. 99 (1945) .................................................................................................................................. 5
Harris v. Garcia,
734 F.Supp.2d 973 (N.D. Cal. 2010) .................................................................................................... 30
7
8
9
10
11
12
13
Heinrichs v. Valley View Development,
474 F.3d 609 (9th Cir. 2007) .................................................................................................................. 3
Heldt v. Tata Consultancy Servs., Ltd.,
2015 WL 5542303 (N. D. Cal. Sep. 18, 2015) ..................................................................................... 10
Hernandez v. Hillsides, Inc.,
47 Cal. 4th 272 (Cal. 2009) ................................................................................................................... 28
Hill v. NCAA,
7 Cal.4th 1 (1994) .................................................................................................................................. 24
14
15
16
17
18
19
20
House of Stuart, Inc. v. Whirlpool Corp.,
33 F. 3d 58 (9th Cir. 1994) .................................................................................................................... 37
In re Anthem, Inc. Data Breach Litig.,
5:15-MD-2617-LHK, Order on Motion to Dismiss, Slip Op. (N.D. Cal. Feb. 14, 2016) .................. 7, 9
In re Application for Pen Register,
396 F.Supp.2d 45 (D. Mass. 2005) ................................................................................................. 13, 23
In re Application for Telephone Information,
2015 WL 4594558 (N.D. Cal., July 29, 2015) ...................................................................................... 26
21
22
23
24
25
26
27
In re Carrier IQ, Inc., Consumer Privacy Litig.,
78 F. Supp. 3d 1051 (N.D. Cal. 2015) ........................................................................................ 9, 14, 18
In re Clorox Consumer Litig.,
894 F. Supp. 2d 1224 (N.D. Cal. Aug. 24, 2012) ................................................................................. 36
In re Facebook Internet Tracking Litigation,
2015 WL 6438744 (N.D. Cal. Oct. 23, 2015)................................................................................ passim
In re Facebook Privacy Litigation,
791 F. Supp. 2d 705 (N.D. Cal. 2011) .................................................................................................. 32
28
iv
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
2
3
4
5
6
In re Facebook Privacy Litigation,
572 Fed.Appx. 494 (9th Cir. 2014) .............................................................................................. 7, 32, 37
In re Google Android Consumer Privacy Litig.,
2013 WL 1283236 (N.D. Cal. Mar. 26, 2013) ...................................................................................... 33
In re Google Inc. Cookie Placement Consumer Privacy Litig.,
806 F.3d 125 (3d Cir. Nov. 10, 2015 as amended Nov. 12, 2015) ................................................ passim
In re Google Inc. Gmail Litig.,
2013 WL 5423918 (N.D. Cal. Sep. 26, 2013) .......................................................................... 17, 18, 24
7
8
9
10
11
12
13
In re Google, Inc. Privacy Policy Litig.,
2013 WL 6248499 (N.D. Cal., Dec. 3, 2013) ....................................................................................... 18
In re iPhone Application Litigation,
2011 WL 4403963 (N.D. Cal. Sept. 20, 2011) ..................................................................................... 39
In re Target Corp. Data Sec. Breach Litig.,
66 F. Supp. 3d 1154 (D. Minn. 2014) ..................................................................................................... 9
In re Zynga Privacy Litig.,
2011 WL 7479170 (N.D. Cal. June 15, 2011) ...................................................................................... 28
14
15
16
17
18
19
20
In re Zynga Privacy Litigation,
750 F.3d 1098 (9th Cir. 2014) ............................................................................................................... 11
Intel Corp. v. Hamidi,
30 Cal. 4th 1342 (2003) .................................................................................................................. 39, 40
Interserve, Inc. v. Fusion Garage PTE, Ltd.,
2011 WL 500497 (N.D. Cal. Feb. 9, 2011) .................................................................................... 36, 37
Kewanee Oil v. Bicron,
416 U.S. 470 (1974) .............................................................................................................................. 27
21
22
23
24
25
26
27
King v. Larsen Realty, Inc.,
121 Cal.Ap.3d 349 (1981) .................................................................................................................... 31
Kirch v. Embarq,
702 F.3d 1245 (10th Cir. 2012) ............................................................................................................. 17
Konop v. Hawaiian Airlines, Inc.,
302 F.3d 868 (9th Cir. 2002) ................................................................................................................. 13
LaCourt v. Specific Media, Inc.,
2011 WL 1661532 (C.D. Cal. Apr. 28, 2011) ...................................................................................... 39
28
v
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
2
3
4
5
6
Landers v. Quality Communications, Inc.,
771 F. 3d 638 (9th Cir. 2015) .................................................................................................................. 8
Los Coyotes Band of Cahuilla and Cupeno Indians v. Jewell,
729 F. 3d 1025 (9th Cir. 2013) .............................................................................................................. 20
Love v. United States,
915 F.2d 1242 (9th Cir. 1988) ................................................................................................................. 3
Low v. LinkedIn Corp.,
900 F.Supp.2d 1010 (N.D. Cal. 2012) .................................................................................................. 28
7
8
9
10
11
12
13
Mendiondo v. Centinela Hosp. Med. Center,
521 F.3d 1097 (9th Cir. 2008) ................................................................................................................. 3
Microsoft v. Does 1-8,
14-cv-00811-LO-IDD (E.D. Va. July 20, 2015) ................................................................................... 19
Miller v. National Broadcasting Co.,
187 Cal.App.3d 1463 (Ct. App. 1986) .................................................................................................. 28
Moncada v. West Coast Quartz Corp.,
221 Cal. App. 4th 768 (2013) ................................................................................................................ 37
14
15
16
17
18
19
20
Murray v. Alaska Airlines, Inc.,
50 Cal. 4th 860 (2010) .......................................................................................................................... 25
Mycogen Corp. v. Monsanto Co.,
28 Cal. 4th 888 (2002) ............................................................................................................................ 3
Nat’l Council of La Raza v. Cegavske,
800 F. 3d 1032 (9th Cir. 2015) ................................................................................................................ 8
Obama v. Klayman,
800 F.3d 559 (D.C. Cir. 2015) ................................................................................................................ 8
21
22
23
24
25
26
27
Opperman v. Path,
87 F.Supp.3d 1018 (N.D. Cal. 2014) .................................................................................. 18, 26, 28, 34
Palomar Mobilehome v. San Marcos,
989 F.2d 362 (9th Cir. 1993) .................................................................................................................. 3
People v. Gopal,
171 Cal.App.3d 524 (App. 1 Dist. 1985) .............................................................................................. 29
People v. Kwok,
63 Cal.App.4th 1236 (App. 1 Dist. 1998) ............................................................................................. 29
28
vi
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
2
3
4
5
6
People v. Nakai,
183 Cal. App. 4th 499 (Cal. App. 2010) ................................................................................................ 24
People v. Norwood,
26 Cal.App.3d 148 (App. 2 Dist. 1972) ................................................................................................ 28
People v. Wooten,
44 Cal.App.4th 1834 (1996) ................................................................................................................. 30
Potter v. Havlicek,
2008 WL 2556723 (S.D. Ohio June 23, 2008) ..................................................................................... 15
7
8
9
10
11
12
13
Quon v. Arch Wireless,
529 F.3d 892 (9th Cir. 2008) ................................................................................................................. 19
Reno v. ACLU,
521 U.S. 844 (1997) .............................................................................................................................. 11
Rhodes v. Graham,
37 S.W.2d 46 (Ky. App. 1931) ............................................................................................................... 6
Riley v. California,
134 S.Ct. 2473 (2014) ............................................................................................................... 19, 25, 28
14
15
16
17
18
19
20
San Remo Hotel v. San Francisco,
545 U.S. 323 (2005) ................................................................................................................................ 3
Scott v. Kuhlmann,
746 F.2d 1377 (9th Cir. 1984) ............................................................................................................... 17
Segan LLC v. Zynga,
2015 WL 5315945 (N.D. Cal. Sept. 10, 2015) ..................................................................................... 21
Shefts v. Petrakis,
2012 WL 4049484 (C.D. Ill. Sep. 13, 2012)......................................................................................... 17
21
22
23
24
25
26
27
Shulman v. Group W. Productions, Inc.,
18 Cal. 4th 200 (1998) ..................................................................................................................... 26, 27
Sierra Club v. Morton,
405 U.S. 727 (1972) ................................................................................................................................ 5
Starr v. Baca,
652 F. 3d 1202 (9th Cir. 2011) .......................................................................................................... 8, 10
Taus v. Loftus,
151 P.3d 1185 (Cal. 2007) .................................................................................................................... 27
28
vii
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
2
3
4
5
6
Theofel v. Farey-Jones,
359 F.3d 1066 (9th Cir. 2004) ............................................................................................................... 21
U.S. Telecom Ass’n v. FCC,
227 F.3d 450 (D.C. Cir. 2000) .............................................................................................................. 12
U.S. v. Councilman,
245 F.Supp.2d 319 (D. Mass. 2013) ..................................................................................................... 20
U.S. v. Councilman,
418 F.3d 67 (1st Cir. 2005) ........................................................................................................ 13, 19, 20
7
8
9
10
11
12
13
U.S. v. Forrester,
512 F.3d 500 (9th Cir. 2008) ........................................................................................................... 13, 23
U.S. v. Szymuskiewicz,
622 F.3d 701 (8th Cir. 2010) ........................................................................................................... 13, 16
Ung v. Facebook, Inc.,
No. 12-CV-217244, Order (Cal Super. Ct. Santa Clara Cnty July 2, 2012) ..................................... 6, 24
United States v. Jones,
132 S.Ct. 945 (2012) ....................................................................................................................... 25, 28
14
15
16
17
18
19
20
United States v. Matlock,
415 U.S. 164 (1974) .............................................................................................................................. 20
Veleron Holding, B.V. v. Morgan Stanley,
2015 WL 4503580 (S.D.N.Y. July 23, 2015) ......................................................................................... 5
Walker v. B&G Foods, Inc.,
2016 WL 463253 (N.D. Cal. Feb. 8, 2016) .......................................................................................... 10
Walling v. Beverly Enters.,
476 F. 2d 393 (9th Cir. 1973) ................................................................................................................ 10
21
22
Warth v. Seldin,
422 U.S. 490 (1975) ................................................................................................................................ 4
23
24
Statutes
25
26
18 U.S.C. § 1030(2)(B) ............................................................................................................................. 27
27
18 U.S.C. § 2501(4) .................................................................................................................................. 13
28
18 U.S.C. § 2510(12) ................................................................................................................................ 11
viii
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
18 U.S.C. § 2510(4) .................................................................................................................................. 14
2
18 U.S.C. § 2510(5) ............................................................................................................................ 14, 17
3
18 U.S.C. § 2510(8) ............................................................................................................................ 10, 14
4
18 U.S.C. § 2511(4)(a).............................................................................................................................. 27
5
18 U.S.C. § 2701(b) .................................................................................................................................. 27
6
18 U.S.C. 2701(a) ..................................................................................................................................... 18
7
28 U.S.C. § 1738 ......................................................................................................................................... 3
8
9
Cal. Civil Code § 654................................................................................................................................ 29
10
Cal. Crim. Code § 630 .............................................................................................................................. 27
11
Cal. Crim. Code § 631 ........................................................................................................................ 22, 27
12
Cal. Crim. Code § 632 ........................................................................................................................ 23, 27
13
Cal. Penal Code § 484 ............................................................................................................................... 27
14
15
Cal. Penal Code § 484(a) .......................................................................................................................... 28
Cal. Penal Code § 496 ............................................................................................................................... 27
16
17
18
Cal. Penal Code § 496(c) .......................................................................................................................... 28
Cal. Penal Code § 499c(b)(3).................................................................................................................... 29
19
Cal. Penal Code § 502 ..................................................................................................................... 4, 33, 37
20
Cal. Penal Code § 502(c)(2)...................................................................................................................... 29
21
Cal. Penal Code § 530.5 ............................................................................................................................ 28
22
Cal. Penal Code § 530.55(b) ..................................................................................................................... 29
23
Cal. Penal Code § 637.2(c) ......................................................................................................................... 4
24
Cal. Penal Code 502(b)(10) ...................................................................................................................... 34
25
26
Cal. Penal Code 502(c) ................................................................................................................. 29, 33, 34
27
Cal. Penal Code 502(e)(1)......................................................................................................................... 33
28
Cal. Penal Code. § 496(a) ......................................................................................................................... 30
ix
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
Other Authorities
2
House of Representatives Report 107-236 (Oct. 11, 2001) ...................................................................... 13
3
Prosser & Keeton, Torts (5th ed. 1984) .................................................................................................... 40
4
Senate Report 109-14 (Feb. 28, 2005) ........................................................................................................ 6
5
Senate Report 99-541 (Oct. 17, 1986) ................................................................................................ 12, 21
6
Wright & Miller, Federal Practice and Procedure, § 1277 ....................................................................... 18
7
8
9
Rules
10
Fed. R. Civ. P. 8(a) ................................................................................................................................. 3, 9
11
Fed. R. Civ. P. 9(b) ................................................................................................................................... 36
12
Rule 12(b)(6)......................................................................................................................................... 3, 17
13
Rule 8(a)...................................................................................................................................................... 8
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
x
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
I.
2
INTRODUCTION
Defendant Facebook, Inc.’s (“Facebook”) Motion to Dismiss (the “Motion”) the Second
3
Amended Complaint (the “SAC”), asks this Court to deny recourse for millions of Americans whose
4
privacy Facebook repeatedly and profoundly violated through the unauthorized and secret tracking of
5
their web browsing. Ignoring recent case law and new facts in the SAC, Facebook’s motion is primarily
6
built on two false premises. First, Facebook argues its misappropriation of billions of URLs and other
7
personal data is not “injury in fact” for Article III standing. Second, Facebook argues URLs
8
categorically do not contain “contents,” the interception of which violates federal and state wiretap laws.
9
Remarkably, Facebook’s Motion ignores the recent landmark opinion in In re Google Inc.
10
Cookie Placement Consumer Privacy Litig., 806 F.3d 125 (3d Cir. Nov. 10, 2015 as amended Nov. 12,
11
2015) (“Google Cookie Placement”). This Court’s order dismissing plaintiffs’ First Amended
12
Complaint relied on the lower court decision in Google Cookie Placement, and described the facts as
13
“virtually indistinguishable.” In re Facebook Internet Tracking Litigation, 2015 WL 6438744 at *6
14
(N.D. Cal. Oct. 23, 2015) (the “Order”). Facebook brought the district court’s original opinion in
15
Google Cookie Placement to this Court’s attention in a Statement of Recent Decisions dated October 10,
16
2013 [ECF No. 69]. Three weeks after the Order, however, the Third Circuit reversed the district court
17
on the standing and contents issues on which Facebook relies.
18
Facebook also argues that users have no reasonable expectation of privacy in a URL. But
19
Facebook ignores the SAC’s focus on the aggregation of web browsing history, and then brushes aside
20
as “dicta” a recent unanimous Supreme Court decision finding a privacy interest in aggregated URLs.
21
Facebook also relegates to a footnote a California state court decision against Facebook on identical
22
facts (Exhibit HH to SAC), finding a privacy interest in aggregate web browsing history.
23
Finally Facebook complains that the SAC does not identify precisely which websites were
24
visited. Facebook does not mention, however, that Facebook has that information for each plaintiff but
25
has refused to produce it.
26
II.
27
28
FACTUAL AND PROCEDURAL BACKGROUND
Plaintiffs filed the first amended complaint on May 23, 2012 [ECF No. 35] (the “FAC”). This
Court granted Facebook’s motion to dismiss all counts on October 23, 2015 with leave to re-plead. See
1
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
Order, 201 5 WL 6438744. Plaintiffs filed the SAC on N ovember 30, 2015. Defendants moved to
2
dismiss on Janmuy 14, 201 6 [ECF No. 94] (th e "Motion"). Accompanying this opposition is the
3
Declaration of Stephen Gtygiel dated Feb. 18, 201 6 ("Gtygiel Decl.") providing referenced exhibits.
4
Other documents accompanying the SAC as exhibits ar e designated "SAC Ex . - ".
5
6
The SAC differs fr om the F AC in several ways. First, fom counts have been dropped and fom
have been added:
7
Claim
8
Violation of t he Federal W iret ap Act
Violation of t he Federal Stored Com munications Act
Violation of t he Federal Computer Fraud and Abuse Act
Invasion of Privacy
9
10
11
13
14
15
California Consumer Lega l Remedies Act
Breach of Contract
Breach of Duty of Good Fait h and Fair Dealing
Civil Fraud
California Statutory Larceny
16
17
19
20
21
22
23
Count I
Count II
Count Ill
Count IV
Count V
Count VI
Count VII
Count VIII
Count IX
Count X
Count XI
[not asserted]
[not asserted]
[not asserted]
[not asserted]
Intrusion upon Seclusion
Conversion
Trespass t o Chattels
California Unfair Competit ion Law ("UCL")
California Penal Code§ 502 (com put er crime law)
California Invasion of Privacy Act ("CIPA")
12
18
First Amended
Complaint
Second Amended
Complaint
Count I
Count II
[dropped]
Count IV
Count V
[dropped]
Count IX
[dropped]
Count X
Count Ill
[dropped]
Count VI
Count VII
Count VIII
Count XI
Second, the SAC outlines litigation in the United States and Emope regar ding privacy claims arising
from Facebook 's u·acking of intemet search histories.
SAC ~~
146-71. Third, the SAC adds facts
supporting a serious invasion of privacy resulting fr om Facebook 's intemet u·acking, with a focus on the
aggregation of intem et connmmications and personal data. Fomi h, the SAC discusses a greater number
of cookies Facebook used to u·ack users post-logout, including the a_user, c_user, datr, lu, fr and
-
cookies. Fifth, the SAC cites discove1 documents coJltu1lllng
y
24
25
26
27
•
and
. Sixth, the SAC specifically pleads that each named plaintiff actually visited websites with
Facebook "Like" buttons while logged out dming the class period, that intercepted UR.Ls containing
detailed file-paths beyond simple IP addresses, an d more fully pleads Facebook 's business practice of
28
2
PLAINTIFFS' OPPOSITION TO FACEBOOK'S MOTION TO DISMISS
CONSOLIDATED CASE NO. : 5:12-MD-023 14-EJD
1
tracking all visits to such pages. Finally, the SAC asserts claims specifically on behalf of a subclass of
2
users of Microsoft Internet Explorer (the “IE Subclass”).
3
III.
LEGAL STANDARDS
4
A.
5
Facebook agrees that all but three (fraud, statutory larceny and § 502) of the SAC’s counts are
Pleading Standards
6
governed by the notice pleading standards of Fed. R. Civ. P. 8(a). Motion at 7. Plaintiffs’ factual
7
allegations need only be detailed enough to “raise a reasonable expectation that discovery will reveal
8
evidence” of the illegality alleged. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555-56 (2007).
9
Dismissal at the pleading stage is only appropriate “where the complaint lacks a cognizable legal theory
10
or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Center,
11
521 F.3d 1097, 1104 (9th Cir. 2008).
For Rule 12(b)(6) purposes, the Court must accept as true all the SAC’s well-pleaded factual
12
13
allegations. Ashcoft v. Iqbal, 556 U.S. 662, 664 (2009). The Court must construe those facts and draw
14
all inferences in the manner most favorable to the plaintiff. Love v. United States, 915 F.2d 1242, 1245
15
(9th Cir. 1988). Nevertheless, Facebook improperly bases several of its arguments on facts materially
16
differing from those in the SAC, and these are noted below where appropriate.1
17
B.
18
Under 28 U.S.C. § 1738, federal courts give full faith and credit to state court judgments. San
19
Remo Hotel v. San Francisco, 545 U.S. 323, 336 (2005); Brodheim v. Cry, 584 F.3d 1262, 1268 (9th
20
Cir. 2009). To determine the preclusive effect of a state court judgment, federal courts look to state law.
21
Heinrichs v. Valley View Development, 474 F.3d 609, 615 (9th Cir. 2007). In California, the preclusive
22
effect of a final judgment can be either “issue preclusion” (i.e., collateral estoppel) or full “claim
23
preclusion.” Mycogen Corp. v. Monsanto Co., 28 Cal. 4th 888, 896–97 (2002). Claim preclusion bars
24
claims/issues actually litigated, or that could have been litigated, in a prior proceeding. See Palomar
25
Mobilehome v. San Marcos, 989 F.2d 362, 364 (9th Cir. 1993). Issue preclusion, on the other hand,
Collateral Estoppel
26
27
28
1
Cf. Memo. at 5, fn. 4 (“[b]ecause cookies do not collect any information”) with SAC ¶ 23 (cookies are
“small files that store information”).
3
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
only bars re-litigation of individual issues. As explained below, Facebook is attempting to re-litigate
2
two issues decided in previous cases and which should be precluded.
3
IV.
4
ARGUMENT
A.
5
Plaintiffs Have Article III Standing
1.
6
Standing May Exist Solely by Virtue of Statutes
Facebook concedes that under current Ninth Circuit law, Art. III standing may exist solely by
7
virtue of statutes creating legal rights. See Warth v. Seldin, 422 U.S. 490, 500 (1975); Edwards v. First
8
American Corp., 610 F.3d 514, 516-17 (9th Cir. 2010); Motion, fn. 7; Order, 2015 WL 6438744 at *7-8.
9
Plaintiffs satisfy the injury-in-fact requirement for standing by alleging an invasion of a statutory legal
10
right. Economic loss is not required. Facebook baselessly argues that plaintiffs’ allegations are
11
insufficiently detailed to establish statutory standing and that economic harm is a statutory prerequisite
12
for three of the California claims (Cal. Penal Code § 502, fraud, and statutory larceny).2
13
2.
14
Viable State-Law Claims are a Basis for Standing
a.
15
Plaintiffs Have Viable State-Law Causes of Action
Plaintiffs have alleged several concrete harms that establish Article III harm: First, Facebook
16
failed to expire personally identifying tracking cookies from their browsers at logout, and plaintiffs
17
recently learned in discovery that
18
. See, e.g., SAC ¶ 76. This concrete and systematic invasion of class members’ computers
19
exceeded the authorized use of plaintiffs’ resources for both the Class and the IE Subclass. Second,
20
Facebook misappropriated billions third-party private communications to which Facebook was not a
21
party, associated them with user-identifying data in real time, and collected them without authorization.
22
This is economic harm sufficient for standing. Third, the unauthorized collection and aggregation of
23
plaintiffs’ and class members’ web browsing is a serious invasion of privacy under California law.
24
Facebook argues that plaintiffs have no standing to pursue valid state law claims to address the
25
injuries above because plaintiffs’ ability to monetize the misappropriated data remained undiminished.
26
Such diminution is not Constitutionally required and the argument is factual anyway. More broadly,
27
2
28
Facebook does not deny that economic harm is not a prerequisite specifically for claims under the
CIPA. See Cal. Penal Code § 637.2(c) (“It is not a necessary prerequisite to an action pursuant to this
section that the plaintiff has suffered, or be threatened with, actual damages.”).
4
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
“concrete harm” need not be economic. Sierra Club v. Morton, 405 U.S. 727, 734 (1972). Even in
2
cases involving economic harm, where data is misappropriated and used for financial gain by another,
3
the victim suffers injury even absent the victim’s intent to monetize the data himself.
4
FMC Corp. v. Boesky, 852 F.2d 981 (7th Cir. 1988), an insider trading case, illustrates Plaintiffs’
5
standing. In the FMC’s civil case for disgorgement, Mr. Boesky argued that FMC had no standing
6
because FMC was not denied the use of its own data, which Boesky had misappropriated. The Seventh
7
Circuit disagreed: “We hold that this misappropriation constitutes a distinct and palpable injury that is
8
legally cognizable under Article III’s case or controversy requirement.” Id.
9
First, the court held that “[c]onfidential business information, even though intangible in nature, is
10
corporate property . . . to which the corporation has the exclusive right and benefit.” Id. If the
11
information is misappropriated, it harms the victim. “Although FMC was not actually deprived of the
12
information itself, FMC, as a result of this wrongful conduct, was denied the right to use exclusively its
13
confidential information. And that is injury.” Id. (emphasis added).
14
15
16
17
18
19
20
21
Boesky teaches that if the claim is cognizable under state common law, it is Constitutionally
cognizable in federal court. The court reasoned:
For example, the actual or threatened injury required by Art. III may exist solely
by virtue of statutes creating legal rights, the invasion of which creates standing.
The same must also be true of legal rights growing out of state law…. Properly
pleaded violations of state-created legal rights, therefore, must suffice to satisfy
Article III’s injury requirement. Thus, even in the absence of a specific finding
that FMC was injured by the misappropriation of its confidential business
information, FMC sufficiently alleged the violation of a state-law right that in
itself would suffice to satisfy Article III’s injury requirement.
22
Id. at 993 (citations omitted) (emphasis added); accord, Veleron Holding, B.V. v. Morgan Stanley, 2015
23
WL 4503580 at *15 (S.D.N.Y. July 23, 2015) (citing Boesky). More recently, the Ninth Circuit
24
explicitly agreed with Boesky and held that requiring out-of-pocket damages might actually run afoul of
25
the Erie doctrine. Cantrell v. City of Long Beach, 241 F.3d 674, 683 (9th Cir. 2001) (citing Boesky);
26
Erie Railroad Co. v. Tompkins, 304 U.S. 64 (1938) (federal courts apply state laws when sitting in
27
diversity); Guaranty Trust Co. v. York, 326 U.S. 99, 105 (1945) (for diversity jurisdiction “Congress
28
5
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
never gave, nor did the federal courts ever claim, the power to deny substantive rights created by State
2
law or to create substantive rights denied by State law”).
3
Cantrell’s focus on diversity cases merits attention here. For example, some states recognize
4
claims for privacy intrusions even absent economic damages. See, e.g., Rhodes v. Graham, 37 S.W.2d
5
46, 47 (Ky. App. 1931) (“The fact that the damages cannot be measured by a pecuniary standard is not a
6
bar to his recovery.”). If a plaintiff were required to pursue his Kentucky tort claim in federal court,
7
Erie says the claim ought to proceed substantively unaltered. Facebook’s standing argument, however,
8
requires the federal court to violate Erie by dismissing a viable state law claim because the privacy
9
invasion did not cause any out-of-pocket damages.
10
Facebook’s view of standing creates further problems in the Class Action Fairness Act
11
(“CAFA”) context. Say a plaintiff pursues a California state court case with a class limited to California
12
members without out of pocket losses. Say also a parallel nationwide class asserts an identical
13
California claim. That latter case must proceed in federal court under the CAFA. Facebook’s Article III
14
theory would result in the broader class having its state common-law causes of action extinguished
15
while the state case proceeds. Such a result is contrary to CAFA’s non-substantive purpose. See Senate
16
Report 109-14 at p. 61 (Feb. 28, 2005), attached as Ex. 1 to Grygiel Decl.
17
The CAFA issue above is not merely academic in this case. Approximately one-seventh of the
18
class here is covered by a state-law class action in Santa Clara County Superior Court asserting only
19
state law claims against Facebook related to identical conduct. See Ung v. Facebook, Inc., Case No. 1-
20
12-cv-217244 (Santa Clara Cty). The state court rejected Facebook’s standing argument, finding that
21
“Facebook’s alleged conduct constitutes a serious invasion of a privacy interest.” See SAC, Ex. HH.
22
The Court’s Order, that plaintiffs lack standing for the unauthorized collection and use of their personal
23
data absent a showing that plaintiffs’ ability to monetize the data was diminished as a result (Order,
24
2015 WL 6438744 at *6) is inconsistent with Erie and Cantrell.
25
Furthermore, the law changed significantly after the Order. This Court cited three opinions for
26
its standing ruling. One was Google Cookie Placement. See Order, 2015 WL 6438744 at *6. Less than
27
three weeks after the Order, however, the Third Circuit reversed the district court’s ruling on standing:
28
6
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
2
For purposes of injury in fact, the defendants’ emphasis on economic loss is
misplaced…. a plaintiff need not show actual monetary loss for purposes of injury
in fact.
3
******
1
4
5
6
7
8
The plaintiffs here base their claims on highly specific allegations that the
defendants, in the course of serving advertisements to their personal web
browsers, implanted tracking cookies on their personal computers. Irrespective of
whether these allegations state a claim, the events that the complaint describes
are concrete, particularized, and actual as to the plaintiffs. To the extent that the
defendants believe that the alleged conduct implicates interests that are not
legally protected, this is an issue of the merits rather than of standing.
9
Google Cookie Placement, 806 F.3d at 134-35 (citations omitted). The court allowed claims for
10
invasion of privacy and intrusion upon seclusion to proceed, and remanded. Id. at 153.
11
This Court found the district court’s opinion in Google Cookie Placement “instructive mainly
12
because Plaintiffs’ allegations are virtually indistinguishable.” Id. at *6. Plaintiffs agree. Google
13
Cookie Placement is perfectly consistent with the simple formulations of Boesky and Cantrell: if a claim
14
is cognizable under state common law it is Constitutionally cognizable in federal court.
15
Finally, plaintiffs submit that the Ninth Circuit extended Cantrell specifically into data privacy
16
cases. See In re Facebook Privacy Litig., 572 Fed. Appx. 494 (9th Cir. 2014) (reversing district court
17
and holding plaintiffs’ allegations of misappropriation of their PII “sufficient to show the element of
18
damages” for contract and fraud claims). This Court’s Order limiting In re Facebook Privacy Litigation
19
to cases where a defendant shared personal data with advertisers (see Order, 2015 WL 6438744 at *6,
20
fn. 3) respectfully is inconsistent with the Ninth Circuit’s standing ruling In re Facebook Privacy Litig.
21
See also In re Anthem, Inc. Data Breach Litig., 5:15-MD-2617-LHK, Order on Motion to Dismiss, Slip
22
Op. at 45-48 (N.D. Cal. Feb. 14, 2016) (citing In re Facebook Privacy Litigation as basis to conclude
23
that loss of value of personal information “represents a cognizable form of economic injury”).
24
3.
Plaintiffs Have Pled Actual Injury to Them
25
Facebook argues that plaintiffs must allege specific third-party webpages visited during the class
26
period or specific communications (URLs) that were intercepted. Motion at 10. Facebook misstates the
27
allegations in the SAC and also misstates the applicable law. Pleading standing is no different than
28
7
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
pleading anything else: a short and plain statement putting the defendant on notice suffices. See, e.g.,
2
Nat’l Council of La Raza v. Cegavske, 800 F. 3d 1032, 1039 (9th Cir. 2015). Notice pleading, buttressed
3
by general facts sufficing to show “plausibility” – the “reasonable expectation that discovery will reveal
4
evidence” supporting the claim – is the rule. See, e.g., Starr v. Baca, 652 F. 3d 1202, 1212, 1214 (9th Cir.
5
2011). The facts alleged need only establish the plausibility of standing. See Landers v. Quality
6
Communications, Inc., 771 F. 3d 638, 645 (9th Cir. 2015).
7
Plaintiffs’ FAC alleged that Facebook installed tracking and session cookies on their computers
8
without consent, that they visited websites with Facebook functionality while logged out, and that
9
Facebook intercepted their electronic communications were intercepted. See, e.g., FAC ¶ 103. The
10
Order only identified one insufficiency: Plaintiffs failed to allege that Facebook obtained the “contents
11
of a communication attributable to them” making the allegation too general to “nudge” a CIPA claim
12
“across the line from conceivable to plausible.” Order, 2015 WL 6438744 at *10 (citing Iqbal, 556 U.S.
13
at 680). The FAC only alleged that communications were intercepted, but never alleged that the
14
communications contain contents. For the SAC, plaintiffs reviewed the URLs of websites visited while
15
logged out of Facebook, and specifically alleged that many of the intercepted URLs “contain detailed
16
file paths containing the content of GET and POST communications.” See, e.g., SAC ¶ 113. These
17
communications were more than IP addresses. The SAC also identifies the specific browser used by
18
each plaintiff and alleges whether the computer was shared. These extra allegations provide the “nudge”
19
the Court required. See Erickson v. Pardus, 551 U.S. 89, 94 (2007) (under Rule 8(a), “[s]pecific facts
20
are not necessary…the statement need only ‘give the defendant fair notice of what the …claim is and the
21
grounds upon which it rests.’”).
22
Furthermore, plaintiffs alleged with summary-judgment-like detail a business practice through
23
which Facebook gathered billions of URLs during the class period and associated them with actual
24
subscribers. SAC ¶¶ 68-78. Independent researchers (see SAC ¶ 58) support these allegations. So do
25
Facebook’s own documents. Such detailed allegations of a general business practice suffice to allege
26
that plaintiffs were harmed. See, e.g., Obama v. Klayman, 800 F.3d 559, 563-64 (D.C. Cir. 2015)
27
(standing established to assert claim against the NSA to proceed even though the plaintiff had not
28
8
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
alleged the particular phone calls at issue because the plaintiff “offer[ed] an inference derived from
2
known facts.”).
3
4.
In the Alternative, Standing Should Be Resolved at a Later Stage
4
Although standing is normally a threshold issue to be resolved at the outset of a case, courts
5
considering class actions may defer resolution until a later stage, even until class certification. See
6
Amchem Prods., Inc. v. Windsor, 521 U.S. 591 (1997). In situations like this one prudential concerns
7
favor deferral (see In re Target Corp. Data Sec. Breach Litig., 66 F. Supp. 3d 1154, 1160 (D. Minn.
8
2014)), and “there is no rigid rule that precludes class certification from being addressed before standing
9
issues.” In re Carrier IQ, Inc., Consumer Privacy Litig., 78 F. Supp. 3d 1051 (N.D. Cal. 2015); accord,
10
In re Anthem, Inc. Data Breach Litig., Slip Op. at 10 (“the Court finds that it has discretion to decide . . .
11
when to consider issues of standing’).
12
If the Court requires allegations of actual websites visited by the named plaintiffs, or actual
13
URLs intercepted, plaintiffs request deferral of the standing issue pending resolution of an upcoming
14
motion to compel. Facebook has refused to produce documents related to the named plaintiffs.
15
Facebook has records of all data collected on the named plaintiffs, which might resolve this issue once
16
and for all.
17
B.
Plaintiffs Have Adequately Pled Federal Claims Under the ECPA
1.
18
Specificity of Pleadings
19
Full of merits-based factual arguments about the Internet’s functioning and, in particular, the
20
functioning of Facebook’s surreptitiously planted cookies,3 Facebook’s brief wishes away plaintiffs’
21
many detailed factual allegations, from defendant’s own documents, showing defendant’s knowledge of
22
its illicit post-log out tracking. Facebook assumes a requirement of proof in the pleadings that neither
23
Fed. R. Civ. P. 8(a), nor 9(b), nor Ninth Circuit precedent imposes. Facebook’s arguments nowhere
24
recognize that any “ambiguities” in this highly technical setting – such as whether a personal computer,
25
server, software or cookie can function as a “device” for Wiretap Act purposes, a “facility” for Stored
26
3
27
28
See, e.g., Memo at 2 (“proof of injury; “record information…transmitted as part of the normal
operation of the Internet;”); at 4 (“[l]ike any web content provider, Facebook’s servers….”); at 17
(“Facebook, like any other third-party provider of webpage content…”).
9
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
Communications Act purposes, or as a “machine, instrument or contrivance” for CIPA purposes – “must
2
be resolved in favor of the pleadings.” Heldt v. Tata Consultancy Servs., Ltd., 2015 WL 5542303, at *3
3
(N. D. Cal. Sep. 18, 2015) (citing Walling v. Beverly Enters., 476 F. 2d 393, 396 (9th Cir. 1973)).
4
Alleging long-established, legally cognizable claims, the SAC does much more than simply
5
“recite the elements of” those claims. Starr, 652 F. 3d at 1216. Plaintiffs do not, for example, merely
6
allege “labels,” that Facebook used a “device” to “intercept” the “content” of confidential
7
communications. Plaintiffs factually plead the identity of such devices, the means and method of the
8
interceptions, and the contents of the communications. Facebook’s factual disagreement with those
9
contentions is for discovery and summary judgment or trial. See Walker v. B&G Foods, Inc., 2016 WL
10
463253, at * 2 (N.D. Cal. Feb. 8, 2016) (“In the Ninth Circuit, ‘[i]f there are two alternative
11
explanations, one advanced by the defendant and the other advanced by the plaintiff, both of which are
12
plausible, plaintiff’s complaint survives a motion to dismiss.”).
13
14
2.
The Wiretap Act
a.
Plaintiffs Adequately Allege Content.
15
Content “includes any information concerning the substance, purport, or meaning of [a]
16
communication.” 18 U.S.C. § 2510(8). The Order held that plaintiffs’ failed to allege Wiretap content
17
because of similarity to “the referrer headers addressed in Zynga Privacy Litigation.” Order at 16.
18
Plaintiffs’ SAC shows that the information Facebook acquired differs from that in Zynga. The Google
19
Cookie Placement ruling and recently declassified cases from the Foreign Intelligence Surveillance
20
Court explain why detailed URLs do contain “content,” i.e. “any information relating to the substance
21
purport, or meaning” of a communication.
22
Plaintiffs’ SAC alleges Defendant acquired “detailed URL requests and search queries” and
23
explains that URLs are composed of several different parts. SAC at ¶185. For example, the URL
24
http://progressivehealth.hubpages.com/hub/How-Do-I-Reduce-Herpes-Breakouts contains four parts: (1)
25
“http” establishes the basic computer language of the communication; (2)
26
“progressivehealth.hubpages.com” identifies the website to which the communications will be sent and
27
received, i.e. the other party to the communication; (3) “How-Do-I-Reduce-Herpes-Breakouts” is the
28
name of the precise file requested; and (4) “hub” plus “How-Do-I-Reduce-Herpes-Breakouts” is called
10
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
the “file path.” SAC at ¶34. In this example, the phrase “How-Do-I-Reduce-Herpes Breakouts” is
2
content because it contains information relating to the substance, purport, or meaning of a
3
communication. Likewise, in the URL http://www.nytimes.com/2011/08/10/nyregion/post-traumatic-
4
stress-disorder-from-911still-haunts.html, the phrase “[PTSD] from 911 still haunts” is content. See
5
SAC at ¶ 35.
6
In Zynga, the URLs at issue were Facebook URLs that only included the name of a person or
7
group. In re Zynga Privacy Litigation, 750 F.3d 1098, 1109 (9th Cir. 2014). The URLs here are third-
8
party communications, and include search terms or other detailed substance, purport and meaning, e.g.,
9
like “How Do I Reduce Herpes Breakouts” and “[PTSD] from 911 still haunts.” See id. (URLs contain
10
content where include “a search term or similar communication.”). Defendant’s argument that
11
computer-generated information can never contain content misstates Zynga’s holding. The SAC-
12
specified URLs were not computer spawned but were only generated after the user sent a ‘GET’
13
command to a non-Facebook website by either typing a URL into the navigation bar or clicking on a
14
hyper-link. SAC at ¶31. The SAC is consistent with Internet users’ everyday experience and the
15
Supreme Court’s explanation of the “relatively straightforward” manner of Internet communications.
16
See Reno v. ACLU, 521 U.S. 844, 852-53 (1997) (“Users generally explore a given Web page, or move
17
to another, by clicking a computer ‘mouse’ on one of the page’s icons or links…”.). Whether a detailed
18
URL results from a user typing all of the information into their toolbar or clicking on a link, the
19
underlying intentional communicative thought by the user is the same.
20
Affirmatively requesting information, and conveying personal thought, on how “PTSD from
21
9/11 still haunts,” the user is sending a protected electronic communication under the Act. See 18 U.S.C.
22
§ 2510(12) (“Electronic communication” includes “any transfer of signs, signals, … data, or intelligence
23
of any nature”). The browser sends a GET request directly to the NYT and populates the toolbar with
24
the detailed URL includes the phrase “[PTSD] from 9/11 still haunts.” That URL is contemporaneously
25
acquired by Facebook without the user’s knowledge or consent. The NYT responds with a 3,000 word
26
essay on PTSD after 9/11 that is also protected by the Wiretap Act. SAC at ¶ 35.
27
28
Clicking on a mouse rather than typing the entire URL into their toolbar the user has still sent a
protected communication. Another protected communication is about to be received. The ECPA’s
11
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
primary purpose was to “effectively protect the privacy of electronic communications” by updating the
2
law to “ke[ep] pace with the development of communications and computer technology … and the
3
structure of the telecommunications industry” and “bring it in line with technological developments[.]”
4
Senate Report 99-541 (Oct. 17, 1986) at 2-3, Grygiel Decl. Ex. 2 .
5
Consider email where the user forwards a message to another person without touching the
6
subject line of the original email. Generated by the email providers’ computer code, the forwarded
7
email’s subject line, is nearly identical to the subject line of the original email. Defendants’ logic leads
8
to the absurd result that such subject lines contain no content because the email providers’ default rules
9
“produced” them. So, too, with Defendant’s argument about detailed URLs.
10
In Declassified Opinion from the FISC, provided to the Court on August 15, 2014 [ECF No. 78],
11
the NSA argued it had authority under the Pen Register Act to track URLs because they are DRAS
12
(dialing, routing, addressing, or signaling) information. The FISC, which routinely hears Wiretap cases,
13
rejected this interpretation, holding “DRAS and content are not mutually exclusive categories.” Id. at 31.
14
In Google Cookie Placement, the Third Circuit explained “everything before the .com instructs a
15
centralized web-server to direct the user to a particular website, but post-domain name portions of the
16
URL are designed to communicate to the visited website which webpage content to send the user…
17
between the information revealed by highly detailed URLs and their functional parallels to post-cut-
18
through digits, we are persuaded that – at a minimum – some queried URLs qualify as content.” 806
19
F.3d at 139 (emphasis added).
20
The Google Cookie Placement panel was persuaded by “post-cut-through-digit” cases holding
21
that “numbers dialed from a telephone after a call is already set-up” are content. 806 F.3d at 138, citing
22
U.S. Telecom Ass’n v. FCC, 227 F.3d 450, 462 (D.C. Cir. 2000), see also Brown v. Waddell, 50 F.3d
23
285, 87-88 (4th Cir. 1995) (numbers sent to pager that are “more extensive … than those in telephone
24
numbers” contain “content.”). Google Cookie Placement also cited the PATRIOT Act’s legislative
25
history, in which a report of the House Judiciary Committee explained that a pen register order “could
26
not be used to collect information other than [DRAS], such as the portion of a URL specifying Web
27
search terms or the name of a requested file or article.” See HR. Rep. 107-236 at 53 (Oct. 11, 2001),
28
Grygiel Decl. Ex. 3; see also In re Application for Pen Register, 396 F.Supp.2d 45, 49-50 (D. Mass.
12
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
2005) (“Contents” included URL “subject lines, application commands, search queries, requested file
2
names, and file paths.”); U.S. v. Forrester, 512 F.3d 500, n. 6 (9th Cir. 2008) (URLs, unlike IP addresses,
3
“reveal[] much more information” about user’s Internet activity, including articles viewed.)
4
b. Plaintiffs Adequately Allege Interception, i.e. Contemporaneous Acquisition
5
Courts have interpreted the Wiretap Act to require the interception (18 U.S.C. § 2501(4)) to be
6
contemporaneous to the sending or receipt of a communication. Plaintiffs know of no court that has
7
accepted defendant’s argument that simultaneous capture of referrer URLs appended to third-party
8
cookies do not involve the acquisition of information contemporaneous to a communication. Cf. U.S. v.
9
Szymuskiewicz, 622 F.3d 701, 706 (8th Cir. 2010) (“contemporaneous does not mean ‘in flight’ or ‘in the
10
middle’ or any football metaphor;” is “contemporaneous by any standard” when the Wiretap defendant
11
and the victims “receive[] each message with no more than an eyeblink in between”); U.S. v.
12
Councilman, 418 F.3d 67, 76 (1st Cir. 2005) (“Councilman I”) (“[B]road definition of … storage was to
13
enlarge privacy protections for stored data … not to exclude email messages stored during transmission
14
from these strong protections.”).
15
Defendant acquired plaintiffs’ communications with websites as in Szymuskiewicz. The re-
16
direction of the URLs in this case functionally operated like an email forwarding rule and Facebook
17
acquired users’ communications to the websites in a time frame “contemporaneous by any standard.”
18
Defendant acquired information relating to the substance, purport, and meaning of communications that
19
user received in return from the websites. SAC ¶ 184. Facebook’s acquisition was completed “before the
20
communication between the plaintiffs and the various websites were completed.” SAC ¶ 184.
Konop v. Hawaiian Airlines, Inc., 302 F.3d 868 (9th Cir. 2002) is inapposite. In Konop, the
21
22
defendant gained unauthorized access to a “secure” website where the contents of the plaintiffs’
23
communications had been stored on a server for an unspecified period of time, but far longer than the
24
milliseconds at issue here. Id.
Facebook’s argument that it must receive “the actual communication” misstates the law.
25
26
Motion at 12.4 An interception is defined as the “acquisition of the contents of any … electronic
27
28
4
Facebook misstates the clear facts alleged in the SAC when it only discusses communications sent
from the Internet users and ignores communications users received. SAC ¶ 184. (“In fact, Facebook
13
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
communication[.]” 18 U.S.C. § 2510(4). “Content” is defined as “any information concerning the
2
substance, purport, or meaning” or the subject communication. 18 U.S.C. § 2510(8). The Wiretap Act
3
prohibits the “acquisition of any information concerning the substance, purport, or meaning of any
4
electronic communication.” It is enough for a defendant to acquire post-cut-through dialed digits, the
5
subject line of an email, or, in this case, the portion of a URL after the .com.
6
Finally, Facebook argues “Plaintiffs’ browser sends two different communications at two
7
different times.” Motion at 12. The plaintiffs, however, are not browsers. The plaintiffs’ are sentient
8
human beings who made human decisions to send and receive personal communications from websites.
9
10
c.
Plaintiffs Adequately Allege the Use of a Device.
The Wiretap defines an “electronic … or other device” as “any device … which can be used to
11
intercept a[n] … electronic communication[.]” 18 U.S.C. § 2510(5). Emphasis added. “Other” and
12
“any” have meaning. They focus on function – i.e. whether something could be used to acquire
13
communications. Congress chose these broad definitions to further its central purpose of effectively
14
protecting the privacy of electronic communications. Random House defines device as, among other
15
things: (1) “a thing made for a particular purpose; an invention or contrivance, especially a mechanical
16
or electrical one;” (2) “a plan or scheme for effecting a purpose;” and (3) “a crafty scheme, trick.”
17
The SAC alleges defendant used seven devices to acquire communications: (1) cookies; (2) web-
18
browsers and their constituent files; (3) computing devices; (4) Facebook’s web-servers; (5) the web-
19
servers of the websites involved; (6) Facebook’s computer code; and (7) the plan Facebook carried out
20
to effectuate the acquisition of plaintiffs’ communications. SAC ¶ 187.
21
Web-servers and computers are devices under the Wiretap Act. Szymuszkiewicz, 622 F.3d at 707
22
(discussing Crowley v. Cybersource Corp., 166 F.Supp.2d 1263, 1269 (N.D. Cal. 2001)). Software and
23
computer code are devices. In re Carrier IQ, 78 F. Supp. 3d at 1067 (“Plaintiffs have sufficiently
24
alleged that the Carrier IQ Software is a ‘device’ for purposes of the Wiretap Act.”). Facebook’s
25
cookies are devices under the act because they are an invention designed for the purposes of “track[ing]
26
and record[ing] an individual Internet user’s communications with and activities on websites across the
27
28
received the communications before the communication between the plaintiffs and the various websites
were completed.”)
14
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
Internet.” SAC ¶ 52. Facebook’s secret interception program is a “device” because it is a “plan or
2
scheme” to carry out the purpose of acquiring the electronic communications of Internet users.
3
Crowley is inapposite. There the Court held that Amazon could not be liable under the Act
4
because it “acted as no more than the second party to a communication” when it knowingly forwarded
5
information to CyberSource to verify one of its users credit card information. Id. at 1266. Facebook is
6
not a party to a communication between a plaintiff and a third-party website as Amazon was in Crowley.
7
Also inapposite, Potter v. Havlicek, 2008 WL 2556723 (S.D. Ohio June 23, 2008), arose out of a
8
divorce. A jealous husband installed software on a family computer to surreptitiously record his wife’s
9
communications. The husband interpleaded the software company. The Court concluded that “computer
10
software alone” is not a Wiretap Act “device” in the context of a software manufacturer who never
11
received the alleged intercepted communications. Id. at *7 (Wiretap Act “does not contemplate
12
imposing civil liability on software manufacturers and distributors for the activities of third parties”).
13
Plaintiffs here allege seven devices, not computer software alone. Nor is Facebook a software
14
manufacturer who received no communications and merely sold software to a third-party who
15
subsequently used it to intercept another person’s communications. Facebook used the software to
16
acquire communications.
17
d. Facebook is Not a Party to the Communication.
18
Facebook tacitly concedes it is a “third-party” and not a party to the relevant communications
19
between the users and the websites. MTD at 14, 21. Plaintiffs agree as the Court did. Order at 18-19.
20
The SAC alleges Facebook intercepted communications that the logged-out plaintiffs sent and received
21
from other websites. SAC ¶ 184. The SAC illustrates that communications between users and websites
22
occur through a channel separate from the path through which Facebook acquires information. SAC ¶
23
60. The SAC alleges interceptions while logged-out users were sending communications to non-
24
Facebook websites, with no intention of sending any information to Facebook and when Facebook
25
explicitly promised it would not acquire user communications.
26
Facebook’s interpretation of the “party” exception obliterates the Wiretap Act. Suppose that, for
27
“security purposes,” the IRS places cookies on the web-browsers of every American who files taxes
28
online. The IRS promises these Americans that it will not access the cookies except when the tax-filer is
15
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
actually on the IRS web-page attempting to file taxes. Suppose the IRS, for what it describes as
2
“security purposes only” so the IRS is sure only approved vendors use the program, requires tax prep
3
firms to place IRS computer code in the header of each web-page the firm controls if the firm wants its
4
customers the option to file their taxes online. The code also places an IRS logo on the page. The IRS
5
informs firms it will receive some information, but promises not to track individual tax-filers through
6
cookies while they are not actively logged-in to the IRS site. Accordingly, tax filers permit the
7
placement of cookies and tax preparation firms place the IRS code on every page of their websites for
8
these limited “security purposes,” including pages like: http://www.efile.com/what-are-the-penalties-for-
9
not-filing-a-tax-return-or-not-to-pay-taxes-IRS-penalty-list/.
10
However, unbeknownst to the tax-filers and the tax preparation firms, suppose the IRS computer
11
code tracks taxpayers and their communications (including the referrer URL above) so that the IRS
12
acquires the content of every communication John Doe makes with his tax preparation firm through his
13
web-browser – including, for example, whether he sent a communication seeking information on “what
14
are the penalties for not filing or tax return or not to pay taxes?” The IRS then uses the information to
15
determine whom to audit. Under Facebook’s logic, directly contrary to Congressional intent, the IRS is a
16
“party” to the intercepted communication between the tax-filer and their chosen tax preparation firm.
17
Similarly, In re Pharmatrak, 329 F.3d 9 (1st Cir. 2003) rejected an argument identical to
18
Facebook’s. See also Szymuszkiewicz, 622 F.3d 701 (rejecting similar argument where defendant used
19
email forwarding rule to instruct victim’s email service to automatically re-direct all emails to
20
defendant); but cf. Google Cookie Placement, 806 F.3d at 143-45.
21
22
23
24
Crowley, cited repeatedly by defendant, illustrates why plaintiffs should prevail. Making an
internet purchase, the Crowley plaintiff knowingly sent financial information to Amazon. Amazon
transferred the data to CyberSource to verify payment details. The communication between the plaintiff
and Amazon occurred on the Amazon web-page, a key fact Facebook omits. Crowley explains:
25
“Amazon merely received the information transferred to it by Crowley, an act without which there
26
27
28
would be no transfer. Amazon acted as no more than the second party to a communication. This is not
an interception as defined by the Wiretap Act.” Id. at 1269.
16
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
e.
Consent is an Affirmative Defense
2
Defendant bears the burden of proving the affirmative defense of consent. See Pharmatrak, 329
3
F.3d at 19. No consent appears in the SAC so consent cannot be resolved on Facebook’s Rule 12(b)(6)
4
motion. Scott v. Kuhlmann, 746 F.2d 1377, 1378 (9th Cir. 1984) (citing Wright & Miller, Federal
5
Practice and Procedure, § 1277 at 328-30) (affirmative defenses may not be raised in a motion to dismiss
6
unless no disputed fact issues).
7
For Wiretap claims, “consent should not be casually inferred.” Pharmatrak at 20. No
8
constructive consent is permissible and “without actual notice, consent can only be implied when the
9
surrounding circumstances convincingly show that the party knew about and consented to the
10
interception.” Pharmatrak at 19, 20. Facebook’s interceptions broke its privacy promises and included
11
the collection of personal data. No consent, actual or implied, exists. Id.
12
f.
The Ordinary Course of Business Exception Does Not Apply
13
The Wiretap Act exception for interceptions “being used by” an ECS provider in the “ordinary
14
course of its business (18 U.S.C. § 2510(5)(a)) only applies to actual ECS providers. In re Google Inc.
15
Gmail Litig., 2013 WL 5423918 at *11 (N.D. Cal. Sep. 26, 2013) (exemption “designed only to protect
16
[ECS] providers”); Shefts v. Petrakis, 2012 WL 4049484 at *5 (C.D. Ill. Sep. 13, 2012); cited with
17
approval in In re Carrier IQ at 40. Facebook, however, fails to identify the relevant ECS provider, and
18
does not say if it is making a vicarious claim. Facebook cites no case in which a defendant successfully
19
invoked a vicarious “ordinary course of its business” exception. Cf. Google Privacy Policy Litigation
20
(involved scanning of emails on defendant’s own email service); Kirch v. Embarq, 702 F.3d 1245 (10th
21
Cir. 2012) (ISP defendant invoked exception based on communications occurring through its own
22
service).
23
Nor does Facebook claim it is the relevant ECS. Facebook is an ECS provider – but only for
24
communications made on Facebook.com. Facebook nowhere identifies – a fact issue, anyway - the
25
“instrument, equipment, or facility” or “component thereof” that it must show it used as an ECS in the
26
ordinary course of business.
27
28
Even if Facebook identified the ECS and the facility necessary to invoke this exception, the nonconsensual taking or tracking of electronic information is not within the “ordinary course of business
17
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
exception.” See Google Gmail Litigation, 2013 WL 5423918 at *11 (adopting “narrow reading” of
2
exception, requiring “some nexus between the need to engage in the alleged interception and the
3
subscriber’s ultimate business, that is, the ability to provide the underlying service or good.”).
4
Facebook’s interceptions and social-sharing tools are neither necessary for transmission of
5
communications between users and websites nor “incidental” to them. See Google Gmail Litigation,
6
2013 WL 5423918 at *8 (exception limited to ECS provider interceptions that “facilitate[] the
7
transmission of the communication at issue or is incidental to the transmission of such communication”).
8
9
Facebook’s argument fails under In re Google Privacy Policy. There the court held that the
exception could apply to actions taken by an ECS provider to further its “legitimate business purpose.”
10
2013 WL 6248499 at *11 (N.D. Cal., Dec. 3, 2013). Facebook’s systematic violation of its privacy
11
promises is not a “legitimate business purpose.” In re Carrier IQ at 39 (exception inapplicable where
12
device “has functionality” that was “expressly disclaimed”); see also Opperman v. Path, 87 F.Supp.3d
13
1018, 1061 (N.D. Cal. 2014) (common law intrusion claim; non-consensual taking of electronic
14
information is not “routine commercial behavior.”).
15
Disclosure of Facebook’s behavior resulted in a Congressional inquiry (SAC ¶ 112) and an
16
unprecedented 20 years of independent privacy audits. SAC at ¶111. False representations and
17
misconduct punished by the FTC are not within the ordinary course of business exception.
18
3.
a.
19
20
The Stored Communications Act
Plaintiffs Adequately Alleged Access to a Facility
The Stored Communications Act defines “facility” as the conduits “through which an electronic
21
communication service is provided.” 18 U.S.C. 2701(a). An ECS is defined as “any service which
22
provides to users thereof the ability to send or receive wire or electronic communications.” To find a
23
“facility,” a court must first determine the ECS then determine the elements through which the service is
24
provided.
25
The SAC alleges unauthorized access to three different types of facilities: (1) personal
26
computing devices; (2) web-browsers; and (3) browser-managed files. SAC ¶ 199. Contrary to the
27
Motion, every court to answer the question has found that web-browsers and browser-managed files are
28
protected SCA “facilities.”
18
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
For example, Microsoft has successfully used the SCA to challenge computer hackers who gain
2
unauthorized access to Internet Explorer and its constituent files located on the personal computing
3
devices of IE users. In Microsoft v. Does 1-8, the defendants circumvented IE’s privacy settings to take
4
information directly from IE users without consent. The court concluded, in unequivocal terms,
5
“Microsoft’s … Windows operating system and Internet Explorer software are facilities through which
6
electronic communication services are provided.” Microsoft v. Does 1-8, 14-cv-00811-LO-IDD (E.D.
7
Va. July 20, 2015). Plaintiffs know of no SCA case involving web-browsers that Microsoft has lost. See
8
also Microsoft v. Does 1-27, 10-cv-00156 (E.D. Va. 2010); Microsoft v. Piatti, 11-cv-01017 (E.D. Va.
9
2011); Microsoft v. Does 1-39, 12-cv-1335 (E.D. N.Y. 2012); Microsoft v. Does 1-18, 13-cv-139 (E.D.
10
Va. 2013); Microsoft v. Does 1-82, 13-cv-00319 (W.D. N.C. 2013). These Microsoft cases get it right.
11
Accord, Chance v. Avenue A, 165 F.Supp.2d 1153, 1160 (W.D. Wash. 2001); Ehling v. Monmouth, 961
12
F.Supp.2d 659, 667 (D. N.J. 2013); Crispin v. Audigier, 717 F.Supp.2d 965 (C.D. Cal. 2010); Freedman
13
v. AOL, 325 F.Supp.2d 638 (E.D. Va. 2004); Councilman I, 418 F.3d at 77 (“Congress sought to ensure
14
that the messages and by-product files that are left behind after transmission, as well as messages stored
15
in a user’s mailbox, are protected from unauthorized access. Email messages in the sender’s and
16
recipient’s computers could be accessed by electronically ‘breaking into’ those computers and retrieving
17
the files.”).
18
Understanding the SCA’s purpose is necessary to parse the distinction between the web-browser
19
and email cases and the mixed case law on personal computing devices. Congress enacted the SCA
20
“because the advent of the Internet presented a host of potential privacy breaches that the Fourth
21
Amendment does not address.” Quon v. Arch Wireless, 529 F.3d 892, 900 (9th Cir. 2008). Congress
22
wished to protect electronic communications “subject to control by a third-party computer operator[.]”
23
See Senate Report 99-541 at 3, Grygiel Dec. Ex. 2. Likewise, in Riley v. California (discussed in more
24
detail below), the U.S. Supreme Court unanimously held that data contained on a personal computing
25
device is protected by the Fourth Amendment, reasoning “[a]n Internet search and browsing history …
26
could reveal an individual’s private interests or concerns[.]” 134 S. Ct. 2473, 2490 (2014). Riley is a
27
good step in the direction of privacy protection, as it closed the front door to secret seizure of such data.
28
But the back door remains open unless the SCA applies.
19
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
Further, if web-browsers are not protected by the SCA, Riley v. California means nothing in the
2
real world. First, rather than attempt to access communications directly through a person’s computer or
3
cell phone, the government need only serve a subpoena on the person’s web-browsing company
4
requiring the company to access the files to which it has access rights. Second, a web-browsing
5
company could give government agents the authority to search a user’s files contained within the
6
browser to which the web-browsing company maintains the right to access. See United States v.
7
Matlock, 415 U.S. 164, n. 7 (1974) (“Common authority” rest on “mutual use of the property by persons
8
generally having joint access or control for most purposes[.]”). This is because a web-browser user does
9
not “own” the browser or its files but only enjoys a “license” to use them subject to conditions which
10
allow the web-browsing company to access the same files, under Facebook’s argument. Finally, a web-
11
browser licensor could disclose the contents of its user’s Internet communications to any third-party
12
without user consent. Viewed in its proper context, therefore, Facebook’s position violates the basic rule
13
of avoiding statutory interpretations that lead to absurd results. See Los Coyotes Band of Cahuilla and
14
Cupeno Indians v. Jewell, 729 F. 3d 1025, 1036 (9th Cir. 2013)
15
16
b.
Plaintiffs Adequately Alleged Storage.
The SCA defines “electronic storage” as (A) “any temporary, intermediate storage of a[n] …
17
electronic communication incidental to the electronic transmission thereof; and (B) any storage of such
18
communication by an [ECS] for purposes of backup protection of such communication.” Plaintiffs
19
allege Facebook gained access to the content of communications in cookies and referer URLs stored in
20
browser-managed files, including: (1) URL requests present in the toolbar while a user remains present
21
at a particular webpage; and (2) browsing history maintained by the web-browser ECS for purposes of
22
back-up protection.
23
The definitions of storage are “extraordinary – indeed, almost breathtakingly – broad.” See
24
Councilman I at 73 (citing U.S. v. Councilman, 245 F.Supp.2d 319, 320 (D. Mass. 2013)) (Congress
25
intended to protect “[e]mail messages in the sender’s and the recipient’s computers” which “could be
26
accessed by electronically ‘breaking into those computers[.]”) Though this is a web-browser case, the
27
concept is the same regarding the URLs stored in the plaintiffs’ toolbar.
28
20
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
Defendant’s argument that a URL stored in a user’s toolbar is not stored “in the middle of a
2
transmission” (MTD at 20) is a factual, and stretched, argument. The contents of these communications,
3
including all information after the .com, enter storage in the toolbar “once a user hits Enter or clicks on a
4
link [and] the communication is in the process of being sent and received between the user and the first-
5
party website.” SAC ¶ 206. The web-browser stores a copy of the user’s URL requests in the toolbar for
6
only so long as “the user remains present at a particular webpage.” Id. When users send their next
7
communication, the stored communication is removed from the toolbar. As pleaded in the SAC, this is
8
the everyday experience of millions of American Internet users including the plaintiffs.
9
Storage in browsing history also satisfies the second part of the definition because the storage is
10
for “purposes of backup protection,” which the Ninth Circuit has held applies to backup protection for
11
the user’s benefit. Theofel v. Farey-Jones, 359 F.3d 1066, 1075 (9th Cir. 2004).
c.
12
Plaintiffs Alleged Facebook “Accessed” Facilities.
13
The SCA does not separately define “access.” The common definition of access is not limited to
14
physically entering a protected facility, but instead to “obtain” information from it or make use of it. See
15
Segan LLC v. Zynga, 2015 WL 5315945 (N.D. Cal. Sept. 10, 2015) (patent case). The Oxford dictionary
16
defines “access” to include “the opportunity to use or benefit from something” or to “obtain, examine, or
17
retrieve.”5 In the computer context, Webopedia defines access as “to use.”6 The Computer Desktop
18
19
20
Encyclopedia defines access as, among other things, “in computer security, the opportunity for use of a
resource.”7 The ECPA’s legislative history shows Congress intended access to have a broad meaning.
See Senate Report 99-541 at 38-39, Grygiel Decl. Ex. 2 (Discussing §2703(c) and (d) as providing for
21
“access to records or other information pertaining to a subscriber” and providing for “orders requiring
22
23
24
access by a Government entity to the contents of an electronic communication,” effectively making
access synonymous in the ECPA with the obtaining of information).
25
5
26
6
27
28
http://www.oxforddictionaries.com/us/definition/american_english/access
http://www.webopedia.com/sgsearch/results?cx=partner-pub
-8768004398756183%3A6766915980&cof=FORID%3A10&ie=UTF-8&q=access
7
http://www.yourdictionary.com/access#computer
21
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
Facebook’s behavior fits all of these definitions. Furthermore, contrary to Facebook’s argument,
2
plaintiffs’ interpretation would not lead to liability for “any third-party provider of webpage content that
3
receives referer URL information” just because they received the communication.8 If a browser
4
communicates a referer URL to a third-party, that normal functioning is not an interception or an
5
unlawful access of a facility, because it is impliedly consensual. In re Doubleclick, 154 F.Supp.2d 497
6
7
8
(S.D.N.Y. 2001). Facebook, however, acquired content without any consent, and the general rule
articulated in Doubleclick does not apply. The only third parties facing liability under plaintiffs’ theory
are those who circumvent privacy settings on browsers or those who misrepresent the nature of the
9
cookies being written to the browser – in other words, those parties who cannot claim implied consent.
10
C.
Plaintiffs Have Adequately Pled California Law Claims
11
1.
The California Invasion of Privacy Act (“CIPA”)
12
a.
13
CIPA § 631
A claim under Section 631 mirrors the ECPA with two relevant differences.9 First, CIPA is an
14
all-party consent statute. Even if Facebook prevails on its theory that the relevant communication is the
15
GET request sent to Facebook, and Facebook is a “party” to the intercepted referer URLs (making it the
16
“one party” consenting to the communication), it cannot demonstrate that the plaintiffs consented.
17
Lacking all-party consent, the CIPA could provide a basis for liability even where the Wiretap Act
18
would not. Furthermore, all parties Additional, Facebook is a third-party.10 But it is not a “content”
19
provider.
20
Second, CIPA does not require the use of a “device.” Facebook argues that the relevant
21
requirement is instead a “machine, instrument, or contrivance,” see Motion at 16, but this argument
22
selectively edits the statute. CIPA’s actual text prohibits interceptions “by means of any machine,
23
instrument, or contrivance, or in any other manner.” Plaintiffs adequately alleged seven instruments or
24
contrivances as detailed in their federal Wiretap section. See SAC ¶ 217. Even if these facts do not
25
26
8
Facebook here concedes it is a third-party.
27
9
Plaintiffs restate their arguments on “content” and “consent” from the federal Wiretap Act.
28
10
Facebook again concedes it is not a party to communications between users and websites.
22
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
technically qualify as a “machine, instrument or contrivance,” Facebook has ignored the portion of the
2
statute allowing “any other manner.”
3
b.
CIPA § 632
4
Section 632 forbids recording a conversation where “a party to [the] conversation has an
5
objectively reasonable expectation that the conversation is not being overheard or recorded.” Flanagan
6
v. Flanagan, 27 Cal. 4th 766, 777 (2002). As Facebook notes, California courts have held that Internet
7
communications are not confidential in some circumstances. However, plaintiffs know of no case
8
holding that an Internet communication is not confidential for purposes of Section 632 when the
9
recording entity explicitly promised the actual parties to the communication that the conversation would
10
not be recorded.11 Facebook explicitly promised not to record the communications at issue creating the
11
privacy expectation. “When you log out of Facebook, we remove the cookies that identify your
12
particular account.” SAC ¶ 23. Even after Facebook was caught, its Engineering Director said,
13
14
SAC ¶ 27.
See also SAC ¶74-78; SAC ¶107.
15
Facebook cites the Court’s prior holding that “Internet users have no expectation of privacy in
16
the … IP addresses of the websites they visit,” Motion at 18, but this holding is irrelevant to the Section
17
632 analysis. As alleged in the SAC, Facebook intercepted detailed URLs in addition to simple IP
18
addresses. See SAC ¶ 35; see also In re Application for Pen Register, 396 F.Supp.2d at 49-50; U.S. v.
19
Forrester, 512 F.3d at n. 6 (URLs, unlike IP addresses, “reveal[] much more information” about user’s
20
Internet activity, including articles viewed); Google Cookie Placement, 806 F.3d at 138 (citing
21
Forrester). Even if the SAC only alleged interceptions of IP addresses (which is not the case), even IP
22
addresses can be the subject of objectively reasonable expectations of privacy in the context of a Section
23
632 claim. As Forrester noted, the government must obtain a court order even if only tracking the IP
24
addresses to and from which a person is communicating.
25
Plaintiffs also adequately alleged the use of a recording device - the same devices used to
26
intercept their communications. SAC ¶ 217. Facebook cites an inapposite pre-Internet case – and fails to
27
11
28
Defendant is not a party to any of the communication between the plaintiffs and the websites. By its
own admissions, it is a third-party. Regardless of whether the Court deems Facebook a party, it is liable
under Section 632.
23
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
cite any case supporting its position that the devices it uses to record its users’ Internet communications
2
while logged-off fail to qualify. See SAC ¶ 48-52 regarding recording of information in
3
database and third-party cookies “designed to track and record an individual Internet user’s
4
communications.” See also In re Google Inc. Gmail Litig, 2013 WL 5423918 at *21 (California
5
Supreme Court has repeatedly interpreted CIPA broadly and “regularly reads statutes to apply to new
6
technologies where such a reading would not conflict with the statutory scheme”); People v. Nakai, 183
7
Cal. App. 4th 499, 518 (Cal. App. 2010) (computer “screenshots … fall within the ambit of a recording
8
device.”). The devices, instruments, contrivances, and scheme used by Facebook to record its user’s
9
communications fit the statutory scheme.
10
2. Invasion of Privacy and Intrusion Upon Seclusion
a.
11
Invasion of Privacy
Enshrined in the state Constitution, the California tort of invasion of privacy has three elements:
12
13
(1) a legally protected privacy interest; (2) a reasonable expectation of privacy; and (3) the intrusion
14
must be so serious as to constitute an egregious breach of social norms. Hill v. NCAA, 7 Cal.4th 1
15
(1994). The plaintiffs allege facts to support all three elements. Without consent, Facebook intercepted
16
billions of URLs appended to cookies that provided user identity (c_user, fr, lu), time and date (act),
17
location (locale) and other personal information. By associating multiple URLs with the same user, a
18
comprehensive picture of each subscriber’s personal life can be assembled with frightening detail, based
19
on data that Facebook was not authorized to receive. In short, there is a reasonable expectation of
20
privacy in aggregate web browsing history, even if not in any single URL.
21
The first court to address whether this wholesale surveillance of the Internet gives rise to a claim
22
for the tort of invasion of privacy was the California Superior Court, in Ung v. Facebook, Inc., No. 12-
23
CV-217244, Order (Cal Super. Ct. Santa Clara Cnty July 2, 2012), attached to the SAC as exhibit HH.
24
Yes, the Court found, “there is a legally protected privacy interest in a person’s identifiable browsing
25
history,” slip op. at 3, and using cookies to “track large portions of people’s browsing histories across
26
numerous other websites . . . constitutes a serious invasion of a privacy interest.” Id. at 5.12
27
12
28
Facebook may be collaterally estopped from challenging the Ung court’s factual ruling regarding
invasion of privacy. Though the decision was a denial of a demurer, Facebook opted not to seek
interlocutory appeal. “Once an issue has been resolved in a prior proceeding, there is no further fact
24
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
Every other court since Ung has reached the same conclusion. The Court of First Instance in
2
Belgium found that using Facebook’s browser-specific datr cookie to track web browsing (even without
3
evidence that datrs could be linked to actual users) violated “fundamental rights and freedoms.” SAC,
4
Ex. EE. In Google Cookie Placement, which this Court found to be factually “virtually
5
indistinguishable,” the Third Circuit held that even sophisticated internet users can “reasonably expect”
6
that URL queries would not be associated with each other without consent. Google Cookie Placement,
7
806 F.3d at 151. The Third Circuit specifically found that Google’s aggregation of the URLs
8
“intrud[ed] upon reasonable expectations of privacy” and allowed the California tort to proceed. Id.
9
The Third Circuit also found Google’s conduct to “constitute an egregious breach of social norms,” id.,
10
conduct which is nearly identical to that alleged here, in particular with respect to the IE Subclass.
11
Finally the French data protection authority (CNIL) recently followed the decision of the Belgian Court
12
of First Instance, finding Facebook’s use of the datr cookie to track web browsing to be neither fair nor
13
lawful without consent. See Grygiel Decl. Exs. 4 and 5.
14
Supreme Court Fourth Amendment jurisprudence mirrors these decisions and reflects the
15
growing and reasonable public desire to be free from electronic surveillance. See, e.g., United States v.
16
Jones, 132 S. Ct. 945, 955 (2012) (prolonged electronic location monitoring by government, even in
17
public spaces, violates reasonable privacy expectations). The Supreme Court repeated this logic in
18
unanimously deciding Riley v. California, 134 S. Ct. 2473, 2490 (2014), finding a legitimate privacy
19
interest in aggregated electronic data on a smart phone (including Internet history) even if any individual
20
item of data may not give rise to a legitimate interest. In the same way, internet users have a reasonable
21
expectation of privacy in the pervasive aggregation of web histories, even if they do not in a single URL.
22
Considering Jones and Riley, Judge Koh recently observed that “Justice Sotomayor was
23
particularly concerned with “the existence of a reasonable societal expectation of privacy in the sum of
24
one’s public movements.” In re Application for Telephone Information, 2015 WL 4594558 at * 8 (N.D.
25
26
27
28
finding function to be performed” in future cases. Murray v. Alaska Airlines, Inc., 50 Cal. 4th 860, 864
(2010). The Restatement (Second) of Judgments §27 cmt. d suggests the denial of a demurer might be
“final” for purposes of collateral estoppel because “an issue . . . submitted and determined on a motion
to dismiss for failure to state a claim” is a final judgment. This is true even if determination is “based on
a failure of pleading or of proof as well as on the sustaining of the burden of proof.” Id.
25
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
Cal., July 29, 2015) (quoting Jones) (emphasis added by Judge Koh). She further observed that Riley
2
also focused on the new technological ability to aggregate personal data, id. at *9, and concluded:
3
“Based on the preceding U.S. Supreme Court cases, the following principles are manifest: (1) an
4
individual’s expectation of privacy is at its pinnacle when government surveillance intrudes on the
5
home; (2) long-term government surveillance by the government implicates an individual’s expectation
6
of privacy; and (3) location data . . . can reveal a wealth of private information about an individual.” Id.
7
She then concluded that cell phone users have a legitimate expectation of privacy in the aggregate
8
collection of cell phone location data, even if there would not be in a single data point. “Such an
9
expectation is one that society is willing to recognize as reasonable.” Id.
10
In its Motion, however, Facebook ignores the tectonic jurisprudential shifts above and argues as
11
if the technological advances discussed above had never happened. Thus, Facebook relegates Ung to a
12
footnote and brushes it off as “wrongly decided” without offering any analysis. Facebook also never
13
mentions Google Cookie Placement and never mentions the recent decisions in Europe finding that
14
pervasive web tracking via the datr cookie violates fundamental freedoms absent consent. Facebook
15
also never mentions Jones, and disregards as mere dicta the Supreme Court’s ruling in Riley.
16
17
b.
Intrusion Upon Seclusion
The California tort of “intrusion upon seclusion” is similar to but distinct from the tort of
18
invasion of privacy and both are cognizable separately on the same facts. See, e.g., Google Cookie
19
Placement, 806 F.3d at 151. Specifically, unauthorized taking of electronic information can give rise to
20
an action for intrusion upon seclusion. Id. (unauthorized taking of personal Internet communications
21
under California law); Opperman, 87 F.Supp.3d at 1058-61 (unauthorized taking of personal contact
22
lists under California law).
23
24
i.
Facebook Intruded Upon a Private Matter
A plaintiff must plead the defendant intruded into “some zone of …privacy surrounding, or
25
obtained unwanted access to data about the plaintiff . . . [and] an objectively reasonable expectation” of
26
privacy in “the place, conversation or data source.” Shulman v. Group W. Productions, Inc., 18 Cal. 4th
27
200, 232 (1998). Facebook obtained unauthorized access to Plaintiffs’ computers and Internet
28
communications by (1) tracking users’ communications while they were logged-off of Facebook in
26
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
violation of Facebook’s own privacy policy and public promises; and (2) circumventing users’ privacy
2
settings on Internet Explorer. Plaintiffs’ SAC pleads “an objectively reasonable expectation of [privacy]
3
in the place, conversation or data source.” Id. at 232. This objectively reasonable expectation was
4
created (1) by Facebook when it explicitly promised not to track its users while they were logged-off;
5
and (2) by state and federal statutes, in particular, the Wiretap Act, Stored Communications Act, CIPA,
6
7
8
Pen Register Act, and other statutes plead in plaintiff’s petition. See SAC ¶ 17-27, 225. Plaintiffs also
had an objectively reasonable expectation of privacy that Facebook would not circumvent the chosen
privacy settings on plaintiffs’ web-browsers. Cf. Kewanee Oil v. Bicron, 416 U.S. 470, 487 (1974) (“A
9
most fundamental human right, that of privacy, is threatened when industrial espionage is condoned or is
10
11
made profitable; the state interest in denying profit to such illegal ventures is unchallengeable.”).
ii.
12
13
14
A Reasonable Person Could Find Facebook’s Behavior Highly
Offensive
“Highly offensive” is a mixed question of law and fact. Hill at 40. It is ultimately a jury
question unless a court determines that “as a matter of policy, such conduct should be considered, as a
15
matter of law, not highly offensive.” Taus v. Loftus, 151 P.3d 1185 (Cal. 2007). Congress and every
16
17
18
19
state has already made this policy decision by enacting criminal statutes against conduct like Facebook’s
that is inherently highly offensive or would not be punishable by incarceration -- violations of the
Wiretap Act, Pen Register Act, Stored Communications Act, CIPA, California Computer Crime Law
20
and Cal. Penal Code §§ 484, 496, 631 and 632 are each subject to prison terms. See, e.g. 18 U.S.C. §
21
2511(4)(a); 18 U.S.C. § 2701(b); and 18 U.S.C. § 1030(2)(B). California explicitly declared that
22
activities such as the SAC alleges are “serious threat[s] to the free exercise of personal liberties and
23
cannot be tolerated in a free and civilized society.” Cal. Crim. Code § 630. California’s Supreme Court
24
has held that “eavesdropping [or] wiretapping” gives rise to the tort of intrusion upon seclusion.
25
Shulman at 868.
26
Even if Facebook technically violated no law, its conduct would still be highly offensive.
27
Determining offensiveness requires consideration of all circumstances of the intrusion, including the
28
degree, setting, and intruder’s motives and objectives. Miller v. National Broadcasting Co., 187
27
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
Cal.App.3d 1463, 1483-84 (Ct. App. 1986); Hernandez v. Hillsides, Inc., 47 Cal. 4th 272 (Cal. 2009).
2
Facebook’s unauthorized intrusion involved the plaintiffs’ home computers and personal computing
3
devices. The Supreme Court has repeatedly emphasized the importance of privacy in a person’s home,
4
computer, and web-browsing history. See e.g., U.S. v. Jones, 132 S. Ct. 945 (2012); Riley v. California,
5
134 S. Ct. 2473 (2014). The degree and circumstances of the intrusion was so widespread and pervasive
6
that Facebook agreed to 20 years of independent privacy audits. SAC ¶ 111. Facebook’s motive and
7
objective of Facebook’s conduct was Facebook’s own financial gain at the expense of the privacy
8
interests of its millions of users, which is not enough to overcome its surreptitious theft of the plaintiffs’
9
personal information. Opperman, 87 F.Supp.3d at 1061 (“surreptitious theft of personal contact
10
11
12
information … has [not] come to [be] qualified as ‘routine commercial behavior’”).
3.
California Statutory Larceny
a.
The SAC Properly Alleges Claims for Statutory Larceny
13
The California Penal Code states that persons who defraud other persons of personal property by
14
false pretense are guilty of theft. Cal. Penal Code § 484(a). Cal. Penal Code § 496(c) provides a private
15
right of action for “[a]ny person who has been injured” by the sale of stolen property. Cal. Penal Code §
16
496(c). Thus, regardless of plaintiffs’ entitlement to a cause of action under § 484, due to the incorporation
17
of theft by false pretense by § 496, plaintiffs have alleged a claim for theft by false pretense.
18
b.
Personally Identifying Information is Property
19
Defendants cite In re Zynga Privacy Litig., 2011 WL 7479170 (N.D. Cal. June 15, 2011) and Low
20
v. LinkedIn Corp., 900 F.Supp.2d 1010, 1026 (N.D. Cal. 2012) (cases involving the California Unfair
21
Competition Law) in arguing PII is not “property” subject to Penal Code 496. See Motion at 39. However,
22
Section 496 does not define “property” and California courts have stated that anything that can be stolen
23
can be property under § 496. People v. Norwood, 26 Cal.App.3d 148, 157 (App. 2 Dist. 1972). California
24
has specifically recognized that one’s personal identifying information (“PII”) can be the object of theft,
25
and criminalizes the unauthorized use of same. See CTC Real Estate Services v. Lepe, 140 Cal.App.4th
26
856 (App. 2 Dist. 2006) (citing Cal. Penal Code § 530.5).
27
For the purposes of Chapter 8 (False Personation and Cheats) of Title 13 (Of Crimes Against
28
Property), the Penal Code defines “personal identifying information” as including, inter alia, any names,
28
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
addresses, personal identification numbers or passwords, unique electronic data, including information
2
identification numbers assigned to persons or addresses, and telecommunications identifying information
3
or access devices. Cal. Penal Code § 530.55(b). Much of the aforementioned information was contained
4
in the information Facebook collected from the plaintiffs as alleged in the SAC, and furthermore, the list
5
of PII set forth in § 530.55 ends with “or an equivalent form of identification.” Id.
6
Courts have explained that the word “property” signifies “something that one has the exclusive
7
right to possess and use.” People v. Kwok, 63 Cal.App.4th 1236, 1250–51 (App. 1 Dist. 1998) (interpreting
8
Cal. Civil Code § 654). Making unauthorized copies, whether of physical objects, trade secrets, or
9
computer data, is, then, theft. Kwok, 63 Cal. App.4th at 1251 (referencing Cal. Penal Code §§ 499c(b)(3)
10
and 502(c)(2)); see People v. Gopal, 171 Cal.App.3d 524 (App. 1 Dist. 1985) (trade secrets were property
11
under § 496). Such actions destroy “the intangible benefit and prerogative” of being able to control access
12
to such property. Id. Plaintiffs had the exclusive right to possess and use their PII, including their
13
respective browsing histories. Facebook interfered with this right. Plaintiffs’ information is property and
14
Facebook’s actions constituted theft under the California Penal Code.
15
c.
Plaintiffs Have Sufficiently Alleged Theft by False Pretenses
16
Echoing its “party to the communication” argument, Facebook claims that because it received the
17
information at issue “directly from Plaintiffs,” it was not stolen. Motion at 39. But the SAC alleges that,
18
when users logged into Facebook, various session cookies and tracking cookies were written to their
19
browsers. SAC ¶ 3. When the users’ browsers sent referer URLs to Facebook, they were appended to user-
20
identifying data without the users’ consent, which fundamentally changes the nature of the
21
communication. Plaintiffs, simply put, sent the URLs under false pretenses.
22
23
Incredibly, Facebook claims it “had no reason to believe the information was stolen, nor was it.”
Motion at 39. But this factual defense is not only inappropriate at the 12(b)(6) stage,
24
. Not only did
25
Facebook track and transmit plaintiffs’ data to itself without plaintiffs’ knowledge or consent, it
26
represented to plaintiffs that it was not doing so. SAC ¶¶ 23–25, 63, 85, 102. No inference is reasonable
27
other than Facebook intended these representations to induce plaintiffs to use its website and to allow
28
Facebook to continually collect valuable personal user information. SAC ¶ 227-f, 263–266, 278. In
29
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
choosing to contract with and use Facebook, plaintiffs relied on Facebook’s false representations. SAC ¶
2
267.13 Plaintiffs’ reliance can also be inferred from all of the circumstances. Harris v. Garcia, 734
3
F.Supp.2d 973, 989 (N.D. Cal. 2010) (citing People v. Wooten, 44 Cal.App.4th 1834, 1843 (1996).
4
d.
The Facts do not Preclude a Claim for Theft by False Pretenses
5
Facebook argues that it cannot have stolen plaintiffs’ property because plaintiffs’ browsers sent
6
“GET” requests to Facebook “as part of the Internet’s normal operation.” Motion at 39. A browser’s
7
sending a GET request to a website in order to view its content is part of the Internet’s normal operation.
8
But a website’s surreptitious installation of cookies on their browsers in order, post-log out, to collect
9
personal information, is not.
10
Facebook further elides the point in arguing it neither purchased plaintiffs’ property nor received
11
it from a third party. Liability, however, attaches from Facebook’s extraction of plaintiffs’ property
12
without their knowledge or consent, and without compensation.
13
Facebook then argues that because Facebook did not actually conceal or withhold plaintiffs’
14
browsing histories from them, plaintiffs have no Sec. 496 claim. However, Section 496 more broadly
15
reaches not only to persons who conceal or withhold property, but also those who sell property, and those
16
who “aid[] in concealing, selling, or withholding any property from the owner, knowing the property to
17
be so stolen or obtained.” Cal. Penal Code. § 496(a). But the facts alleged in the SAC show Facebook
18
cannot disclaim knowledge of the non-consensual manner in which plaintiffs’ personal information was
19
acquired. Facebook did sell its users’ personal information because it charged more to advertisers based
20
on this very information.
21
4.
Breach of Contract and Implied Covenant of Good Faith and Fair Dealing
As the SAC alleges, Facebook breached its contractual promises (both explicit and implicit) not
22
23
to track the web browsing of subscribers who had logged out. Facebook makes three argument in its
24
Motion to dismiss the breach of contract claim: (1) Facebook is not contractually bound by its own
25
Privacy Policy nor referenced Help Pages; (2) no damages; and (3) no allegations of plaintiffs’
26
27
28
13
Contrary to Facebook’s assertion that Plaintiffs have not properly pled the elements of theft by false
pretenses, all of the foregoing information in this paragraph was incorporated into Count XI of the SAC.
See SAC ¶ 286.
30
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
performance. Facebook makes these same arguments with respect to the implied covenant of good faith
2
and fair dealing, and also argues that the claim is merely duplicative of the contract claim.
3
a.
4
The Privacy Policy and Help Center Pages Are a Part of the SRR
Facebook remarkably posits that it is not contractually bound by its own Privacy Policy or Data
5
Use Policy, merely because the SAC “never identifies any section in the SRR that contained hyperlinks”
6
to the specifically relevant portions of the other documents. Motion at 34. However, under California
7
law, contracts can incorporate other documents by reference without hyperlinks or mentioning specific
8
provisions. So says the very case Facebook cites, Chan v. Drexel Burnham Lambert, Inc., 178
9
Cal.App.3d 632, 641 (1986). In Chan, a contract failed to incorporate a second document because the
10
second document was never identified; the contract simply included a term that required a signatory to
11
abide by unspecified other contracts governing membership in unspecified other organizations. The
12
Chan court distinguished that term from other contracts that “clearly referred to and identified the
13
incorporated documents.” Id. (citing King v. Larsen Realty, Inc., 121 Cal.Ap.3d 349 (1981)); see also
14
Baker v. Aubry, 216 Cal.App.3d 1259, 1264 (1989) (“The distinguishing factor in King, found lacking in
15
Chan, was the fact that the incorporated document was readily available to the appellants.”).
16
Here, the SRR clearly identifies and incorporates the Privacy Policy (and later Data Use Policy),
17
and the Privacy Policy clearly identifies and incorporates the Help Center pages,14 constituting the
18
“layered approach” that Facebook represented to Congress. SAC ¶¶ 21-23. Indeed, the very first term
19
of the SRR is called “Privacy” and Facebook represents that the Privacy Policy makes “important
20
disclosures about . . . how we collect and can use your content and information. We encourage you to
21
read the Privacy Policy, and to use it to help make informed decisions.” SAC, Ex. A. The Privacy
22
Policy, in turn, repeatedly references the SRR and even represents that the terms of the Privacy Policy
23
may be changed pursuant to the SRR, and that the Privacy Policy “applies to all information we have
24
about you.” It then contains links to the Help Pages. SAC, Ex. G, ¶ 9.
25
26
27
28
14
Facebook objects that copies of certain cited Help Center pages were not appended to the SAC.
However, plaintiffs requested these pages during discovery almost two years ago and Facebook has
refused to produce them. The parties are currently negotiating this point.
31
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
Other courts addressing this issue have implicitly found the Facebook SRR to incorporate the
2
Privacy Policy. Thus, for example, the breach of contract claim in In re Facebook Privacy Litigation
3
was premised on a contract consisting of both documents, see 791 F. Supp. 2d 705, 717 (N.D. Cal.
4
2011), and the Ninth Circuit later held that the complaint adequately pled breach of contract. See 572
5
Fed. Appx. 494 (9th Cir. 2014).15 While Facebook also argues it is not contractually bound by the
6
Privacy Policy, it routinely claims that subscribers are. So for example, in Cohen v. Facebook, Inc., 798
7
F. Supp. 2d 1090 (N.D. Cal. 2011), Facebook argued that subscribers consented to sharing names and
8
pictures based on the terms of the Privacy Policy. Id. at 1095; see also Campbell v. Facebook, Inc., 77
9
F. Supp. 3d 836, 846 (N.D. Cal. 2014) (“Facebook points to its ‘Statement of Rights and
10
Responsibilities’ and its ‘Data Use Policy,’ both of which must be agreed to by users in order to use the
11
Facebook website” (emphasis added)).
12
b.
13
Damages
The issue of contractual damages is addressed above in the “Standing” section, and include loss
14
of computer resources caused by the presence of the unauthorized cookies as well as loss of privacy.
15
The Ninth Circuit ruled that a complaint adequately pleads contract damages under California law on
16
almost identical facts. In re Facebook Privacy Litig., 572 Fed. Appx. at 494.
17
c.
Alleging Performance
18
In the SAC, plaintiffs alleged that they accepted the terms of the contract with Facebook, SAC ¶
19
247, and had active Facebook accounts during the entire class period. SAC ¶¶ 12-15. These allegations
20
are sufficient to generally allege their performance under the contract. Facebook, however argues in the
21
Motion that plaintiffs are required to allege that they did not breach negative obligations, i.e., provisions
22
of the SRR forbidding certain behavior. The only case cited by Facebook, however, does not support
23
this expansive view of notice pleading. In Bennett-wofford v. Bayview Loan Servicing, LLC, 2015 WL
24
8527333 (N.D. Cal. Dec. 11, 2015), plaintiffs alleged a breach of a contract to settle a case, a contract
25
which required the plaintiff to perform many things, including dismissing a complaint. Id. at *6. But a
26
review of the contact also reveals that plaintiffs had other ancillary contractual obligations, including
27
28
15
Because the Ninth Circuit decision is “final,” it is possible that Facebook is now collaterally estopped
from arguing that its SRR does not incorporate the Privacy Policy by reference.
32
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
agreeing that they had no intention to bring suit against a number of persons, and knew of no facts
2
constituting a basis for suit; they also agreed to cooperate and use best efforts, and also represented that
3
each had the authority to sign the contract. Nevertheless, the court found the following sentence
4
sufficient to plead performance: “The case was dismissed on March 11, 2013.” Id.
5
6
d.
Breach of Implied Covenant
In California, all contracts contain an implied term of good faith and fair dealing. Careau & Co.
7
v. Security Pacific Business Credit, Inc., 22 Cal. App.3d 1371, 1395 (1990). Facebook objects that
8
plaintiffs’ claim here is merely duplicative of the breach of contract claim, but plaintiffs’ claim is
9
brought in the alternative to the extent the promises made in the Help Pages or Privacy Policy are
10
deemed not to be contractually binding on Facebook. If these documents are contractually binding,
11
Facebook had a contractual duty to expire cookies each time a subscriber logged out. Failure to do so is
12
a breach of contract, and the breach of the implied covenant is superfluous. If, however, Facebook’s
13
Privacy Policy is deemed not to be contractually binding, Facebook’s actions –
14
– violate the implied covenant which would not be duplicative of the
15
excluded Privacy Policy terms.
16
5.
17
California Penal Code 502
The California’s Comprehensive Computer Data Access and Fraud Act protects persons from
18
unauthorized access to their computers, Cal. Penal Code § 502. Pursuant to section 502(e)(1),
19
individuals have a private right of action against persons causing them damage by reason of a violation
20
of any one of eight subsections 502(c); plaintiffs alleged violations of four subsections.
21
22
a.
Damage
No statutory minimum amount of damage is required for a section 502 claim, and Facebook cites
23
to none. The prevailing view is that “any amount of loss may be sufficient” under the statute. In re
24
Google Android Consumer Privacy Litig., 2013 WL 1283236 at *11 (N.D. Cal. Mar. 26, 2013).
25
Facebook failed to expire certain cookies upon logout,
26
. Facebook’s actions resulted in larger amounts of data being sent to Facebook’s servers
27
each and every time a subscriber communicated with Facebook-enabled websites. The amount of this
28
unauthorized extra data –stored and repeatedly transmitted throughout the day – is robust. See SAC ¶¶
33
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
58-60. Appending user-identifying cookies to billions of URLs allows Facebook to associate multiple
2
URLs with an actual person, painting a comprehensive picture of that person’s life, intruding upon a
3
reasonable expectation of privacy. This is injury under California law as discussed above and thus
4
satisfies “damage” under section 502.
5
6
b.
Permission
All relevant subsections of section 502(c) require that the defendant act “without permission.”
7
Courts routinely interpret “without permission” to mean “in a manner that circumvents technical or
8
code-based barriers in place to restrict or bar a user’s access.” Opperman, 87 F.Supp.3d at 1053.
9
Plaintiffs’ section 502 claim is therefore limited the IE Subclass. But as Facebook concedes (see Motion
10
at 27, fn. 15), the SAC alleges that Facebook circumvented the cookie blocking technology used by the
11
IE Subclass without permission. See Google Cookie Placement, 806 F.3d at 151 (Google circumvented
12
cookie blockers on browsers). Facebook argues that it disclosed the use of cookies generally, Motion at
13
27, fn. 15 (“the Privacy Policy informed users that Facebook used these cookies”), but the Third Circuit
14
rejected Google’s similar argument (“Google’s emphasis on tracking and disclosure amounts to a
15
smokescreen”) because the browser was only accessed after Google circumvented cookie blockers.
16
Google Cookie Placement, 806 F.3d. at 150.
17
c.
Contaminant
18
The statute defines computer contaminants to include (but are not limited to) “viruses or worms,
19
that are self-replicating or self-propagating and are designed to contaminate other computer programs or
20
computer data, consume computer resources, modify, destroy, record, or transmit data, or in some other
21
fashion usurp the normal operation of the computer.” Section 502(b)(10). As alleged in the SAC,
22
cookies fit this definition. Self-replicating, they copy themselves to each and every referrer URL sent to
23
24
25
26
27
28
Facebook, potentially hundreds of times a day for any subscriber, contaminating an otherwise
anonymous referrer URL with user identification. And they consume computer resources, both by
occupying computer storage and by increasing the size of communications sent to Facebook’s servers.
6.
Fraud
To state an action for fraud, a plaintiff must plead with specificity an intentional
misrepresentation of material fact with knowledge of its falsity and intent to induce reliance, actual
34
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
reliance, and damages proximately caused by the reliance. Gonsalves v. Hodgson, 38 Cal.2d 91, 100-
2
102 (Cal. 1951). Plaintiffs’ actual and constructive fraud claims satisfy Rule 9(b)’s specificity
3
requirement. Plaintiffs allege the “who” – Facebook and its employees and engineers, many by name.
4
Plaintiffs allege the “what” – surreptitious post-log out tracking contrary to Facebook’s promise.
5
Plaintiffs allege the “when” – during the class period (and during the IE Subclass period), prior to public
6
discovery of Facebook’s deceit. Plaintiffs allege the “where” – in the interactions between plaintiffs’
7
computers, third-party websites and Facebook’s servers. Plaintiffs allege the “how” – through
8
specifically identified, improperly planted cookies. Having falsely promised to delete user-identifying
9
tracking cookies from browsers after logout, Facebook was duty bound to make, and did not, a
10
corrective disclosure.
11
Facebook does not deny that the SAC alleges all of the elements necessary to establish fraud;
12
instead, Facebook argues in the Motion that the elements were not sufficiently pled. First, Facebook’s
13
fraud was intentional – Facebook cites Engalla v. Permanente, 15 Cal. 4th 951, 976 (1997),16 in arguing
14
that “[f]raud requires intent to induce, not just knowledge of falsity.” Motion at 22. Fraud’s elements
15
are not at issue. The facts are. Plaintiffs allege facts showing Facebook’s intent to deceive – which must
16
be taken as true on this dismissal motion. Facebook’s arguments from other cases with fully developed
17
factual records cannot defeat those facts – which allege Facebook making a false promise and
18
knowingly breaking it. See SAC ¶¶ 4, 23-27, 63, 66, and 68-73.
19
Facebook’s engineering director
20
21
SAC ¶ 74. And Facebook
. See SAC ¶ 78 (“
22
”). Were more
23
needed, Facebook’s effort to patent its post-log out tracking method confirms inftent. See SAC ¶¶ 79-
24
84. Further confirming Facebook’s intent, when caught, Facebook blamed post-log out tracking on “a
25
bug.” SAC ¶ 105. But Facebook’s internal emails
See also SAC ¶¶ 75-76.
26
27
28
16
Engalla also involved a well-developed factual record of twelve depositions and thirteen motions
demonstrating the fraudulent inducement that invalidated an arbitration agreement. Engalla, 15 Cal. 4th
at 914. Even without depositions plaintiffs have pleaded facts demonstrating Facebook’s fraud.
35
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
Facebook’s assertion that the “SAC fails to allege that Facebook intended to induce reliance or
2
conduct,” Memo at 23, simply cannot be squared with the SAC’s factual allegations that (a) Facebook
3
wanted to track users; (b) logged out users posed an obstacle to that desire; and (c) Facebook developed
4
a way of tracking logged out users (d) all the while internally admitting that Facebook’s public promises
5
were to the contrary. These are not “bare allegations” of concealment. Besides, although intent can be
6
alleged generally (Fed. R. Civ. P. 9(b)), Plaintiffs allege facts showing intent. See, e.g., SAC ¶¶ 69 (“
7
8
9
.”), 75 (“
).
Plaintiffs’ SAC also specifically pleads Facebook’s false promises to not track logged-off users.
10
See SAC ¶¶ 4, 23, 24, 27, 74, 78. It also specifically pleads the plaintiffs “relied on Facebook’s false
11
assertions in contracting with and using Facebook.” SAC ¶ 267. Plaintiffs, relying on Facebook’s
12
promises, visited numerous websites while logged out without any inkling that Facebook was tracking
13
their post-log out comings and goings. SAC ¶¶ 5, 115 (Davis), 118 (Quinn), 121 (Lentz), 124 (Vickery).
14
Facebook’s argument about the alleged inspecificity of the reliance allegations ignores the
15
governing law permitting generalized reliance claims. See Anthony v. Yahoo, Inc., 421 F. Supp. 2d
16
1257, 1264 (N.D. Cal. 2006) (reliance element not required to meet heightened Rule 9(b) standard) See
17
also Interserve, Inc. v. Fusion Garage PTE, Ltd., 2011 WL 500497, at *3 (N.D. Cal. Feb. 9, 2011).
18
Facebook’s internal emails also support the reliance element at this stage. In re Clorox Consumer Litig.,
19
894 F. Supp. 2d 1224 (N.D. Cal. Aug. 24, 2012), is instructive. There the court found allegations
20
identifying commercials “upon which the Plaintiffs allegedly relied” and their “contents,” when they
21
aired, plus the allegation that plaintiffs purchased in reliance on the advertisements was “detailed
22
information…sufficient to place Clorox on notice of the basis of Plaintiffs’ claims and demonstrates that
23
Plaintiffs are not on a fishing expedition.” Id. at 1234. Just as the Clorox defendant was sufficiently
24
apprised of the claims to be able “to locate and produce videos” of the allegedly false commercials,
25
Facebook was able to produce emails corresponding precisely to the fraud Plaintiffs claim.
26
Facebook’s claim that no “immediate” causal link exists between Facebook’s misrepresentation and
27
Plaintiffs’ injurious behavior” (Def. Memo at 24) ignores the totality of facts showing that absent
28
Facebook’s falsehood, Plaintiffs “‘would not, in all probability, have entered into the contract’” of use
36
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
with Facebook. Clear Solutions, Inc. v. Clear Channel Comm., 365 F. 3d 835, 840 (9th Cir. 2004)
2
(reliance on truth of fraudulent statement need not be sole or predominant factor influencing plaintiff’s
3
behavior, discussing California law’s recognition of “‘highly subjective nature of a causation analysis’”
4
and noting cases saying causation is usually a jury question (quoting Alliance Mortgage Co. v. Rothwell,
5
10 Cal. 4th 1226, 1239 (1995)). That argument also ignores the SAC’s allegations that plaintiffs never
6
consented to Facebook’s tracking (SAC ¶ 125), never changed the default cookie blocking settings that
7
Facebook evaded (SAC ¶ 126), or employed devices to prevent Facebook’s post-log out information
8
gathering. SAC ¶ 127.
9
Plaintiffs have also sufficiently alleged damages (specific and general) proximately resulting
10
from Facebook’s fraud.17 Cause and effect, sufficient for this pleadings stage, is clear. See Interserve,
11
2011 WL 500497, at * 2 (Rule 9(b) purposes do not require heightened damages specificity). Facebook
12
secretly collected, post-log out, plaintiffs’ confidential personal information. See, e.g., SAC ¶¶ 113-115,
13
Davis); 116-118 (Quinn); 119-121 (Lentz); 122-124 (Vickery). That information has economic value on
14
its own (see SAC ¶¶ 129-143), and is further protected by statutory damages under the ECPA, CIPA,
15
and Cal. Penal Code § 502. No more direct cause-and-effect allegation is necessary, under Moncada v.
16
West Coast Quartz Corp., 221 Cal. App. 4th 768, 776 (2013), or any other case.
17
Plaintiffs also sufficiently alleged affirmative falsity. Facebook falsely represented its post-
18
logout cookie practices on its Help Center pages, which plaintiffs were directed to by the Privacy Policy.
19
When the public learned of the practice, Congress held hearings and the FTC required two decades of
20
privacy audits. Facebook admitted it lacked consent to track post-logout. Facebook cannot now argue
21
no falsity. Moreover, having made that false statement Facebook concomitantly had “a duty to disclose”
22
the truth of post log-out tracking. If the telling of a “half-truth” triggers a duty to disclose the full truth,
23
Facebook’s flat-out lie that it does not track post-log out surely compels corrective disclosure. See, e.g.,
24
Barnes & Noble, Inc. v. LSI Corp., 849 F. Supp. 2d 925, 936 (N.D. Cal. 2012) (“where a party
25
volunteers information…‘the telling of a half-truth calculated to deceive is fraud’” (citation omitted);
26
House of Stuart, Inc. v. Whirlpool Corp., 33 F. 3d 58, 3 (9th Cir. 1994) (unpub.) (“Absent a fiduciary
27
28
17
Facebook should be precluded from arguing this issue under the doctrine of collateral estoppel based on the
Ninth Circuit’s ruling in In re Facebook Privacy Litig., 572 Fed. Appx. 494 (9th Cir. 2014).
37
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
relationship, a duty to disclose arises only where there are ‘special circumstances,’ such as when the
2
party in fault creates a false or misleading impression in the first instance.” (citation omitted)).
3
Finally, plaintiffs have also asserted a claim for constructive fraud. For example, in Dealertrack,
4
Inc. v. Huber, 460 F. Supp. 2d 1177 (C.D. Cal. 1177) “a confidential relationship was created” when the
5
parties executed a Mutual Confidentiality Agreement for evaluating information concerning a possible
6
business deal. Reaching Facebook’s adhesive contract with Plaintiffs, the rule is that “‘[a]s a general
7
principle constructive fraud comprises any act, omission, or concealment involving a breach of legal or
8
equitable duty, trust or confidence which results in damage to another even though the conduct is not
9
otherwise fraudulent.’” Id. at 1183 (citation omitted). Factors elevating a contractual relationship into a
10
confidential one are present here. See Portney v. CIBA Vision Corp., 2008 WL 5505517, at * 5 (C. D.
11
Cal. July 17, 2008). Facebook had superior technological “sophistication and bargaining power” and
12
Plaintiffs’ reliance on Facebook’s privacy promises were “‘so substantial as to give rise to equitable
13
concerns.’” Id. (citation omitted). Facebook’s other constructive fraud cases are not to the contrary.18
14
7.
Trespass to Chattels
15
“Under California common law, the tort of trespass to chattel encompasses unauthorized access to
16
a computer system where ‘(1) defendant intentionally and without authorization interfered with plaintiff's
17
possessory interest in the computer system; and (2) defendant's unauthorized use proximately resulted in
18
damage to plaintiff.’” Craigslist Inc. v. 3Taps Inc., 942 F. Supp. 2d 962, 980 (N.D. Cal. 2013) (quoting
19
eBay, Inc. v. Bidder’s Edge, Inc., 100 F. Supp. 2d 1058, 1069-70 (N.D. Cal. 2000) (further citation
20
omitted)). Plaintiffs adequately allege, among other things, that Facebook placed cookies on their
21
computers post-logout without their consent, allowing Facebook to track their activity without permission
22
and interfering with plaintiffs’ use of their computers, and were harmed by the loss of otherwise valuable
23
private information. See SAC ¶¶ 129-43, 270-73. Such claim is proper both for the IE Subclass, members
24
of which never consented to any cookies, and by the entire class to the extent Facebook exceeded the
25
scope of consent. See eBay, 100 F. Supp. 2d at 1069-70 (“California does recognize a trespass claim
26
where the defendant exceeds the scope of consent”).
27
18
28
In addition, whether a confidential relationship exists is generally a fact question, see Patriot Sci.
Corp. v. Korodi, 504 F. Supp. 2d 952, 966 (S.D. Cal. 2007) and plaintiffs’ allegations at minimum
generate that question.
38
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
Defendant misreads Hamidi, which held a plaintiff need only allege that the defendant’s access
2
caused some “actual damage.” Intel Corp. v. Hamidi, 30 Cal. 4th 1342, 1357 (2003) (citing Prosser &
3
Keeton, Torts (5th ed. 1984), § 15). But damage is defined broadly; “who intentionally intermeddles with
4
another’s chattel is subject to liability only if his intermeddling is harmful to the possessor’s materially
5
valuable interest in the physical condition, quality, or value of the chattel, or if the possessor is deprived
6
of the use of the chattel for a substantial amount of time, or some other legally protected interest of the
7
possessor is affected.” Id. at 1351 (quoting Rest. 2d of Torts § 218) (emphasis added). Here, unlike in In
8
re iPhone Application Litigation, 2011 WL 4403963, at *13-14 (N.D. Cal. Sept. 20, 2011), plaintiffs
9
adequately allege ”actual damage” under Hamidi, including that the activity affects Plaintiffs’ “legally
10
protected interest” in the privacy of their communications and website browsing. Defendant’s cookies
11
interfere with the “ordinary and intended operation” of Plaintiffs’ computers, including by circumventing
12
various privacy protections (¶¶ 85-101) and tracking Facebook users when the users intended to log out
13
of Facebook and not be tracked (¶¶ 63-84).
14
What Defendant calls “trivial,” LaCourt v. Specific Media, Inc., 2011 WL 1661532, at *7 (C.D.
15
Cal. Apr. 28, 2011), is a question of fact not susceptible for resolution at this stage. See Coupons, Inc. v.
16
Stottlemire, 2008 WL 3245006, at *6 (N.D. Cal. July 2, 2008) (denying motion to dismiss trespass to
17
chattels claim, finding that the defendants’ “trivial” interference argument “premature” here there were
18
not enough facts for the court to make a determination). If “other operators of parasitic websites widely
19
replicated the defendants’ conduct, the plaintiffs’ business and computer operations would surely suffer.”
20
Atl. Recording Corp. v. Serrano, 2007 WL 46128921, at * 5 (S.D. Cal. Dec. 28, 2007) (citing Hamidi, 30
21
Cal. 4th at 1354-57). Defendant’s conduct, if condoned, would give other “parasitic” websites reason to
22
replicate similar conduct.
23
24
25
26
27
28
39
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
2
3
V.
CONCLUSION
Plaintiffs request that the Court deny Facebook’s Motion and allow discovery to continue.
Dated: February 18, 2016
4
KIESEL LAW LLP
8
By:
/s/ Paul R. Kiesel
Paul R. Kiesel (SBN 119854)
8648 Wilshire Blvd.
Beverly Hills, CA 90211-2910
Telephone: (310) 854-4444
Facsimile: (310) 854-0812
kiesel@kiesel-law.com
9
Interim Liaison Counsel
5
6
7
10
SILVERMAN, THOMPSON, SLUTKIN &
WHITE LLC
KAPLAN, FOX & KILSHEIMER LLP
16
By: /s/ Stephen G. Grygiel
Stephen G. Grygiel (admitted pro hac vice)
201 N. Charles St., #2600
Baltimore, MD 21201
Telephone (410) 385-2225
Facsimile: (410) 547-2432
sgrygiel@mdattorney.com
17
Interim Co-Lead Counsel
By:
/s/ David A. Straite
Frederic S. Fox (admitted pro hac vice)
David A. Straite (admitted pro hac vice)
850 Third Avenue
New York, NY 10022
Telephone: (212) 687-1980
Facsimile: (212) 687-7714
dstraite@kaplanfox.com
11
12
13
14
15
18
19
20
21
Laurence D. King (206423)
Mario Choi (243409)
350 Sansome Street, 4th Floor
San Francisco, CA 94104
Tel.: (415) 772-4700
Fax: (415) 772-4707
lking@kaplanfox.com
22
Interim Co-Lead Counsel
23
24
25
26
27
28
40
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
1
ATTESTATION OF E-FILED SIGNATURE
2
I, David A. Straite, court-appointed interim lead counsel for the proposed Class, am the ECF
3
User whose ID and password are being used to file the foregoing. In compliance with Civil L.R. 5-
4
1(i)(3), I hereby attest that Paul R. Kiesel and Stephen Grygiel have concurred in this filing.
5
6
/s/ David A. Straite
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
1
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?