In Re FACEBOOK INTERNET TRACKING LITIGATION

Filing 107

EXHIBITS re #104 Administrative Motion to File Under Seal Exhibit 2 to Declaration of David A. Straite filed byFacebook Inc.. (Attachments: #1 Exhibit 2 HIGHLIGHTED UNREDACTED to Decl. of David A. Straite)(Related document(s) #104 ) (Brown, Matthew) (Filed on 2/22/2016)

1
2
3
4
5
6
7

COOLEY LLP
MICHAEL G. RHODES (116127)
([e-mail])
MATTHEW D. BROWN (196972)
([e-mail])
JEFFREY M. GUTKIN (216083)
([e-mail])
KYLE C. WONG (224021)
([e-mail])
101 California Street
5th Floor
San Francisco, CA 94111-5800
Telephone:
[phone]
Facsimile:
[phone]

8
9

Attorneys for Defendant
FACEBOOK, INC.

10
UNITED STATES DISTRICT COURT
11
NORTHERN DISTRICT OF CALIFORNIA
12
SAN JOSE DIVISION
13
14
In re: Facebook Internet Tracking Litigation

Case No. 5:12-md-02314 EJD

15
16
17
18
19
20
21
22

DECLARATION OF NATALIE NAUGLE IN
SUPPORT OF DEFENDANT FACEBOOK,
INC.’S RESPONSE TO PLAINTIFFS’
ADMINISTRATIVE MOTION TO FILE
UNDER SEAL
DATE:
TIME:
JUDGE:
COURTROOM:
TRIAL DATE:

April 28, 2016
9:00 a.m.
Hon. Edward J. Davila
4
Not Yet Set

[PUBLIC REDACTED VERSION]

23

Exhibit 2

24

to Declaration of David A. Straite Motion

25

[Re: ECF No.104-3]

26
27

REDACTED VERSION OF DOCUMENTS SOUGHT TO BE SEALED

28
COOLEY LLP
ATTORNEYS AT LAW
SAN FRANCISCO

DECL. OF NATALIE NAUGLE I/S/O FACEBOOK,
INC.’S RESPONSE TO PLFS’ ADMIN MOTION TO
FILE UNDER SEAL – Case No. 5:12-md-02314 EJD

EXHIBIT 2
TO
DECLARATION OF
DAVID A. STRAITE

FILED UNDER SEAL

1
2
3
4
5

Stephen G. Grygiel (admitted pro hac vice)
SILVERMAN THOMPSON
SLUTKIN WHITE LLC
201 N. Charles Street, 26TH Floor
Baltimore, MD 21201
Tel.: [phone]
Fax: [phone]
[e-mail]

6

Frederic S. Fox (admitted pro hac vice)
David A. Straite (admitted pro hac vice)
KAPLAN FOX & KILSHEIMER LLP
850 Third Avenue, 14th Floor
New York, NY 10022
Tel.: [phone]
Fax: [phone]
[e-mail]
Laurence D. King (206423)
Mario Choi (243409)
KAPLAN FOX & KILSHEIMER LLP
350 Sansome Street, 4th Floor
San Francisco, CA 94104
Tel.: [phone]
Fax: [phone]
[e-mail]

7
8
9
10
11
12
13

UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
SAN JOSE DIVISION

14
No. 5:12-md-02314-EJD

15
16
17
18
19
20
21

IN RE: FACEBOOK, INC. INTERNET
TRACKING LITIGATION

PLAINTIFFS’ MEMORANDUM OF POINTS
AND AUTHORITIES IN OPPOSITION TO
FACEBOOK’S MOTION TO DISMISS
Date:
Time:
Place:
Judge:

April 28, 2016
9:00am
Courtroom 4
Hon. Edward J. Davila

22
23
24
25

REDACTED VERSION OF DOCUMENT SOUGHT TO BE SEALED

26
27
28

PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

TABLE OF CONTENTS

1
2

I.

INTRODUCTION ............................................................................................................................. 1

3

II.

FACTUAL AND PROCEDURAL BACKGROUND....................................................................... 1

4

III. LEGAL STANDARDS ..................................................................................................................... 3

5

A. Pleading Standards ....................................................................................................................... 3

6

B. Collateral Estoppel ....................................................................................................................... 3

7
IV. ARGUMENT ..................................................................................................................................... 4
8
A. Plaintiffs Have Article III Standing ............................................................................................. 4

9
10

1. Standing May Exist Solely by Virtue of Statutes .................................................................. 4

11

2. Viable State-Law Claims are a Basis for Standing ................................................................ 4

12

3. Plaintiffs Have Pled Actual Injury to Them .......................................................................... 7

13

4. In the Alternative, Standing Should Be Resolved at a Later Stage ....................................... 9

14

B. Plaintiffs Have Adequately Pled Federal Claims Under the ECPA ............................................ 9

15

1. Specificity of Pleadings ......................................................................................................... 9

16
2. The Wiretap Act ................................................................................................................... 10

17

3. The Stored Communications Act ......................................................................................... 18

18
19

C. Plaintiffs Have Adequately Pled California Law Claims .......................................................... 22

20

1. The California Invasion of Privacy Act (“CIPA”) ............................................................... 22

21

2. Invasion of Privacy and Intrusion Upon Seclusion.............................................................. 24

22

3. California Statutory Larceny................................................................................................ 28

23

4. Breach of Contract and Implied Covenant of Good Faith and Fair Dealing ....................... 30

24
5. California Penal Code 502 ................................................................................................... 33
25
6. Fraud .................................................................................................................................... 34

26

7. Trespass to Chattels ............................................................................................................. 38

27
28

V.

CONCLUSION ................................................................................................................................ 40
i
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

TABLE OF AUTHORITIES

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

Cases
Alliance Mortgage Co. v. Rothwell,
10 Cal. 4th 1226 (1995) ......................................................................................................................... 37
Amchem Prods., Inc. v. Windsor,
521 U.S. 591 (1997) ................................................................................................................................ 9
Anthony v. Yahoo, Inc.,
421 F. Supp. 2d 1257 (N.D. Cal. 2006) ................................................................................................ 36
Ashcoft v. Iqbal,
556 U.S. 662 (2009) ............................................................................................................................ 3, 8
Atl. Recording Corp. v. Serrano,
2007 WL 46128921 (S.D. Cal. Dec. 28, 2007)..................................................................................... 40
Baker v. Aubry,
216 Cal.App.3d 1259 (1989) ................................................................................................................ 31
Barnes & Noble, Inc. v. LSI Corp.,
849 F. Supp. 2d 925 (N.D. Cal. 2012) .................................................................................................. 37
Bell Atlantic Corp. v. Twombly,
550 U.S. 544 (2007) ................................................................................................................................ 3
Bennett-wofford v. Bayview Loan Servicing, LLC,
2015 WL 8527333 (N.D. Cal. Dec. 11, 2015) ...................................................................................... 32

18
19
20
21
22
23
24

Brodheim v. Cry,
584 F.3d 1262 (9th Cir. 2009) ................................................................................................................ 3
Brown v. Waddell,
50 F.3d 285 (4th Cir. 1995) ................................................................................................................... 12
Campbell v. Facebook, Inc.,
77 F. Supp. 3d 836 (N.D. Cal. 2014) .................................................................................................... 32
Cantrell v. City of Long Beach,
241 F.3d 674 (9th Cir. 2001) ................................................................................................................... 5

25
26
27
28

Careau & Co. v. Security Pacific Business Credit, Inc.,
22 Cal. App.3d 1371 (1990) ................................................................................................................. 33
Chan v. Drexel Burnham Lambert, Inc.,
178 Cal.App.3d 632 (1986) .................................................................................................................. 31
ii
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1
2
3
4
5
6

Chance v. Avenue A,
165 F.Supp.2d 1153 (W.D. Wash. 2001) .............................................................................................. 19
Clear Solutions, Inc. v. Clear Channel Comm.,
365 F. 3d 835 (9th Cir. 2004) ................................................................................................................ 37
Cohen v. Facebook, Inc.,
798 F. Supp. 2d 1090 (N.D. Cal. 2011) ................................................................................................ 32
Coupons, Inc. v. Stottlemire,
2008 WL 3245006 (N.D. Cal. July 2, 2008) ......................................................................................... 40

7
8
9
10
11
12
13

Craigslist Inc. v. 3Taps Inc.,
942 F. Supp. 2d 962 (N.D. Cal. 2013) .................................................................................................. 39
Crispin v. Audigier,
717 F.Supp.2d 965 (C.D. Cal. 2010) .................................................................................................... 19
Crowley v. Cybersource Corp.,
166 F.Supp.2d 1263 (N.D. Cal. 2001) ............................................................................................ 14, 16
CTC Real Estate Services v. Lepe,
140 Cal.App.4th 856 (App. 2 Dist. 2006) ............................................................................................. 28

14
15
16
17
18
19
20

eBay, Inc. v. Bidder’s Edge, Inc.,
100 F. Supp. 2d 1058 (N.D. Cal. 2000) ................................................................................................ 39
Edwards v. First American Corp.,
610 F.3d 514 (9th Cir. 2010) .................................................................................................................. 4
Ehling v. Monmouth,
961 F.Supp.2d 659 (D. N.J. 2013) ........................................................................................................ 19
Engalla v. Permanente,
15 Cal. 4th 951 (1997) ........................................................................................................................... 35

21
22
23
24
25
26
27

Erickson v. Pardus,
551 U.S. 89 (2007) .................................................................................................................................. 8
Erie Railroad Co. v. Tompkins,
304 U.S. 64 (1938) .................................................................................................................................. 5
Flanagan v. Flanagan,
27 Cal. 4th 766 (2002) ........................................................................................................................... 23
FMC Corp. v. Boesky,
852 F.2d 981 (7th Cir. 1988) ................................................................................................................... 5

28
iii
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1
2
3
4
5
6

Freedman v. AOL,
325 F.Supp.2d 638 (E.D. Va. 2004) ..................................................................................................... 19
Gonsalves v. Hodgson,
38 Cal.2d 91 (Cal. 1951) ....................................................................................................................... 35
Guaranty Trust Co. v. York,
326 U.S. 99 (1945) .................................................................................................................................. 5
Harris v. Garcia,
734 F.Supp.2d 973 (N.D. Cal. 2010) .................................................................................................... 30

7
8
9
10
11
12
13

Heinrichs v. Valley View Development,
474 F.3d 609 (9th Cir. 2007) .................................................................................................................. 3
Heldt v. Tata Consultancy Servs., Ltd.,
2015 WL 5542303 (N. D. Cal. Sep. 18, 2015) ..................................................................................... 10
Hernandez v. Hillsides, Inc.,
47 Cal. 4th 272 (Cal. 2009) ................................................................................................................... 28
Hill v. NCAA,
7 Cal.4th 1 (1994) .................................................................................................................................. 24

14
15
16
17
18
19
20

House of Stuart, Inc. v. Whirlpool Corp.,
33 F. 3d 58 (9th Cir. 1994) .................................................................................................................... 37
In re Anthem, Inc. Data Breach Litig.,
5:15-MD-2617-LHK, Order on Motion to Dismiss, Slip Op. (N.D. Cal. Feb. 14, 2016) .................. 7, 9
In re Application for Pen Register,
396 F.Supp.2d 45 (D. Mass. 2005) ................................................................................................. 13, 23
In re Application for Telephone Information,
2015 WL 4594558 (N.D. Cal., July 29, 2015) ...................................................................................... 26

21
22
23
24
25
26
27

In re Carrier IQ, Inc., Consumer Privacy Litig.,
78 F. Supp. 3d 1051 (N.D. Cal. 2015) ........................................................................................ 9, 14, 18
In re Clorox Consumer Litig.,
894 F. Supp. 2d 1224 (N.D. Cal. Aug. 24, 2012) ................................................................................. 36
In re Facebook Internet Tracking Litigation,
2015 WL 6438744 (N.D. Cal. Oct. 23, 2015)................................................................................ passim
In re Facebook Privacy Litigation,
791 F. Supp. 2d 705 (N.D. Cal. 2011) .................................................................................................. 32

28
iv
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1
2
3
4
5
6

In re Facebook Privacy Litigation,
572 Fed.Appx. 494 (9th Cir. 2014) .............................................................................................. 7, 32, 37
In re Google Android Consumer Privacy Litig.,
2013 WL 1283236 (N.D. Cal. Mar. 26, 2013) ...................................................................................... 33
In re Google Inc. Cookie Placement Consumer Privacy Litig.,
806 F.3d 125 (3d Cir. Nov. 10, 2015 as amended Nov. 12, 2015) ................................................ passim
In re Google Inc. Gmail Litig.,
2013 WL 5423918 (N.D. Cal. Sep. 26, 2013) .......................................................................... 17, 18, 24

7
8
9
10
11
12
13

In re Google, Inc. Privacy Policy Litig.,
2013 WL 6248499 (N.D. Cal., Dec. 3, 2013) ....................................................................................... 18
In re iPhone Application Litigation,
2011 WL 4403963 (N.D. Cal. Sept. 20, 2011) ..................................................................................... 39
In re Target Corp. Data Sec. Breach Litig.,
66 F. Supp. 3d 1154 (D. Minn. 2014) ..................................................................................................... 9
In re Zynga Privacy Litig.,
2011 WL 7479170 (N.D. Cal. June 15, 2011) ...................................................................................... 28

14
15
16
17
18
19
20

In re Zynga Privacy Litigation,
750 F.3d 1098 (9th Cir. 2014) ............................................................................................................... 11
Intel Corp. v. Hamidi,
30 Cal. 4th 1342 (2003) .................................................................................................................. 39, 40
Interserve, Inc. v. Fusion Garage PTE, Ltd.,
2011 WL 500497 (N.D. Cal. Feb. 9, 2011) .................................................................................... 36, 37
Kewanee Oil v. Bicron,
416 U.S. 470 (1974) .............................................................................................................................. 27

21
22
23
24
25
26
27

King v. Larsen Realty, Inc.,
121 Cal.Ap.3d 349 (1981) .................................................................................................................... 31
Kirch v. Embarq,
702 F.3d 1245 (10th Cir. 2012) ............................................................................................................. 17
Konop v. Hawaiian Airlines, Inc.,
302 F.3d 868 (9th Cir. 2002) ................................................................................................................. 13
LaCourt v. Specific Media, Inc.,
2011 WL 1661532 (C.D. Cal. Apr. 28, 2011) ...................................................................................... 39

28
v
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1
2
3
4
5
6

Landers v. Quality Communications, Inc.,
771 F. 3d 638 (9th Cir. 2015) .................................................................................................................. 8
Los Coyotes Band of Cahuilla and Cupeno Indians v. Jewell,
729 F. 3d 1025 (9th Cir. 2013) .............................................................................................................. 20
Love v. United States,
915 F.2d 1242 (9th Cir. 1988) ................................................................................................................. 3
Low v. LinkedIn Corp.,
900 F.Supp.2d 1010 (N.D. Cal. 2012) .................................................................................................. 28

7
8
9
10
11
12
13

Mendiondo v. Centinela Hosp. Med. Center,
521 F.3d 1097 (9th Cir. 2008) ................................................................................................................. 3
Microsoft v. Does 1-8,
14-cv-00811-LO-IDD (E.D. Va. July 20, 2015) ................................................................................... 19
Miller v. National Broadcasting Co.,
187 Cal.App.3d 1463 (Ct. App. 1986) .................................................................................................. 28
Moncada v. West Coast Quartz Corp.,
221 Cal. App. 4th 768 (2013) ................................................................................................................ 37

14
15
16
17
18
19
20

Murray v. Alaska Airlines, Inc.,
50 Cal. 4th 860 (2010) .......................................................................................................................... 25
Mycogen Corp. v. Monsanto Co.,
28 Cal. 4th 888 (2002) ............................................................................................................................ 3
Nat’l Council of La Raza v. Cegavske,
800 F. 3d 1032 (9th Cir. 2015) ................................................................................................................ 8
Obama v. Klayman,
800 F.3d 559 (D.C. Cir. 2015) ................................................................................................................ 8

21
22
23
24
25
26
27

Opperman v. Path,
87 F.Supp.3d 1018 (N.D. Cal. 2014) .................................................................................. 18, 26, 28, 34
Palomar Mobilehome v. San Marcos,
989 F.2d 362 (9th Cir. 1993) .................................................................................................................. 3
People v. Gopal,
171 Cal.App.3d 524 (App. 1 Dist. 1985) .............................................................................................. 29
People v. Kwok,
63 Cal.App.4th 1236 (App. 1 Dist. 1998) ............................................................................................. 29

28
vi
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1
2
3
4
5
6

People v. Nakai,
183 Cal. App. 4th 499 (Cal. App. 2010) ................................................................................................ 24
People v. Norwood,
26 Cal.App.3d 148 (App. 2 Dist. 1972) ................................................................................................ 28
People v. Wooten,
44 Cal.App.4th 1834 (1996) ................................................................................................................. 30
Potter v. Havlicek,
2008 WL 2556723 (S.D. Ohio June 23, 2008) ..................................................................................... 15

7
8
9
10
11
12
13

Quon v. Arch Wireless,
529 F.3d 892 (9th Cir. 2008) ................................................................................................................. 19
Reno v. ACLU,
521 U.S. 844 (1997) .............................................................................................................................. 11
Rhodes v. Graham,
37 S.W.2d 46 (Ky. App. 1931) ............................................................................................................... 6
Riley v. California,
134 S.Ct. 2473 (2014) ............................................................................................................... 19, 25, 28

14
15
16
17
18
19
20

San Remo Hotel v. San Francisco,
545 U.S. 323 (2005) ................................................................................................................................ 3
Scott v. Kuhlmann,
746 F.2d 1377 (9th Cir. 1984) ............................................................................................................... 17
Segan LLC v. Zynga,
2015 WL 5315945 (N.D. Cal. Sept. 10, 2015) ..................................................................................... 21
Shefts v. Petrakis,
2012 WL 4049484 (C.D. Ill. Sep. 13, 2012)......................................................................................... 17

21
22
23
24
25
26
27

Shulman v. Group W. Productions, Inc.,
18 Cal. 4th 200 (1998) ..................................................................................................................... 26, 27
Sierra Club v. Morton,
405 U.S. 727 (1972) ................................................................................................................................ 5
Starr v. Baca,
652 F. 3d 1202 (9th Cir. 2011) .......................................................................................................... 8, 10
Taus v. Loftus,
151 P.3d 1185 (Cal. 2007) .................................................................................................................... 27

28
vii
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1
2
3
4
5
6

Theofel v. Farey-Jones,
359 F.3d 1066 (9th Cir. 2004) ............................................................................................................... 21
U.S. Telecom Ass’n v. FCC,
227 F.3d 450 (D.C. Cir. 2000) .............................................................................................................. 12
U.S. v. Councilman,
245 F.Supp.2d 319 (D. Mass. 2013) ..................................................................................................... 20
U.S. v. Councilman,
418 F.3d 67 (1st Cir. 2005) ........................................................................................................ 13, 19, 20

7
8
9
10
11
12
13

U.S. v. Forrester,
512 F.3d 500 (9th Cir. 2008) ........................................................................................................... 13, 23
U.S. v. Szymuskiewicz,
622 F.3d 701 (8th Cir. 2010) ........................................................................................................... 13, 16
Ung v. Facebook, Inc.,
No. 12-CV-217244, Order (Cal Super. Ct. Santa Clara Cnty July 2, 2012) ..................................... 6, 24
United States v. Jones,
132 S.Ct. 945 (2012) ....................................................................................................................... 25, 28

14
15
16
17
18
19
20

United States v. Matlock,
415 U.S. 164 (1974) .............................................................................................................................. 20
Veleron Holding, B.V. v. Morgan Stanley,
2015 WL 4503580 (S.D.N.Y. July 23, 2015) ......................................................................................... 5
Walker v. B&G Foods, Inc.,
2016 WL 463253 (N.D. Cal. Feb. 8, 2016) .......................................................................................... 10
Walling v. Beverly Enters.,
476 F. 2d 393 (9th Cir. 1973) ................................................................................................................ 10

21
22

Warth v. Seldin,
422 U.S. 490 (1975) ................................................................................................................................ 4

23
24

Statutes

25
26

18 U.S.C. § 1030(2)(B) ............................................................................................................................. 27

27

18 U.S.C. § 2501(4) .................................................................................................................................. 13

28

18 U.S.C. § 2510(12) ................................................................................................................................ 11
viii
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

18 U.S.C. § 2510(4) .................................................................................................................................. 14

2

18 U.S.C. § 2510(5) ............................................................................................................................ 14, 17

3

18 U.S.C. § 2510(8) ............................................................................................................................ 10, 14

4

18 U.S.C. § 2511(4)(a).............................................................................................................................. 27

5

18 U.S.C. § 2701(b) .................................................................................................................................. 27

6

18 U.S.C. 2701(a) ..................................................................................................................................... 18

7
28 U.S.C. § 1738 ......................................................................................................................................... 3
8
9

Cal. Civil Code § 654................................................................................................................................ 29

10

Cal. Crim. Code § 630 .............................................................................................................................. 27

11

Cal. Crim. Code § 631 ........................................................................................................................ 22, 27

12

Cal. Crim. Code § 632 ........................................................................................................................ 23, 27

13

Cal. Penal Code § 484 ............................................................................................................................... 27

14
15

Cal. Penal Code § 484(a) .......................................................................................................................... 28
Cal. Penal Code § 496 ............................................................................................................................... 27

16
17
18

Cal. Penal Code § 496(c) .......................................................................................................................... 28
Cal. Penal Code § 499c(b)(3).................................................................................................................... 29

19

Cal. Penal Code § 502 ..................................................................................................................... 4, 33, 37

20

Cal. Penal Code § 502(c)(2)...................................................................................................................... 29

21

Cal. Penal Code § 530.5 ............................................................................................................................ 28

22

Cal. Penal Code § 530.55(b) ..................................................................................................................... 29

23

Cal. Penal Code § 637.2(c) ......................................................................................................................... 4

24
Cal. Penal Code 502(b)(10) ...................................................................................................................... 34
25
26

Cal. Penal Code 502(c) ................................................................................................................. 29, 33, 34

27

Cal. Penal Code 502(e)(1)......................................................................................................................... 33

28

Cal. Penal Code. § 496(a) ......................................................................................................................... 30
ix
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

Other Authorities

2

House of Representatives Report 107-236 (Oct. 11, 2001) ...................................................................... 13

3

Prosser & Keeton, Torts (5th ed. 1984) .................................................................................................... 40

4

Senate Report 109-14 (Feb. 28, 2005) ........................................................................................................ 6

5

Senate Report 99-541 (Oct. 17, 1986) ................................................................................................ 12, 21

6

Wright & Miller, Federal Practice and Procedure, § 1277 ....................................................................... 18

7
8
9

Rules

10

Fed. R. Civ. P. 8(a) ................................................................................................................................. 3, 9

11

Fed. R. Civ. P. 9(b) ................................................................................................................................... 36

12

Rule 12(b)(6)......................................................................................................................................... 3, 17

13

Rule 8(a)...................................................................................................................................................... 8

14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
x
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

I.

2

INTRODUCTION
Defendant Facebook, Inc.’s (“Facebook”) Motion to Dismiss (the “Motion”) the Second

3

Amended Complaint (the “SAC”), asks this Court to deny recourse for millions of Americans whose

4

privacy Facebook repeatedly and profoundly violated through the unauthorized and secret tracking of

5

their web browsing. Ignoring recent case law and new facts in the SAC, Facebook’s motion is primarily

6

built on two false premises. First, Facebook argues its misappropriation of billions of URLs and other

7

personal data is not “injury in fact” for Article III standing. Second, Facebook argues URLs

8

categorically do not contain “contents,” the interception of which violates federal and state wiretap laws.

9

Remarkably, Facebook’s Motion ignores the recent landmark opinion in In re Google Inc.

10

Cookie Placement Consumer Privacy Litig., 806 F.3d 125 (3d Cir. Nov. 10, 2015 as amended Nov. 12,

11

2015) (“Google Cookie Placement”). This Court’s order dismissing plaintiffs’ First Amended

12

Complaint relied on the lower court decision in Google Cookie Placement, and described the facts as

13

“virtually indistinguishable.” In re Facebook Internet Tracking Litigation, 2015 WL 6438744 at *6

14

(N.D. Cal. Oct. 23, 2015) (the “Order”). Facebook brought the district court’s original opinion in

15

Google Cookie Placement to this Court’s attention in a Statement of Recent Decisions dated October 10,

16

2013 [ECF No. 69]. Three weeks after the Order, however, the Third Circuit reversed the district court

17

on the standing and contents issues on which Facebook relies.

18

Facebook also argues that users have no reasonable expectation of privacy in a URL. But

19

Facebook ignores the SAC’s focus on the aggregation of web browsing history, and then brushes aside

20

as “dicta” a recent unanimous Supreme Court decision finding a privacy interest in aggregated URLs.

21

Facebook also relegates to a footnote a California state court decision against Facebook on identical

22

facts (Exhibit HH to SAC), finding a privacy interest in aggregate web browsing history.

23

Finally Facebook complains that the SAC does not identify precisely which websites were

24

visited. Facebook does not mention, however, that Facebook has that information for each plaintiff but

25

has refused to produce it.

26

II.

27
28

FACTUAL AND PROCEDURAL BACKGROUND
Plaintiffs filed the first amended complaint on May 23, 2012 [ECF No. 35] (the “FAC”). This

Court granted Facebook’s motion to dismiss all counts on October 23, 2015 with leave to re-plead. See
1
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

Order, 2015 WL 6438744. Plaintiffs filed the SAC on November 30, 2015. Defendants moved to

2

dismiss on January 14, 2016 [ECF No. 94] (the “Motion”). Accompanying this opposition is the

3

Declaration of Stephen Grygiel dated Feb. 18, 2016 (“Grygiel Decl.”) providing referenced exhibits.

4

Other documents accompanying the SAC as exhibits are designated “SAC Ex. – ”.

5
6

The SAC differs from the FAC in several ways. First, four counts have been dropped and four
have been added:

7
Claim 

8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

Violation of the Federal Wiretap Act 
Violation of the Federal Stored Communications Act 
Violation of the Federal Computer Fraud and Abuse Act 
Invasion of Privacy 
Intrusion upon Seclusion 
Conversion 
Trespass to Chattels 
California Unfair Competition Law (“UCL”) 
California Penal Code § 502 (computer crime law) 
California Invasion of Privacy Act (“CIPA”) 
California Consumer Legal Remedies Act 
Breach of Contract 
Breach of Duty of Good Faith and Fair Dealing 
Civil Fraud 
California Statutory Larceny 

First Amended 
Complaint 
Count I 
Count II 
Count III 
Count IV 
Count V 
Count VI 
Count VII 
Count VIII 
Count IX 
Count X 
Count XI 
[not asserted] 
[not asserted] 
[not asserted] 
[not asserted] 

Second Amended 
Complaint 
Count I 
Count II 
[dropped] 
Count IV 
Count V 
[dropped] 
Count IX 
[dropped] 
Count X 
Count III 
[dropped] 
Count VI 
Count VII 
Count VIII 
Count XI 

Second, the SAC outlines litigation in the United States and Europe regarding privacy claims arising
from Facebook’s tracking of internet search histories. SAC ¶¶ 146-71. Third, the SAC adds facts
supporting a serious invasion of privacy resulting from Facebook’s internet tracking, with a focus on the
aggregation of internet communications and personal data. Fourth, the SAC discusses a greater number
of cookies Facebook used to track users post-logout, including the a_user, c_user, datr, lu, fr and
cookies. Fifth, the SAC cites discovery documents confirming
and
Sixth, the SAC specifically pleads that each named plaintiff actually visited websites with
Facebook “Like” buttons while logged out during the class period, that intercepted URLs containing
detailed file-paths beyond simple IP addresses, and more fully pleads Facebook’s business practice of

28
2
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

tracking all visits to such pages. Finally, the SAC asserts claims specifically on behalf of a subclass of

2

users of Microsoft Internet Explorer (the “IE Subclass”).

3

III.

LEGAL STANDARDS

4

A.

Pleading Standards

5

Facebook agrees that all but three (fraud, statutory larceny and § 502) of the SAC’s counts are

6

governed by the notice pleading standards of Fed. R. Civ. P. 8(a). Motion at 7. Plaintiffs’ factual

7

allegations need only be detailed enough to “raise a reasonable expectation that discovery will reveal

8

evidence” of the illegality alleged. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555-56 (2007).

9

Dismissal at the pleading stage is only appropriate “where the complaint lacks a cognizable legal theory

10

or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Center,

11

521 F.3d 1097, 1104 (9th Cir. 2008).
For Rule 12(b)(6) purposes, the Court must accept as true all the SAC’s well-pleaded factual

12
13

allegations. Ashcoft v. Iqbal, 556 U.S. 662, 664 (2009). The Court must construe those facts and draw

14

all inferences in the manner most favorable to the plaintiff. Love v. United States, 915 F.2d 1242, 1245

15

(9th Cir. 1988). Nevertheless, Facebook improperly bases several of its arguments on facts materially

16

differing from those in the SAC, and these are noted below where appropriate.1

17

B.

Collateral Estoppel

18

Under 28 U.S.C. § 1738, federal courts give full faith and credit to state court judgments. San

19

Remo Hotel v. San Francisco, 545 U.S. 323, 336 (2005); Brodheim v. Cry, 584 F.3d 1262, 1268 (9th

20

Cir. 2009). To determine the preclusive effect of a state court judgment, federal courts look to state law.

21

Heinrichs v. Valley View Development, 474 F.3d 609, 615 (9th Cir. 2007). In California, the preclusive

22

effect of a final judgment can be either “issue preclusion” (i.e., collateral estoppel) or full “claim

23

preclusion.” Mycogen Corp. v. Monsanto Co., 28 Cal. 4th 888, 896–97 (2002). Claim preclusion bars

24

claims/issues actually litigated, or that could have been litigated, in a prior proceeding. See Palomar

25

Mobilehome v. San Marcos, 989 F.2d 362, 364 (9th Cir. 1993). Issue preclusion, on the other hand,

26
27
28

1

   Cf. Memo. at 5, fn. 4 (“[b]ecause cookies do not collect any information”) with SAC ¶ 23 (cookies are

“small files that store information”).

3
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

only bars re-litigation of individual issues. As explained below, Facebook is attempting to re-litigate

2

two issues decided in previous cases and which should be precluded.

3

IV.

ARGUMENT
A.

4
5

Plaintiffs Have Article III Standing
1.

6

Standing May Exist Solely by Virtue of Statutes

Facebook concedes that under current Ninth Circuit law, Art. III standing may exist solely by

7

virtue of statutes creating legal rights. See Warth v. Seldin, 422 U.S. 490, 500 (1975); Edwards v. First

8

American Corp., 610 F.3d 514, 516-17 (9th Cir. 2010); Motion, fn. 7; Order, 2015 WL 6438744 at *7-8.

9

Plaintiffs satisfy the injury-in-fact requirement for standing by alleging an invasion of a statutory legal

10

right. Economic loss is not required. Facebook baselessly argues that plaintiffs’ allegations are

11

insufficiently detailed to establish statutory standing and that economic harm is a statutory prerequisite

12

for three of the California claims (Cal. Penal Code § 502, fraud, and statutory larceny).2

13

2.

14

Viable State-Law Claims are a Basis for Standing
a.

15

Plaintiffs Have Viable State-Law Causes of Action

Plaintiffs have alleged several concrete harms that establish Article III harm: First, Facebook

16

failed to expire personally identifying tracking cookies from their browsers at logout, and plaintiffs

17

recently learned in discovery that

18

. See, e.g., SAC ¶ 76. This concrete and systematic invasion of class members’ computers

19

exceeded the authorized use of plaintiffs’ resources for both the Class and the IE Subclass. Second,

20

Facebook misappropriated billions third-party private communications to which Facebook was not a

21

party, associated them with user-identifying data in real time, and collected them without authorization.

22

This is economic harm sufficient for standing. Third, the unauthorized collection and aggregation of

23

plaintiffs’ and class members’ web browsing is a serious invasion of privacy under California law.

24

Facebook argues that plaintiffs have no standing to pursue valid state law claims to address the

25

injuries above because plaintiffs’ ability to monetize the misappropriated data remained undiminished.

26

Such diminution is not Constitutionally required and the argument is factual anyway. More broadly,

27

2

28

Facebook does not deny that economic harm is not a prerequisite specifically for claims under the
CIPA. See Cal. Penal Code § 637.2(c) (“It is not a necessary prerequisite to an action pursuant to this
section that the plaintiff has suffered, or be threatened with, actual damages.”).
4
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

“concrete harm” need not be economic. Sierra Club v. Morton, 405 U.S. 727, 734 (1972). Even in

2

cases involving economic harm, where data is misappropriated and used for financial gain by another,

3

the victim suffers injury even absent the victim’s intent to monetize the data himself.

4

FMC Corp. v. Boesky, 852 F.2d 981 (7th Cir. 1988), an insider trading case, illustrates Plaintiffs’

5

standing. In the FMC’s civil case for disgorgement, Mr. Boesky argued that FMC had no standing

6

because FMC was not denied the use of its own data, which Boesky had misappropriated. The Seventh

7

Circuit disagreed: “We hold that this misappropriation constitutes a distinct and palpable injury that is

8

legally cognizable under Article III’s case or controversy requirement.” Id.

9

First, the court held that “[c]onfidential business information, even though intangible in nature, is

10

corporate property . . . to which the corporation has the exclusive right and benefit.” Id. If the

11

information is misappropriated, it harms the victim. “Although FMC was not actually deprived of the

12

information itself, FMC, as a result of this wrongful conduct, was denied the right to use exclusively its

13

confidential information. And that is injury.” Id. (emphasis added).

14
15
16
17
18
19
20
21

Boesky teaches that if the claim is cognizable under state common law, it is Constitutionally
cognizable in federal court. The court reasoned:
For example, the actual or threatened injury required by Art. III may exist solely
by virtue of statutes creating legal rights, the invasion of which creates standing.
The same must also be true of legal rights growing out of state law…. Properly
pleaded violations of state-created legal rights, therefore, must suffice to satisfy
Article III’s injury requirement. Thus, even in the absence of a specific finding
that FMC was injured by the misappropriation of its confidential business
information, FMC sufficiently alleged the violation of a state-law right that in
itself would suffice to satisfy Article III’s injury requirement.

22

Id. at 993 (citations omitted) (emphasis added); accord, Veleron Holding, B.V. v. Morgan Stanley, 2015

23

WL 4503580 at *15 (S.D.N.Y. July 23, 2015) (citing Boesky). More recently, the Ninth Circuit

24

explicitly agreed with Boesky and held that requiring out-of-pocket damages might actually run afoul of

25

the Erie doctrine. Cantrell v. City of Long Beach, 241 F.3d 674, 683 (9th Cir. 2001) (citing Boesky);

26

Erie Railroad Co. v. Tompkins, 304 U.S. 64 (1938) (federal courts apply state laws when sitting in

27

diversity); Guaranty Trust Co. v. York, 326 U.S. 99, 105 (1945) (for diversity jurisdiction “Congress

28
5
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

never gave, nor did the federal courts ever claim, the power to deny substantive rights created by State

2

law or to create substantive rights denied by State law”).

3

Cantrell’s focus on diversity cases merits attention here. For example, some states recognize

4

claims for privacy intrusions even absent economic damages. See, e.g., Rhodes v. Graham, 37 S.W.2d

5

46, 47 (Ky. App. 1931) (“The fact that the damages cannot be measured by a pecuniary standard is not a

6

bar to his recovery.”). If a plaintiff were required to pursue his Kentucky tort claim in federal court,

7

Erie says the claim ought to proceed substantively unaltered. Facebook’s standing argument, however,

8

requires the federal court to violate Erie by dismissing a viable state law claim because the privacy

9

invasion did not cause any out-of-pocket damages.

10

Facebook’s view of standing creates further problems in the Class Action Fairness Act

11

(“CAFA”) context. Say a plaintiff pursues a California state court case with a class limited to California

12

members without out of pocket losses. Say also a parallel nationwide class asserts an identical

13

California claim. That latter case must proceed in federal court under the CAFA. Facebook’s Article III

14

theory would result in the broader class having its state common-law causes of action extinguished

15

while the state case proceeds. Such a result is contrary to CAFA’s non-substantive purpose. See Senate

16

Report 109-14 at p. 61 (Feb. 28, 2005), attached as Ex. 1 to Grygiel Decl.

17

The CAFA issue above is not merely academic in this case. Approximately one-seventh of the

18

class here is covered by a state-law class action in Santa Clara County Superior Court asserting only

19

state law claims against Facebook related to identical conduct. See Ung v. Facebook, Inc., Case No. 1-

20

12-cv-217244 (Santa Clara Cty). The state court rejected Facebook’s standing argument, finding that

21

“Facebook’s alleged conduct constitutes a serious invasion of a privacy interest.” See SAC, Ex. HH.

22

The Court’s Order, that plaintiffs lack standing for the unauthorized collection and use of their personal

23

data absent a showing that plaintiffs’ ability to monetize the data was diminished as a result (Order,

24

2015 WL 6438744 at *6) is inconsistent with Erie and Cantrell.

25

Furthermore, the law changed significantly after the Order. This Court cited three opinions for

26

its standing ruling. One was Google Cookie Placement. See Order, 2015 WL 6438744 at *6. Less than

27

three weeks after the Order, however, the Third Circuit reversed the district court’s ruling on standing:

28
6
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

2

For purposes of injury in fact, the defendants’ emphasis on economic loss is
misplaced…. a plaintiff need not show actual monetary loss for purposes of injury
in fact.

3

******

1

4
5
6
7
8

The plaintiffs here base their claims on highly specific allegations that the
defendants, in the course of serving advertisements to their personal web
browsers, implanted tracking cookies on their personal computers. Irrespective of
whether these allegations state a claim, the events that the complaint describes
are concrete, particularized, and actual as to the plaintiffs. To the extent that the
defendants believe that the alleged conduct implicates interests that are not
legally protected, this is an issue of the merits rather than of standing.

9
Google Cookie Placement, 806 F.3d at 134-35 (citations omitted). The court allowed claims for
10
invasion of privacy and intrusion upon seclusion to proceed, and remanded. Id. at 153.
11
This Court found the district court’s opinion in Google Cookie Placement “instructive mainly
12
because Plaintiffs’ allegations are virtually indistinguishable.” Id. at *6. Plaintiffs agree. Google
13
Cookie Placement is perfectly consistent with the simple formulations of Boesky and Cantrell: if a claim
14
is cognizable under state common law it is Constitutionally cognizable in federal court.
15
Finally, plaintiffs submit that the Ninth Circuit extended Cantrell specifically into data privacy
16

cases. See In re Facebook Privacy Litig., 572 Fed. Appx. 494 (9th Cir. 2014) (reversing district court

17
and holding plaintiffs’ allegations of misappropriation of their PII “sufficient to show the element of
18
damages” for contract and fraud claims). This Court’s Order limiting In re Facebook Privacy Litigation
19
to cases where a defendant shared personal data with advertisers (see Order, 2015 WL 6438744 at *6,
20
fn. 3) respectfully is inconsistent with the Ninth Circuit’s standing ruling In re Facebook Privacy Litig.
21
See also In re Anthem, Inc. Data Breach Litig., 5:15-MD-2617-LHK, Order on Motion to Dismiss, Slip
22
Op. at 45-48 (N.D. Cal. Feb. 14, 2016) (citing In re Facebook Privacy Litigation as basis to conclude
23
that loss of value of personal information “represents a cognizable form of economic injury”).
24
3.

Plaintiffs Have Pled Actual Injury to Them

25
Facebook argues that plaintiffs must allege specific third-party webpages visited during the class
26
period or specific communications (URLs) that were intercepted. Motion at 10. Facebook misstates the
27
allegations in the SAC and also misstates the applicable law. Pleading standing is no different than
28
7
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

pleading anything else: a short and plain statement putting the defendant on notice suffices. See, e.g.,

2

Nat’l Council of La Raza v. Cegavske, 800 F. 3d 1032, 1039 (9th Cir. 2015). Notice pleading, buttressed

3

by general facts sufficing to show “plausibility” – the “reasonable expectation that discovery will reveal

4

evidence” supporting the claim – is the rule. See, e.g., Starr v. Baca, 652 F. 3d 1202, 1212, 1214 (9th Cir.

5

2011). The facts alleged need only establish the plausibility of standing. See Landers v. Quality

6

Communications, Inc., 771 F. 3d 638, 645 (9th Cir. 2015).

7

Plaintiffs’ FAC alleged that Facebook installed tracking and session cookies on their computers

8

without consent, that they visited websites with Facebook functionality while logged out, and that

9

Facebook intercepted their electronic communications were intercepted. See, e.g., FAC ¶ 103. The

10

Order only identified one insufficiency: Plaintiffs failed to allege that Facebook obtained the “contents

11

of a communication attributable to them” making the allegation too general to “nudge” a CIPA claim

12

“across the line from conceivable to plausible.” Order, 2015 WL 6438744 at *10 (citing Iqbal, 556 U.S.

13

at 680). The FAC only alleged that communications were intercepted, but never alleged that the

14

communications contain contents. For the SAC, plaintiffs reviewed the URLs of websites visited while

15

logged out of Facebook, and specifically alleged that many of the intercepted URLs “contain detailed

16

file paths containing the content of GET and POST communications.” See, e.g., SAC ¶ 113. These

17

communications were more than IP addresses. The SAC also identifies the specific browser used by

18

each plaintiff and alleges whether the computer was shared. These extra allegations provide the “nudge”

19

the Court required. See Erickson v. Pardus, 551 U.S. 89, 94 (2007) (under Rule 8(a), “[s]pecific facts

20

are not necessary…the statement need only ‘give the defendant fair notice of what the …claim is and the

21

grounds upon which it rests.’”).

22

Furthermore, plaintiffs alleged with summary-judgment-like detail a business practice through

23

which Facebook gathered billions of URLs during the class period and associated them with actual

24

subscribers. SAC ¶¶ 68-78. Independent researchers (see SAC ¶ 58) support these allegations. So do

25

Facebook’s own documents. Such detailed allegations of a general business practice suffice to allege

26

that plaintiffs were harmed. See, e.g., Obama v. Klayman, 800 F.3d 559, 563-64 (D.C. Cir. 2015)

27

(standing established to assert claim against the NSA to proceed even though the plaintiff had not

28
8
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

alleged the particular phone calls at issue because the plaintiff “offer[ed] an inference derived from

2

known facts.”).

3

4.

In the Alternative, Standing Should Be Resolved at a Later Stage

4

Although standing is normally a threshold issue to be resolved at the outset of a case, courts

5

considering class actions may defer resolution until a later stage, even until class certification. See

6

Amchem Prods., Inc. v. Windsor, 521 U.S. 591 (1997). In situations like this one prudential concerns

7

favor deferral (see In re Target Corp. Data Sec. Breach Litig., 66 F. Supp. 3d 1154, 1160 (D. Minn.

8

2014)), and “there is no rigid rule that precludes class certification from being addressed before standing

9

issues.” In re Carrier IQ, Inc., Consumer Privacy Litig., 78 F. Supp. 3d 1051 (N.D. Cal. 2015); accord,

10

In re Anthem, Inc. Data Breach Litig., Slip Op. at 10 (“the Court finds that it has discretion to decide . . .

11

when to consider issues of standing’).

12

If the Court requires allegations of actual websites visited by the named plaintiffs, or actual

13

URLs intercepted, plaintiffs request deferral of the standing issue pending resolution of an upcoming

14

motion to compel. Facebook has refused to produce documents related to the named plaintiffs.

15

Facebook has records of all data collected on the named plaintiffs, which might resolve this issue once

16

and for all.
B.

17

Plaintiffs Have Adequately Pled Federal Claims Under the ECPA
1.

18

Specificity of Pleadings

19

Full of merits-based factual arguments about the Internet’s functioning and, in particular, the

20

functioning of Facebook’s surreptitiously planted cookies,3 Facebook’s brief wishes away plaintiffs’

21

many detailed factual allegations, from defendant’s own documents, showing defendant’s knowledge of

22

its illicit post-log out tracking. Facebook assumes a requirement of proof in the pleadings that neither

23

Fed. R. Civ. P. 8(a), nor 9(b), nor Ninth Circuit precedent imposes. Facebook’s arguments nowhere

24

recognize that any “ambiguities” in this highly technical setting – such as whether a personal computer,

25

server, software or cookie can function as a “device” for Wiretap Act purposes, a “facility” for Stored

26
3

27
28

See, e.g., Memo at 2 (“proof of injury; “record information…transmitted as part of the normal
operation of the Internet;”); at 4 (“[l]ike any web content provider, Facebook’s servers….”); at 17
(“Facebook, like any other third-party provider of webpage content…”).
9
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

Communications Act purposes, or as a “machine, instrument or contrivance” for CIPA purposes – “must

2

be resolved in favor of the pleadings.” Heldt v. Tata Consultancy Servs., Ltd., 2015 WL 5542303, at *3

3

(N. D. Cal. Sep. 18, 2015) (citing Walling v. Beverly Enters., 476 F. 2d 393, 396 (9th Cir. 1973)).

4

Alleging long-established, legally cognizable claims, the SAC does much more than simply

5

“recite the elements of” those claims. Starr, 652 F. 3d at 1216. Plaintiffs do not, for example, merely

6

allege “labels,” that Facebook used a “device” to “intercept” the “content” of confidential

7

communications. Plaintiffs factually plead the identity of such devices, the means and method of the

8

interceptions, and the contents of the communications. Facebook’s factual disagreement with those

9

contentions is for discovery and summary judgment or trial. See Walker v. B&G Foods, Inc., 2016 WL

10

463253, at * 2 (N.D. Cal. Feb. 8, 2016) (“In the Ninth Circuit, ‘[i]f there are two alternative

11

explanations, one advanced by the defendant and the other advanced by the plaintiff, both of which are

12

plausible, plaintiff’s complaint survives a motion to dismiss.”).

13
14

2.

The Wiretap Act
a.

Plaintiffs Adequately Allege Content.

15

Content “includes any information concerning the substance, purport, or meaning of [a]

16

communication.” 18 U.S.C. § 2510(8). The Order held that plaintiffs’ failed to allege Wiretap content

17

because of similarity to “the referrer headers addressed in Zynga Privacy Litigation.” Order at 16.

18

Plaintiffs’ SAC shows that the information Facebook acquired differs from that in Zynga. The Google

19

Cookie Placement ruling and recently declassified cases from the Foreign Intelligence Surveillance

20

Court explain why detailed URLs do contain “content,” i.e. “any information relating to the substance

21

purport, or meaning” of a communication.

22

Plaintiffs’ SAC alleges Defendant acquired “detailed URL requests and search queries” and

23

explains that URLs are composed of several different parts. SAC at ¶185. For example, the URL

24

http://progressivehealth.hubpages.com/hub/How-Do-I-Reduce-Herpes-Breakouts contains four parts: (1)

25

“http” establishes the basic computer language of the communication; (2)

26

“progressivehealth.hubpages.com” identifies the website to which the communications will be sent and

27

received, i.e. the other party to the communication; (3) “How-Do-I-Reduce-Herpes-Breakouts” is the

28

name of the precise file requested; and (4) “hub” plus “How-Do-I-Reduce-Herpes-Breakouts” is called
10
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

the “file path.” SAC at ¶34. In this example, the phrase “How-Do-I-Reduce-Herpes Breakouts” is

2

content because it contains information relating to the substance, purport, or meaning of a

3

communication. Likewise, in the URL http://www.nytimes.com/2011/08/10/nyregion/post-traumatic-

4

stress-disorder-from-911still-haunts.html, the phrase “[PTSD] from 911 still haunts” is content. See

5

SAC at ¶ 35.

6

In Zynga, the URLs at issue were Facebook URLs that only included the name of a person or

7

group. In re Zynga Privacy Litigation, 750 F.3d 1098, 1109 (9th Cir. 2014). The URLs here are third-

8

party communications, and include search terms or other detailed substance, purport and meaning, e.g.,

9

like “How Do I Reduce Herpes Breakouts” and “[PTSD] from 911 still haunts.” See id. (URLs contain

10

content where include “a search term or similar communication.”). Defendant’s argument that

11

computer-generated information can never contain content misstates Zynga’s holding. The SAC-

12

specified URLs were not computer spawned but were only generated after the user sent a ‘GET’

13

command to a non-Facebook website by either typing a URL into the navigation bar or clicking on a

14

hyper-link. SAC at ¶31. The SAC is consistent with Internet users’ everyday experience and the

15

Supreme Court’s explanation of the “relatively straightforward” manner of Internet communications.

16

See Reno v. ACLU, 521 U.S. 844, 852-53 (1997) (“Users generally explore a given Web page, or move

17

to another, by clicking a computer ‘mouse’ on one of the page’s icons or links…”.). Whether a detailed

18

URL results from a user typing all of the information into their toolbar or clicking on a link, the

19

underlying intentional communicative thought by the user is the same.

20

Affirmatively requesting information, and conveying personal thought, on how “PTSD from

21

9/11 still haunts,” the user is sending a protected electronic communication under the Act. See 18 U.S.C.

22

§ 2510(12) (“Electronic communication” includes “any transfer of signs, signals, … data, or intelligence

23

of any nature”). The browser sends a GET request directly to the NYT and populates the toolbar with

24

the detailed URL includes the phrase “[PTSD] from 9/11 still haunts.” That URL is contemporaneously

25

acquired by Facebook without the user’s knowledge or consent. The NYT responds with a 3,000 word

26

essay on PTSD after 9/11 that is also protected by the Wiretap Act. SAC at ¶ 35.

27
28

Clicking on a mouse rather than typing the entire URL into their toolbar the user has still sent a
protected communication. Another protected communication is about to be received. The ECPA’s
11
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

primary purpose was to “effectively protect the privacy of electronic communications” by updating the

2

law to “ke[ep] pace with the development of communications and computer technology … and the

3

structure of the telecommunications industry” and “bring it in line with technological developments[.]”

4

Senate Report 99-541 (Oct. 17, 1986) at 2-3, Grygiel Decl. Ex. 2 .

5

Consider email where the user forwards a message to another person without touching the

6

subject line of the original email. Generated by the email providers’ computer code, the forwarded

7

email’s subject line, is nearly identical to the subject line of the original email. Defendants’ logic leads

8

to the absurd result that such subject lines contain no content because the email providers’ default rules

9

“produced” them. So, too, with Defendant’s argument about detailed URLs.

10

In Declassified Opinion from the FISC, provided to the Court on August 15, 2014 [ECF No. 78],

11

the NSA argued it had authority under the Pen Register Act to track URLs because they are DRAS

12

(dialing, routing, addressing, or signaling) information. The FISC, which routinely hears Wiretap cases,

13

rejected this interpretation, holding “DRAS and content are not mutually exclusive categories.” Id. at 31.

14

In Google Cookie Placement, the Third Circuit explained “everything before the .com instructs a

15

centralized web-server to direct the user to a particular website, but post-domain name portions of the

16

URL are designed to communicate to the visited website which webpage content to send the user…

17

between the information revealed by highly detailed URLs and their functional parallels to post-cut-

18

through digits, we are persuaded that – at a minimum – some queried URLs qualify as content.” 806

19

F.3d at 139 (emphasis added).

20

The Google Cookie Placement panel was persuaded by “post-cut-through-digit” cases holding

21

that “numbers dialed from a telephone after a call is already set-up” are content. 806 F.3d at 138, citing

22

U.S. Telecom Ass’n v. FCC, 227 F.3d 450, 462 (D.C. Cir. 2000), see also Brown v. Waddell, 50 F.3d

23

285, 87-88 (4th Cir. 1995) (numbers sent to pager that are “more extensive … than those in telephone

24

numbers” contain “content.”). Google Cookie Placement also cited the PATRIOT Act’s legislative

25

history, in which a report of the House Judiciary Committee explained that a pen register order “could

26

not be used to collect information other than [DRAS], such as the portion of a URL specifying Web

27

search terms or the name of a requested file or article.” See HR. Rep. 107-236 at 53 (Oct. 11, 2001),

28

Grygiel Decl. Ex. 3; see also In re Application for Pen Register, 396 F.Supp.2d 45, 49-50 (D. Mass.
12
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

2005) (“Contents” included URL “subject lines, application commands, search queries, requested file

2

names, and file paths.”); U.S. v. Forrester, 512 F.3d 500, n. 6 (9th Cir. 2008) (URLs, unlike IP addresses,

3

“reveal[] much more information” about user’s Internet activity, including articles viewed.)

4

b. Plaintiffs Adequately Allege Interception, i.e. Contemporaneous Acquisition

5

Courts have interpreted the Wiretap Act to require the interception (18 U.S.C. § 2501(4)) to be

6

contemporaneous to the sending or receipt of a communication. Plaintiffs know of no court that has

7

accepted defendant’s argument that simultaneous capture of referrer URLs appended to third-party

8

cookies do not involve the acquisition of information contemporaneous to a communication. Cf. U.S. v.

9

Szymuskiewicz, 622 F.3d 701, 706 (8th Cir. 2010) (“contemporaneous does not mean ‘in flight’ or ‘in the

10

middle’ or any football metaphor;” is “contemporaneous by any standard” when the Wiretap defendant

11

and the victims “receive[] each message with no more than an eyeblink in between”); U.S. v.

12

Councilman, 418 F.3d 67, 76 (1st Cir. 2005) (“Councilman I”) (“[B]road definition of … storage was to

13

enlarge privacy protections for stored data … not to exclude email messages stored during transmission

14

from these strong protections.”).

15

Defendant acquired plaintiffs’ communications with websites as in Szymuskiewicz. The re-

16

direction of the URLs in this case functionally operated like an email forwarding rule and Facebook

17

acquired users’ communications to the websites in a time frame “contemporaneous by any standard.”

18

Defendant acquired information relating to the substance, purport, and meaning of communications that

19

user received in return from the websites. SAC ¶ 184. Facebook’s acquisition was completed “before the

20

communication between the plaintiffs and the various websites were completed.” SAC ¶ 184.
Konop v. Hawaiian Airlines, Inc., 302 F.3d 868 (9th Cir. 2002) is inapposite. In Konop, the

21
22

defendant gained unauthorized access to a “secure” website where the contents of the plaintiffs’

23

communications had been stored on a server for an unspecified period of time, but far longer than the

24

milliseconds at issue here. Id.
Facebook’s argument that it must receive “the actual communication” misstates the law.

25
26

Motion at 12.4 An interception is defined as the “acquisition of the contents of any … electronic

27
28

4

Facebook misstates the clear facts alleged in the SAC when it only discusses communications sent
from the Internet users and ignores communications users received. SAC ¶ 184. (“In fact, Facebook
13
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

communication[.]” 18 U.S.C. § 2510(4). “Content” is defined as “any information concerning the

2

substance, purport, or meaning” or the subject communication. 18 U.S.C. § 2510(8). The Wiretap Act

3

prohibits the “acquisition of any information concerning the substance, purport, or meaning of any

4

electronic communication.” It is enough for a defendant to acquire post-cut-through dialed digits, the

5

subject line of an email, or, in this case, the portion of a URL after the .com.

6

Finally, Facebook argues “Plaintiffs’ browser sends two different communications at two

7

different times.” Motion at 12. The plaintiffs, however, are not browsers. The plaintiffs’ are sentient

8

human beings who made human decisions to send and receive personal communications from websites.

9
10

c.

Plaintiffs Adequately Allege the Use of a Device.

The Wiretap defines an “electronic … or other device” as “any device … which can be used to

11

intercept a[n] … electronic communication[.]” 18 U.S.C. § 2510(5). Emphasis added. “Other” and

12

“any” have meaning. They focus on function – i.e. whether something could be used to acquire

13

communications. Congress chose these broad definitions to further its central purpose of effectively

14

protecting the privacy of electronic communications. Random House defines device as, among other

15

things: (1) “a thing made for a particular purpose; an invention or contrivance, especially a mechanical

16

or electrical one;” (2) “a plan or scheme for effecting a purpose;” and (3) “a crafty scheme, trick.”

17

The SAC alleges defendant used seven devices to acquire communications: (1) cookies; (2) web-

18

browsers and their constituent files; (3) computing devices; (4) Facebook’s web-servers; (5) the web-

19

servers of the websites involved; (6) Facebook’s computer code; and (7) the plan Facebook carried out

20

to effectuate the acquisition of plaintiffs’ communications. SAC ¶ 187.

21

Web-servers and computers are devices under the Wiretap Act. Szymuszkiewicz, 622 F.3d at 707

22

(discussing Crowley v. Cybersource Corp., 166 F.Supp.2d 1263, 1269 (N.D. Cal. 2001)). Software and

23

computer code are devices. In re Carrier IQ, 78 F. Supp. 3d at 1067 (“Plaintiffs have sufficiently

24

alleged that the Carrier IQ Software is a ‘device’ for purposes of the Wiretap Act.”). Facebook’s

25

cookies are devices under the act because they are an invention designed for the purposes of “track[ing]

26

and record[ing] an individual Internet user’s communications with and activities on websites across the

27
28

received the communications before the communication between the plaintiffs and the various websites
were completed.”)
14
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

Internet.” SAC ¶ 52. Facebook’s secret interception program is a “device” because it is a “plan or

2

scheme” to carry out the purpose of acquiring the electronic communications of Internet users.

3

Crowley is inapposite. There the Court held that Amazon could not be liable under the Act

4

because it “acted as no more than the second party to a communication” when it knowingly forwarded

5

information to CyberSource to verify one of its users credit card information. Id. at 1266. Facebook is

6

not a party to a communication between a plaintiff and a third-party website as Amazon was in Crowley.

7

Also inapposite, Potter v. Havlicek, 2008 WL 2556723 (S.D. Ohio June 23, 2008), arose out of a

8

divorce. A jealous husband installed software on a family computer to surreptitiously record his wife’s

9

communications. The husband interpleaded the software company. The Court concluded that “computer

10

software alone” is not a Wiretap Act “device” in the context of a software manufacturer who never

11

received the alleged intercepted communications. Id. at *7 (Wiretap Act “does not contemplate

12

imposing civil liability on software manufacturers and distributors for the activities of third parties”).

13

Plaintiffs here allege seven devices, not computer software alone. Nor is Facebook a software

14

manufacturer who received no communications and merely sold software to a third-party who

15

subsequently used it to intercept another person’s communications. Facebook used the software to

16

acquire communications.

17

d. Facebook is Not a Party to the Communication.

18

Facebook tacitly concedes it is a “third-party” and not a party to the relevant communications

19

between the users and the websites. MTD at 14, 21. Plaintiffs agree as the Court did. Order at 18-19.

20

The SAC alleges Facebook intercepted communications that the logged-out plaintiffs sent and received

21

from other websites. SAC ¶ 184. The SAC illustrates that communications between users and websites

22

occur through a channel separate from the path through which Facebook acquires information. SAC ¶

23

60. The SAC alleges interceptions while logged-out users were sending communications to non-

24

Facebook websites, with no intention of sending any information to Facebook and when Facebook

25

explicitly promised it would not acquire user communications.

26

Facebook’s interpretation of the “party” exception obliterates the Wiretap Act. Suppose that, for

27

“security purposes,” the IRS places cookies on the web-browsers of every American who files taxes

28

online. The IRS promises these Americans that it will not access the cookies except when the tax-filer is
15
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

actually on the IRS web-page attempting to file taxes. Suppose the IRS, for what it describes as

2

“security purposes only” so the IRS is sure only approved vendors use the program, requires tax prep

3

firms to place IRS computer code in the header of each web-page the firm controls if the firm wants its

4

customers the option to file their taxes online. The code also places an IRS logo on the page. The IRS

5

informs firms it will receive some information, but promises not to track individual tax-filers through

6

cookies while they are not actively logged-in to the IRS site. Accordingly, tax filers permit the

7

placement of cookies and tax preparation firms place the IRS code on every page of their websites for

8

these limited “security purposes,” including pages like: http://www.efile.com/what-are-the-penalties-for-

9

not-filing-a-tax-return-or-not-to-pay-taxes-IRS-penalty-list/.

10

However, unbeknownst to the tax-filers and the tax preparation firms, suppose the IRS computer

11

code tracks taxpayers and their communications (including the referrer URL above) so that the IRS

12

acquires the content of every communication John Doe makes with his tax preparation firm through his

13

web-browser – including, for example, whether he sent a communication seeking information on “what

14

are the penalties for not filing or tax return or not to pay taxes?” The IRS then uses the information to

15

determine whom to audit. Under Facebook’s logic, directly contrary to Congressional intent, the IRS is a

16

“party” to the intercepted communication between the tax-filer and their chosen tax preparation firm.

17

Similarly, In re Pharmatrak, 329 F.3d 9 (1st Cir. 2003) rejected an argument identical to

18

Facebook’s. See also Szymuszkiewicz, 622 F.3d 701 (rejecting similar argument where defendant used

19

email forwarding rule to instruct victim’s email service to automatically re-direct all emails to

20

defendant); but cf. Google Cookie Placement, 806 F.3d at 143-45.

21
22
23
24

Crowley, cited repeatedly by defendant, illustrates why plaintiffs should prevail. Making an
internet purchase, the Crowley plaintiff knowingly sent financial information to Amazon. Amazon
transferred the data to CyberSource to verify payment details. The communication between the plaintiff
and Amazon occurred on the Amazon web-page, a key fact Facebook omits. Crowley explains:

25
“Amazon merely received the information transferred to it by Crowley, an act without which there
26
27
28

would be no transfer. Amazon acted as no more than the second party to a communication. This is not
an interception as defined by the Wiretap Act.” Id. at 1269.

16
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

e.

Consent is an Affirmative Defense

2

Defendant bears the burden of proving the affirmative defense of consent. See Pharmatrak, 329

3

F.3d at 19. No consent appears in the SAC so consent cannot be resolved on Facebook’s Rule 12(b)(6)

4

motion. Scott v. Kuhlmann, 746 F.2d 1377, 1378 (9th Cir. 1984) (citing Wright & Miller, Federal

5

Practice and Procedure, § 1277 at 328-30) (affirmative defenses may not be raised in a motion to dismiss

6

unless no disputed fact issues).

7

For Wiretap claims, “consent should not be casually inferred.” Pharmatrak at 20. No

8

constructive consent is permissible and “without actual notice, consent can only be implied when the

9

surrounding circumstances convincingly show that the party knew about and consented to the

10

interception.” Pharmatrak at 19, 20. Facebook’s interceptions broke its privacy promises and included

11

the collection of personal data. No consent, actual or implied, exists. Id.

12

f.

The Ordinary Course of Business Exception Does Not Apply

13

The Wiretap Act exception for interceptions “being used by” an ECS provider in the “ordinary

14

course of its business (18 U.S.C. § 2510(5)(a)) only applies to actual ECS providers. In re Google Inc.

15

Gmail Litig., 2013 WL 5423918 at *11 (N.D. Cal. Sep. 26, 2013) (exemption “designed only to protect

16

[ECS] providers”); Shefts v. Petrakis, 2012 WL 4049484 at *5 (C.D. Ill. Sep. 13, 2012); cited with

17

approval in In re Carrier IQ at 40. Facebook, however, fails to identify the relevant ECS provider, and

18

does not say if it is making a vicarious claim. Facebook cites no case in which a defendant successfully

19

invoked a vicarious “ordinary course of its business” exception. Cf. Google Privacy Policy Litigation

20

(involved scanning of emails on defendant’s own email service); Kirch v. Embarq, 702 F.3d 1245 (10th

21

Cir. 2012) (ISP defendant invoked exception based on communications occurring through its own

22

service).

23

Nor does Facebook claim it is the relevant ECS. Facebook is an ECS provider – but only for

24

communications made on Facebook.com. Facebook nowhere identifies – a fact issue, anyway - the

25

“instrument, equipment, or facility” or “component thereof” that it must show it used as an ECS in the

26

ordinary course of business.

27
28

Even if Facebook identified the ECS and the facility necessary to invoke this exception, the nonconsensual taking or tracking of electronic information is not within the “ordinary course of business
17
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

exception.” See Google Gmail Litigation, 2013 WL 5423918 at *11 (adopting “narrow reading” of

2

exception, requiring “some nexus between the need to engage in the alleged interception and the

3

subscriber’s ultimate business, that is, the ability to provide the underlying service or good.”).

4

Facebook’s interceptions and social-sharing tools are neither necessary for transmission of

5

communications between users and websites nor “incidental” to them. See Google Gmail Litigation,

6

2013 WL 5423918 at *8 (exception limited to ECS provider interceptions that “facilitate[] the

7

transmission of the communication at issue or is incidental to the transmission of such communication”).

8
9

Facebook’s argument fails under In re Google Privacy Policy. There the court held that the
exception could apply to actions taken by an ECS provider to further its “legitimate business purpose.”

10

2013 WL 6248499 at *11 (N.D. Cal., Dec. 3, 2013). Facebook’s systematic violation of its privacy

11

promises is not a “legitimate business purpose.” In re Carrier IQ at 39 (exception inapplicable where

12

device “has functionality” that was “expressly disclaimed”); see also Opperman v. Path, 87 F.Supp.3d

13

1018, 1061 (N.D. Cal. 2014) (common law intrusion claim; non-consensual taking of electronic

14

information is not “routine commercial behavior.”).

15

Disclosure of Facebook’s behavior resulted in a Congressional inquiry (SAC ¶ 112) and an

16

unprecedented 20 years of independent privacy audits. SAC at ¶111. False representations and

17

misconduct punished by the FTC are not within the ordinary course of business exception.

18

3.

a.

19
20

The Stored Communications Act
Plaintiffs Adequately Alleged Access to a Facility

The Stored Communications Act defines “facility” as the conduits “through which an electronic

21

communication service is provided.” 18 U.S.C. 2701(a). An ECS is defined as “any service which

22

provides to users thereof the ability to send or receive wire or electronic communications.” To find a

23

“facility,” a court must first determine the ECS then determine the elements through which the service is

24

provided.

25

The SAC alleges unauthorized access to three different types of facilities: (1) personal

26

computing devices; (2) web-browsers; and (3) browser-managed files. SAC ¶ 199. Contrary to the

27

Motion, every court to answer the question has found that web-browsers and browser-managed files are

28

protected SCA “facilities.”
18
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

For example, Microsoft has successfully used the SCA to challenge computer hackers who gain

2

unauthorized access to Internet Explorer and its constituent files located on the personal computing

3

devices of IE users. In Microsoft v. Does 1-8, the defendants circumvented IE’s privacy settings to take

4

information directly from IE users without consent. The court concluded, in unequivocal terms,

5

“Microsoft’s … Windows operating system and Internet Explorer software are facilities through which

6

electronic communication services are provided.” Microsoft v. Does 1-8, 14-cv-00811-LO-IDD (E.D.

7

Va. July 20, 2015). Plaintiffs know of no SCA case involving web-browsers that Microsoft has lost. See

8

also Microsoft v. Does 1-27, 10-cv-00156 (E.D. Va. 2010); Microsoft v. Piatti, 11-cv-01017 (E.D. Va.

9

2011); Microsoft v. Does 1-39, 12-cv-1335 (E.D. N.Y. 2012); Microsoft v. Does 1-18, 13-cv-139 (E.D.

10

Va. 2013); Microsoft v. Does 1-82, 13-cv-00319 (W.D. N.C. 2013). These Microsoft cases get it right.

11

Accord, Chance v. Avenue A, 165 F.Supp.2d 1153, 1160 (W.D. Wash. 2001); Ehling v. Monmouth, 961

12

F.Supp.2d 659, 667 (D. N.J. 2013); Crispin v. Audigier, 717 F.Supp.2d 965 (C.D. Cal. 2010); Freedman

13

v. AOL, 325 F.Supp.2d 638 (E.D. Va. 2004); Councilman I, 418 F.3d at 77 (“Congress sought to ensure

14

that the messages and by-product files that are left behind after transmission, as well as messages stored

15

in a user’s mailbox, are protected from unauthorized access. Email messages in the sender’s and

16

recipient’s computers could be accessed by electronically ‘breaking into’ those computers and retrieving

17

the files.”).

18

Understanding the SCA’s purpose is necessary to parse the distinction between the web-browser

19

and email cases and the mixed case law on personal computing devices. Congress enacted the SCA

20

“because the advent of the Internet presented a host of potential privacy breaches that the Fourth

21

Amendment does not address.” Quon v. Arch Wireless, 529 F.3d 892, 900 (9th Cir. 2008). Congress

22

wished to protect electronic communications “subject to control by a third-party computer operator[.]”

23

See Senate Report 99-541 at 3, Grygiel Dec. Ex. 2. Likewise, in Riley v. California (discussed in more

24

detail below), the U.S. Supreme Court unanimously held that data contained on a personal computing

25

device is protected by the Fourth Amendment, reasoning “[a]n Internet search and browsing history …

26

could reveal an individual’s private interests or concerns[.]” 134 S. Ct. 2473, 2490 (2014). Riley is a

27

good step in the direction of privacy protection, as it closed the front door to secret seizure of such data.

28

But the back door remains open unless the SCA applies.
19
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

Further, if web-browsers are not protected by the SCA, Riley v. California means nothing in the

2

real world. First, rather than attempt to access communications directly through a person’s computer or

3

cell phone, the government need only serve a subpoena on the person’s web-browsing company

4

requiring the company to access the files to which it has access rights. Second, a web-browsing

5

company could give government agents the authority to search a user’s files contained within the

6

browser to which the web-browsing company maintains the right to access. See United States v.

7

Matlock, 415 U.S. 164, n. 7 (1974) (“Common authority” rest on “mutual use of the property by persons

8

generally having joint access or control for most purposes[.]”). This is because a web-browser user does

9

not “own” the browser or its files but only enjoys a “license” to use them subject to conditions which

10

allow the web-browsing company to access the same files, under Facebook’s argument. Finally, a web-

11

browser licensor could disclose the contents of its user’s Internet communications to any third-party

12

without user consent. Viewed in its proper context, therefore, Facebook’s position violates the basic rule

13

of avoiding statutory interpretations that lead to absurd results. See Los Coyotes Band of Cahuilla and

14

Cupeno Indians v. Jewell, 729 F. 3d 1025, 1036 (9th Cir. 2013)

15
16

b.

Plaintiffs Adequately Alleged Storage.

The SCA defines “electronic storage” as (A) “any temporary, intermediate storage of a[n] …

17

electronic communication incidental to the electronic transmission thereof; and (B) any storage of such

18

communication by an [ECS] for purposes of backup protection of such communication.” Plaintiffs

19

allege Facebook gained access to the content of communications in cookies and referer URLs stored in

20

browser-managed files, including: (1) URL requests present in the toolbar while a user remains present

21

at a particular webpage; and (2) browsing history maintained by the web-browser ECS for purposes of

22

back-up protection.

23

The definitions of storage are “extraordinary – indeed, almost breathtakingly – broad.” See

24

Councilman I at 73 (citing U.S. v. Councilman, 245 F.Supp.2d 319, 320 (D. Mass. 2013)) (Congress

25

intended to protect “[e]mail messages in the sender’s and the recipient’s computers” which “could be

26

accessed by electronically ‘breaking into those computers[.]”) Though this is a web-browser case, the

27

concept is the same regarding the URLs stored in the plaintiffs’ toolbar.

28
20
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

Defendant’s argument that a URL stored in a user’s toolbar is not stored “in the middle of a

2

transmission” (MTD at 20) is a factual, and stretched, argument. The contents of these communications,

3

including all information after the .com, enter storage in the toolbar “once a user hits Enter or clicks on a

4

link [and] the communication is in the process of being sent and received between the user and the first-

5

party website.” SAC ¶ 206. The web-browser stores a copy of the user’s URL requests in the toolbar for

6

only so long as “the user remains present at a particular webpage.” Id. When users send their next

7

communication, the stored communication is removed from the toolbar. As pleaded in the SAC, this is

8

the everyday experience of millions of American Internet users including the plaintiffs.

9

Storage in browsing history also satisfies the second part of the definition because the storage is

10

for “purposes of backup protection,” which the Ninth Circuit has held applies to backup protection for

11

the user’s benefit. Theofel v. Farey-Jones, 359 F.3d 1066, 1075 (9th Cir. 2004).
c.

12

Plaintiffs Alleged Facebook “Accessed” Facilities.

13

The SCA does not separately define “access.” The common definition of access is not limited to

14

physically entering a protected facility, but instead to “obtain” information from it or make use of it. See

15

Segan LLC v. Zynga, 2015 WL 5315945 (N.D. Cal. Sept. 10, 2015) (patent case). The Oxford dictionary

16

defines “access” to include “the opportunity to use or benefit from something” or to “obtain, examine, or

17

retrieve.”5 In the computer context, Webopedia defines access as “to use.”6 The Computer Desktop

18
19
20

Encyclopedia defines access as, among other things, “in computer security, the opportunity for use of a
resource.”7 The ECPA’s legislative history shows Congress intended access to have a broad meaning.
See Senate Report 99-541 at 38-39, Grygiel Decl. Ex. 2 (Discussing §2703(c) and (d) as providing for

21
“access to records or other information pertaining to a subscriber” and providing for “orders requiring
22
23
24

access by a Government entity to the contents of an electronic communication,” effectively making
access synonymous in the ECPA with the obtaining of information).

25

5

26

6

27
28

http://www.oxforddictionaries.com/us/definition/american_english/access

http://www.webopedia.com/sgsearch/results?cx=partner-pub
-8768004398756183%3A6766915980&cof=FORID%3A10&ie=UTF-8&q=access
7

http://www.yourdictionary.com/access#computer
21
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

Facebook’s behavior fits all of these definitions. Furthermore, contrary to Facebook’s argument,

2

plaintiffs’ interpretation would not lead to liability for “any third-party provider of webpage content that

3

receives referer URL information” just because they received the communication.8 If a browser

4

communicates a referer URL to a third-party, that normal functioning is not an interception or an

5

unlawful access of a facility, because it is impliedly consensual. In re Doubleclick, 154 F.Supp.2d 497

6
7
8

(S.D.N.Y. 2001). Facebook, however, acquired content without any consent, and the general rule
articulated in Doubleclick does not apply. The only third parties facing liability under plaintiffs’ theory
are those who circumvent privacy settings on browsers or those who misrepresent the nature of the

9
cookies being written to the browser – in other words, those parties who cannot claim implied consent.
10

C.

11

Plaintiffs Have Adequately Pled California Law Claims
1.

The California Invasion of Privacy Act (“CIPA”)

12
a.
13

CIPA § 631

A claim under Section 631 mirrors the ECPA with two relevant differences.9 First, CIPA is an

14
all-party consent statute. Even if Facebook prevails on its theory that the relevant communication is the
15
GET request sent to Facebook, and Facebook is a “party” to the intercepted referer URLs (making it the
16
“one party” consenting to the communication), it cannot demonstrate that the plaintiffs consented.
17
Lacking all-party consent, the CIPA could provide a basis for liability even where the Wiretap Act
18

would not. Furthermore, all parties Additional, Facebook is a third-party.10 But it is not a “content”

19
provider.
20
Second, CIPA does not require the use of a “device.” Facebook argues that the relevant
21
requirement is instead a “machine, instrument, or contrivance,” see Motion at 16, but this argument
22
selectively edits the statute. CIPA’s actual text prohibits interceptions “by means of any machine,
23
instrument, or contrivance, or in any other manner.” Plaintiffs adequately alleged seven instruments or
24
contrivances as detailed in their federal Wiretap section. See SAC ¶ 217. Even if these facts do not
25
26

8

Facebook here concedes it is a third-party.

27

9

Plaintiffs restate their arguments on “content” and “consent” from the federal Wiretap Act.

28
10

Facebook again concedes it is not a party to communications between users and websites.  
22
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

technically qualify as a “machine, instrument or contrivance,” Facebook has ignored the portion of the

2

statute allowing “any other manner.”

3

b.

CIPA § 632

4

Section 632 forbids recording a conversation where “a party to [the] conversation has an

5

objectively reasonable expectation that the conversation is not being overheard or recorded.” Flanagan

6

v. Flanagan, 27 Cal. 4th 766, 777 (2002). As Facebook notes, California courts have held that Internet

7

communications are not confidential in some circumstances. However, plaintiffs know of no case

8

holding that an Internet communication is not confidential for purposes of Section 632 when the

9

recording entity explicitly promised the actual parties to the communication that the conversation would

10

not be recorded.11 Facebook explicitly promised not to record the communications at issue creating the

11

privacy expectation. “When you log out of Facebook, we remove the cookies that identify your

12

particular account.” SAC ¶ 23. Even after Facebook was caught, its Engineering Director said, “We’ve

13

said that we don’t do it, and we couldn’t do it without some form of consent and disclosure.” SAC ¶ 27.

14

See also SAC ¶74-78; SAC ¶107.

15

Facebook cites the Court’s prior holding that “Internet users have no expectation of privacy in

16

the … IP addresses of the websites they visit,” Motion at 18, but this holding is irrelevant to the Section

17

632 analysis. As alleged in the SAC, Facebook intercepted detailed URLs in addition to simple IP

18

addresses. See SAC ¶ 35; see also In re Application for Pen Register, 396 F.Supp.2d at 49-50; U.S. v.

19

Forrester, 512 F.3d at n. 6 (URLs, unlike IP addresses, “reveal[] much more information” about user’s

20

Internet activity, including articles viewed); Google Cookie Placement, 806 F.3d at 138 (citing

21

Forrester). Even if the SAC only alleged interceptions of IP addresses (which is not the case), even IP

22

addresses can be the subject of objectively reasonable expectations of privacy in the context of a Section

23

632 claim. As Forrester noted, the government must obtain a court order even if only tracking the IP

24

addresses to and from which a person is communicating.

25

Plaintiffs also adequately alleged the use of a recording device - the same devices used to

26

intercept their communications. SAC ¶ 217. Facebook cites an inapposite pre-Internet case – and fails to

27

11

28

Defendant is not a party to any of the communication between the plaintiffs and the websites. By its
own admissions, it is a third-party. Regardless of whether the Court deems Facebook a party, it is liable
under Section 632.
23
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

cite any case supporting its position that the devices it uses to record its users’ Internet communications

2

while logged-off fail to qualify. See SAC ¶ 48-52 regarding recording of information in

3

database and third-party cookies “designed to track and record an individual Internet user’s

4

communications.” See also In re Google Inc. Gmail Litig, 2013 WL 5423918 at *21 (California

5

Supreme Court has repeatedly interpreted CIPA broadly and “regularly reads statutes to apply to new

6

technologies where such a reading would not conflict with the statutory scheme”); People v. Nakai, 183

7

Cal. App. 4th 499, 518 (Cal. App. 2010) (computer “screenshots … fall within the ambit of a recording

8

device.”). The devices, instruments, contrivances, and scheme used by Facebook to record its user’s

9

communications fit the statutory scheme.

10

2. Invasion of Privacy and Intrusion Upon Seclusion
a.

11

Invasion of Privacy

Enshrined in the state Constitution, the California tort of invasion of privacy has three elements:

12
13

(1) a legally protected privacy interest; (2) a reasonable expectation of privacy; and (3) the intrusion

14

must be so serious as to constitute an egregious breach of social norms. Hill v. NCAA, 7 Cal.4th 1

15

(1994). The plaintiffs allege facts to support all three elements. Without consent, Facebook intercepted

16

billions of URLs appended to cookies that provided user identity (c_user, fr, lu), time and date (act),

17

location (locale) and other personal information. By associating multiple URLs with the same user, a

18

comprehensive picture of each subscriber’s personal life can be assembled with frightening detail, based

19

on data that Facebook was not authorized to receive. In short, there is a reasonable expectation of

20

privacy in aggregate web browsing history, even if not in any single URL.

21

The first court to address whether this wholesale surveillance of the Internet gives rise to a claim

22

for the tort of invasion of privacy was the California Superior Court, in Ung v. Facebook, Inc., No. 12-

23

CV-217244, Order (Cal Super. Ct. Santa Clara Cnty July 2, 2012), attached to the SAC as exhibit HH.

24

Yes, the Court found, “there is a legally protected privacy interest in a person’s identifiable browsing

25

history,” slip op. at 3, and using cookies to “track large portions of people’s browsing histories across

26

numerous other websites . . . constitutes a serious invasion of a privacy interest.” Id. at 5.12

27

12

28

Facebook may be collaterally estopped from challenging the Ung court’s factual ruling regarding
invasion of privacy. Though the decision was a denial of a demurer, Facebook opted not to seek
interlocutory appeal. “Once an issue has been resolved in a prior proceeding, there is no further fact
24
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

Every other court since Ung has reached the same conclusion. The Court of First Instance in

2

Belgium found that using Facebook’s browser-specific datr cookie to track web browsing (even without

3

evidence that datrs could be linked to actual users) violated “fundamental rights and freedoms.” SAC,

4

Ex. EE. In Google Cookie Placement, which this Court found to be factually “virtually

5

indistinguishable,” the Third Circuit held that even sophisticated internet users can “reasonably expect”

6

that URL queries would not be associated with each other without consent. Google Cookie Placement,

7

806 F.3d at 151. The Third Circuit specifically found that Google’s aggregation of the URLs

8

“intrud[ed] upon reasonable expectations of privacy” and allowed the California tort to proceed. Id.

9

The Third Circuit also found Google’s conduct to “constitute an egregious breach of social norms,” id.,

10

conduct which is nearly identical to that alleged here, in particular with respect to the IE Subclass.

11

Finally the French data protection authority (CNIL) recently followed the decision of the Belgian Court

12

of First Instance, finding Facebook’s use of the datr cookie to track web browsing to be neither fair nor

13

lawful without consent. See Grygiel Decl. Exs. 4 and 5.

14

Supreme Court Fourth Amendment jurisprudence mirrors these decisions and reflects the

15

growing and reasonable public desire to be free from electronic surveillance. See, e.g., United States v.

16

Jones, 132 S. Ct. 945, 955 (2012) (prolonged electronic location monitoring by government, even in

17

public spaces, violates reasonable privacy expectations). The Supreme Court repeated this logic in

18

unanimously deciding Riley v. California, 134 S. Ct. 2473, 2490 (2014), finding a legitimate privacy

19

interest in aggregated electronic data on a smart phone (including Internet history) even if any individual

20

item of data may not give rise to a legitimate interest. In the same way, internet users have a reasonable

21

expectation of privacy in the pervasive aggregation of web histories, even if they do not in a single URL.

22

Considering Jones and Riley, Judge Koh recently observed that “Justice Sotomayor was

23

particularly concerned with “the existence of a reasonable societal expectation of privacy in the sum of

24

one’s public movements.” In re Application for Telephone Information, 2015 WL 4594558 at * 8 (N.D.

25
26
27
28

finding function to be performed” in future cases. Murray v. Alaska Airlines, Inc., 50 Cal. 4th 860, 864
(2010). The Restatement (Second) of Judgments §27 cmt. d suggests the denial of a demurer might be
“final” for purposes of collateral estoppel because “an issue . . . submitted and determined on a motion
to dismiss for failure to state a claim” is a final judgment. This is true even if determination is “based on
a failure of pleading or of proof as well as on the sustaining of the burden of proof.” Id.
25
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

Cal., July 29, 2015) (quoting Jones) (emphasis added by Judge Koh). She further observed that Riley

2

also focused on the new technological ability to aggregate personal data, id. at *9, and concluded:

3

“Based on the preceding U.S. Supreme Court cases, the following principles are manifest: (1) an

4

individual’s expectation of privacy is at its pinnacle when government surveillance intrudes on the

5

home; (2) long-term government surveillance by the government implicates an individual’s expectation

6

of privacy; and (3) location data . . . can reveal a wealth of private information about an individual.” Id.

7

She then concluded that cell phone users have a legitimate expectation of privacy in the aggregate

8

collection of cell phone location data, even if there would not be in a single data point. “Such an

9

expectation is one that society is willing to recognize as reasonable.” Id.

10

In its Motion, however, Facebook ignores the tectonic jurisprudential shifts above and argues as

11

if the technological advances discussed above had never happened. Thus, Facebook relegates Ung to a

12

footnote and brushes it off as “wrongly decided” without offering any analysis. Facebook also never

13

mentions Google Cookie Placement and never mentions the recent decisions in Europe finding that

14

pervasive web tracking via the datr cookie violates fundamental freedoms absent consent. Facebook

15

also never mentions Jones, and disregards as mere dicta the Supreme Court’s ruling in Riley.

16
17

b.

Intrusion Upon Seclusion

The California tort of “intrusion upon seclusion” is similar to but distinct from the tort of

18

invasion of privacy and both are cognizable separately on the same facts. See, e.g., Google Cookie

19

Placement, 806 F.3d at 151. Specifically, unauthorized taking of electronic information can give rise to

20

an action for intrusion upon seclusion. Id. (unauthorized taking of personal Internet communications

21

under California law); Opperman, 87 F.Supp.3d at 1058-61 (unauthorized taking of personal contact

22

lists under California law).

23
24

i.

Facebook Intruded Upon a Private Matter

A plaintiff must plead the defendant intruded into “some zone of …privacy surrounding, or

25

obtained unwanted access to data about the plaintiff . . . [and] an objectively reasonable expectation” of

26

privacy in “the place, conversation or data source.” Shulman v. Group W. Productions, Inc., 18 Cal. 4th

27

200, 232 (1998). Facebook obtained unauthorized access to Plaintiffs’ computers and Internet

28

communications by (1) tracking users’ communications while they were logged-off of Facebook in
26
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

violation of Facebook’s own privacy policy and public promises; and (2) circumventing users’ privacy

2

settings on Internet Explorer. Plaintiffs’ SAC pleads “an objectively reasonable expectation of [privacy]

3

in the place, conversation or data source.” Id. at 232. This objectively reasonable expectation was

4

created (1) by Facebook when it explicitly promised not to track its users while they were logged-off;

5

and (2) by state and federal statutes, in particular, the Wiretap Act, Stored Communications Act, CIPA,

6
7
8

Pen Register Act, and other statutes plead in plaintiff’s petition. See SAC ¶ 17-27, 225. Plaintiffs also
had an objectively reasonable expectation of privacy that Facebook would not circumvent the chosen
privacy settings on plaintiffs’ web-browsers. Cf. Kewanee Oil v. Bicron, 416 U.S. 470, 487 (1974) (“A

9
most fundamental human right, that of privacy, is threatened when industrial espionage is condoned or is
10
11

made profitable; the state interest in denying profit to such illegal ventures is unchallengeable.”).
ii.

12
13
14

A Reasonable Person Could Find Facebook’s Behavior Highly
Offensive

“Highly offensive” is a mixed question of law and fact. Hill at 40. It is ultimately a jury
question unless a court determines that “as a matter of policy, such conduct should be considered, as a

15
matter of law, not highly offensive.” Taus v. Loftus, 151 P.3d 1185 (Cal. 2007). Congress and every
16
17
18
19

state has already made this policy decision by enacting criminal statutes against conduct like Facebook’s
that is inherently highly offensive or would not be punishable by incarceration -- violations of the
Wiretap Act, Pen Register Act, Stored Communications Act, CIPA, California Computer Crime Law

20

and Cal. Penal Code §§ 484, 496, 631 and 632 are each subject to prison terms. See, e.g. 18 U.S.C. §

21

2511(4)(a); 18 U.S.C. § 2701(b); and 18 U.S.C. § 1030(2)(B). California explicitly declared that

22

activities such as the SAC alleges are “serious threat[s] to the free exercise of personal liberties and

23

cannot be tolerated in a free and civilized society.” Cal. Crim. Code § 630. California’s Supreme Court

24

has held that “eavesdropping [or] wiretapping” gives rise to the tort of intrusion upon seclusion.

25

Shulman at 868.

26

Even if Facebook technically violated no law, its conduct would still be highly offensive.

27

Determining offensiveness requires consideration of all circumstances of the intrusion, including the

28

degree, setting, and intruder’s motives and objectives. Miller v. National Broadcasting Co., 187
27
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

Cal.App.3d 1463, 1483-84 (Ct. App. 1986); Hernandez v. Hillsides, Inc., 47 Cal. 4th 272 (Cal. 2009).

2

Facebook’s unauthorized intrusion involved the plaintiffs’ home computers and personal computing

3

devices. The Supreme Court has repeatedly emphasized the importance of privacy in a person’s home,

4

computer, and web-browsing history. See e.g., U.S. v. Jones, 132 S. Ct. 945 (2012); Riley v. California,

5

134 S. Ct. 2473 (2014). The degree and circumstances of the intrusion was so widespread and pervasive

6

that Facebook agreed to 20 years of independent privacy audits. SAC ¶ 111. Facebook’s motive and

7

objective of Facebook’s conduct was Facebook’s own financial gain at the expense of the privacy

8

interests of its millions of users, which is not enough to overcome its surreptitious theft of the plaintiffs’

9

personal information. Opperman, 87 F.Supp.3d at 1061 (“surreptitious theft of personal contact

10
11
12

information … has [not] come to [be] qualified as ‘routine commercial behavior’”).
3.

California Statutory Larceny
a.

The SAC Properly Alleges Claims for Statutory Larceny

13

The California Penal Code states that persons who defraud other persons of personal property by

14

false pretense are guilty of theft. Cal. Penal Code § 484(a). Cal. Penal Code § 496(c) provides a private

15

right of action for “[a]ny person who has been injured” by the sale of stolen property. Cal. Penal Code §

16

496(c). Thus, regardless of plaintiffs’ entitlement to a cause of action under § 484, due to the incorporation

17

of theft by false pretense by § 496, plaintiffs have alleged a claim for theft by false pretense.

18

b.

Personally Identifying Information is Property

19

Defendants cite In re Zynga Privacy Litig., 2011 WL 7479170 (N.D. Cal. June 15, 2011) and Low

20

v. LinkedIn Corp., 900 F.Supp.2d 1010, 1026 (N.D. Cal. 2012) (cases involving the California Unfair

21

Competition Law) in arguing PII is not “property” subject to Penal Code 496. See Motion at 39. However,

22

Section 496 does not define “property” and California courts have stated that anything that can be stolen

23

can be property under § 496. People v. Norwood, 26 Cal.App.3d 148, 157 (App. 2 Dist. 1972). California

24

has specifically recognized that one’s personal identifying information (“PII”) can be the object of theft,

25

and criminalizes the unauthorized use of same. See CTC Real Estate Services v. Lepe, 140 Cal.App.4th

26

856 (App. 2 Dist. 2006) (citing Cal. Penal Code § 530.5).

27

For the purposes of Chapter 8 (False Personation and Cheats) of Title 13 (Of Crimes Against

28

Property), the Penal Code defines “personal identifying information” as including, inter alia, any names,
28
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

addresses, personal identification numbers or passwords, unique electronic data, including information

2

identification numbers assigned to persons or addresses, and telecommunications identifying information

3

or access devices. Cal. Penal Code § 530.55(b). Much of the aforementioned information was contained

4

in the information Facebook collected from the plaintiffs as alleged in the SAC, and furthermore, the list

5

of PII set forth in § 530.55 ends with “or an equivalent form of identification.” Id.

6

Courts have explained that the word “property” signifies “something that one has the exclusive

7

right to possess and use.” People v. Kwok, 63 Cal.App.4th 1236, 1250–51 (App. 1 Dist. 1998) (interpreting

8

Cal. Civil Code § 654). Making unauthorized copies, whether of physical objects, trade secrets, or

9

computer data, is, then, theft. Kwok, 63 Cal. App.4th at 1251 (referencing Cal. Penal Code §§ 499c(b)(3)

10

and 502(c)(2)); see People v. Gopal, 171 Cal.App.3d 524 (App. 1 Dist. 1985) (trade secrets were property

11

under § 496). Such actions destroy “the intangible benefit and prerogative” of being able to control access

12

to such property. Id. Plaintiffs had the exclusive right to possess and use their PII, including their

13

respective browsing histories. Facebook interfered with this right. Plaintiffs’ information is property and

14

Facebook’s actions constituted theft under the California Penal Code.

15

c.

Plaintiffs Have Sufficiently Alleged Theft by False Pretenses

16

Echoing its “party to the communication” argument, Facebook claims that because it received the

17

information at issue “directly from Plaintiffs,” it was not stolen. Motion at 39. But the SAC alleges that,

18

when users logged into Facebook, various session cookies and tracking cookies were written to their

19

browsers. SAC ¶ 3. When the users’ browsers sent referer URLs to Facebook, they were appended to user-

20

identifying data without the users’ consent, which fundamentally changes the nature of the

21

communication. Plaintiffs, simply put, sent the URLs under false pretenses.

22
23

Incredibly, Facebook claims it “had no reason to believe the information was stolen, nor was it.”
Motion at 39. But this factual defense is not only inappropriate at the 12(b)(6) stage,

24

. Not only did

25

Facebook track and transmit plaintiffs’ data to itself without plaintiffs’ knowledge or consent, it

26

represented to plaintiffs that it was not doing so. SAC ¶¶ 23–25, 63, 85, 102. No inference is reasonable

27

other than Facebook intended these representations to induce plaintiffs to use its website and to allow

28

Facebook to continually collect valuable personal user information. SAC ¶ 227-f, 263–266, 278. In
29
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

choosing to contract with and use Facebook, plaintiffs relied on Facebook’s false representations. SAC ¶

2

267.13 Plaintiffs’ reliance can also be inferred from all of the circumstances. Harris v. Garcia, 734

3

F.Supp.2d 973, 989 (N.D. Cal. 2010) (citing People v. Wooten, 44 Cal.App.4th 1834, 1843 (1996).

4

d.

The Facts do not Preclude a Claim for Theft by False Pretenses

5

Facebook argues that it cannot have stolen plaintiffs’ property because plaintiffs’ browsers sent

6

“GET” requests to Facebook “as part of the Internet’s normal operation.” Motion at 39. A browser’s

7

sending a GET request to a website in order to view its content is part of the Internet’s normal operation.

8

But a website’s surreptitious installation of cookies on their browsers in order, post-log out, to collect

9

personal information, is not.

10

Facebook further elides the point in arguing it neither purchased plaintiffs’ property nor received

11

it from a third party. Liability, however, attaches from Facebook’s extraction of plaintiffs’ property

12

without their knowledge or consent, and without compensation.

13

Facebook then argues that because Facebook did not actually conceal or withhold plaintiffs’

14

browsing histories from them, plaintiffs have no Sec. 496 claim. However, Section 496 more broadly

15

reaches not only to persons who conceal or withhold property, but also those who sell property, and those

16

who “aid[] in concealing, selling, or withholding any property from the owner, knowing the property to

17

be so stolen or obtained.” Cal. Penal Code. § 496(a). But the facts alleged in the SAC show Facebook

18

cannot disclaim knowledge of the non-consensual manner in which plaintiffs’ personal information was

19

acquired. Facebook did sell its users’ personal information because it charged more to advertisers based

20

on this very information.

21

4.

Breach of Contract and Implied Covenant of Good Faith and Fair Dealing

As the SAC alleges, Facebook breached its contractual promises (both explicit and implicit) not

22
23

to track the web browsing of subscribers who had logged out. Facebook makes three argument in its

24

Motion to dismiss the breach of contract claim: (1) Facebook is not contractually bound by its own

25

Privacy Policy nor referenced Help Pages; (2) no damages; and (3) no allegations of plaintiffs’

26
27
28

13

Contrary to Facebook’s assertion that Plaintiffs have not properly pled the elements of theft by false
pretenses, all of the foregoing information in this paragraph was incorporated into Count XI of the SAC.
See SAC ¶ 286.
30
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

performance. Facebook makes these same arguments with respect to the implied covenant of good faith

2

and fair dealing, and also argues that the claim is merely duplicative of the contract claim.

3

a.

4

The Privacy Policy and Help Center Pages Are a Part of the SRR

Facebook remarkably posits that it is not contractually bound by its own Privacy Policy or Data

5

Use Policy, merely because the SAC “never identifies any section in the SRR that contained hyperlinks”

6

to the specifically relevant portions of the other documents. Motion at 34. However, under California

7

law, contracts can incorporate other documents by reference without hyperlinks or mentioning specific

8

provisions. So says the very case Facebook cites, Chan v. Drexel Burnham Lambert, Inc., 178

9

Cal.App.3d 632, 641 (1986). In Chan, a contract failed to incorporate a second document because the

10

second document was never identified; the contract simply included a term that required a signatory to

11

abide by unspecified other contracts governing membership in unspecified other organizations. The

12

Chan court distinguished that term from other contracts that “clearly referred to and identified the

13

incorporated documents.” Id. (citing King v. Larsen Realty, Inc., 121 Cal.Ap.3d 349 (1981)); see also

14

Baker v. Aubry, 216 Cal.App.3d 1259, 1264 (1989) (“The distinguishing factor in King, found lacking in

15

Chan, was the fact that the incorporated document was readily available to the appellants.”).

16

Here, the SRR clearly identifies and incorporates the Privacy Policy (and later Data Use Policy),

17

and the Privacy Policy clearly identifies and incorporates the Help Center pages,14 constituting the

18

“layered approach” that Facebook represented to Congress. SAC ¶¶ 21-23. Indeed, the very first term

19

of the SRR is called “Privacy” and Facebook represents that the Privacy Policy makes “important

20

disclosures about . . . how we collect and can use your content and information. We encourage you to

21

read the Privacy Policy, and to use it to help make informed decisions.” SAC, Ex. A. The Privacy

22

Policy, in turn, repeatedly references the SRR and even represents that the terms of the Privacy Policy

23

may be changed pursuant to the SRR, and that the Privacy Policy “applies to all information we have

24

about you.” It then contains links to the Help Pages. SAC, Ex. G, ¶ 9.

25
26
27
28

14

Facebook objects that copies of certain cited Help Center pages were not appended to the SAC.
However, plaintiffs requested these pages during discovery almost two years ago and Facebook has
refused to produce them. The parties are currently negotiating this point.

31
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

Other courts addressing this issue have implicitly found the Facebook SRR to incorporate the

2

Privacy Policy. Thus, for example, the breach of contract claim in In re Facebook Privacy Litigation

3

was premised on a contract consisting of both documents, see 791 F. Supp. 2d 705, 717 (N.D. Cal.

4

2011), and the Ninth Circuit later held that the complaint adequately pled breach of contract. See 572

5

Fed. Appx. 494 (9th Cir. 2014).15 While Facebook also argues it is not contractually bound by the

6

Privacy Policy, it routinely claims that subscribers are. So for example, in Cohen v. Facebook, Inc., 798

7

F. Supp. 2d 1090 (N.D. Cal. 2011), Facebook argued that subscribers consented to sharing names and

8

pictures based on the terms of the Privacy Policy. Id. at 1095; see also Campbell v. Facebook, Inc., 77

9

F. Supp. 3d 836, 846 (N.D. Cal. 2014) (“Facebook points to its ‘Statement of Rights and

10

Responsibilities’ and its ‘Data Use Policy,’ both of which must be agreed to by users in order to use the

11

Facebook website” (emphasis added)).

12

b.

13

Damages

The issue of contractual damages is addressed above in the “Standing” section, and include loss

14

of computer resources caused by the presence of the unauthorized cookies as well as loss of privacy.

15

The Ninth Circuit ruled that a complaint adequately pleads contract damages under California law on

16

almost identical facts. In re Facebook Privacy Litig., 572 Fed. Appx. at 494.

17

c.

Alleging Performance

18

In the SAC, plaintiffs alleged that they accepted the terms of the contract with Facebook, SAC ¶

19

247, and had active Facebook accounts during the entire class period. SAC ¶¶ 12-15. These allegations

20

are sufficient to generally allege their performance under the contract. Facebook, however argues in the

21

Motion that plaintiffs are required to allege that they did not breach negative obligations, i.e., provisions

22

of the SRR forbidding certain behavior. The only case cited by Facebook, however, does not support

23

this expansive view of notice pleading. In Bennett-wofford v. Bayview Loan Servicing, LLC, 2015 WL

24

8527333 (N.D. Cal. Dec. 11, 2015), plaintiffs alleged a breach of a contract to settle a case, a contract

25

which required the plaintiff to perform many things, including dismissing a complaint. Id. at *6. But a

26

review of the contact also reveals that plaintiffs had other ancillary contractual obligations, including

27
28

15

Because the Ninth Circuit decision is “final,” it is possible that Facebook is now collaterally estopped
from arguing that its SRR does not incorporate the Privacy Policy by reference.
32
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

agreeing that they had no intention to bring suit against a number of persons, and knew of no facts

2

constituting a basis for suit; they also agreed to cooperate and use best efforts, and also represented that

3

each had the authority to sign the contract. Nevertheless, the court found the following sentence

4

sufficient to plead performance: “The case was dismissed on March 11, 2013.” Id.

5
6

d.

Breach of Implied Covenant

In California, all contracts contain an implied term of good faith and fair dealing. Careau & Co.

7

v. Security Pacific Business Credit, Inc., 22 Cal. App.3d 1371, 1395 (1990). Facebook objects that

8

plaintiffs’ claim here is merely duplicative of the breach of contract claim, but plaintiffs’ claim is

9

brought in the alternative to the extent the promises made in the Help Pages or Privacy Policy are

10

deemed not to be contractually binding on Facebook. If these documents are contractually binding,

11

Facebook had a contractual duty to expire cookies each time a subscriber logged out. Failure to do so is

12

a breach of contract, and the breach of the implied covenant is superfluous. If, however, Facebook’s

13

Privacy Policy is deemed not to be contractually binding, Facebook’s actions – alleged in the SAC to be

14

done knowingly and bad faith – violate the implied covenant which would not be duplicative of the

15

excluded Privacy Policy terms.

16

5.

17

California Penal Code 502

The California’s Comprehensive Computer Data Access and Fraud Act protects persons from

18

unauthorized access to their computers, Cal. Penal Code § 502. Pursuant to section 502(e)(1),

19

individuals have a private right of action against persons causing them damage by reason of a violation

20

of any one of eight subsections 502(c); plaintiffs alleged violations of four subsections.

21
22

a.

Damage

No statutory minimum amount of damage is required for a section 502 claim, and Facebook cites

23

to none. The prevailing view is that “any amount of loss may be sufficient” under the statute. In re

24

Google Android Consumer Privacy Litig., 2013 WL 1283236 at *11 (N.D. Cal. Mar. 26, 2013).

25

Facebook failed to expire certain cookies upon logout,

26

. Facebook’s actions resulted in larger amounts of data being sent to Facebook’s servers

27

each and every time a subscriber communicated with Facebook-enabled websites. The amount of this

28

unauthorized extra data –stored and repeatedly transmitted throughout the day – is robust. See SAC ¶¶
33
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

58-60. Appending user-identifying cookies to billions of URLs allows Facebook to associate multiple

2

URLs with an actual person, painting a comprehensive picture of that person’s life, intruding upon a

3

reasonable expectation of privacy. This is injury under California law as discussed above and thus

4

satisfies “damage” under section 502.

5
6

b.

Permission

All relevant subsections of section 502(c) require that the defendant act “without permission.”

7

Courts routinely interpret “without permission” to mean “in a manner that circumvents technical or

8

code-based barriers in place to restrict or bar a user’s access.” Opperman, 87 F.Supp.3d at 1053.

9

Plaintiffs’ section 502 claim is therefore limited the IE Subclass. But as Facebook concedes (see Motion

10

at 27, fn. 15), the SAC alleges that Facebook circumvented the cookie blocking technology used by the

11

IE Subclass without permission. See Google Cookie Placement, 806 F.3d at 151 (Google circumvented

12

cookie blockers on browsers). Facebook argues that it disclosed the use of cookies generally, Motion at

13

27, fn. 15 (“the Privacy Policy informed users that Facebook used these cookies”), but the Third Circuit

14

rejected Google’s similar argument (“Google’s emphasis on tracking and disclosure amounts to a

15

smokescreen”) because the browser was only accessed after Google circumvented cookie blockers.

16

Google Cookie Placement, 806 F.3d. at 150.

17

c.

Contaminant

18

The statute defines computer contaminants to include (but are not limited to) “viruses or worms,

19

that are self-replicating or self-propagating and are designed to contaminate other computer programs or

20

computer data, consume computer resources, modify, destroy, record, or transmit data, or in some other

21

fashion usurp the normal operation of the computer.” Section 502(b)(10). As alleged in the SAC,

22

cookies fit this definition. Self-replicating, they copy themselves to each and every referrer URL sent to

23
24
25
26
27
28

Facebook, potentially hundreds of times a day for any subscriber, contaminating an otherwise
anonymous referrer URL with user identification. And they consume computer resources, both by
occupying computer storage and by increasing the size of communications sent to Facebook’s servers.
6.

Fraud

To state an action for fraud, a plaintiff must plead with specificity an intentional
misrepresentation of material fact with knowledge of its falsity and intent to induce reliance, actual
34
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

reliance, and damages proximately caused by the reliance. Gonsalves v. Hodgson, 38 Cal.2d 91, 100-

2

102 (Cal. 1951). Plaintiffs’ actual and constructive fraud claims satisfy Rule 9(b)’s specificity

3

requirement. Plaintiffs allege the “who” – Facebook and its employees and engineers, many by name.

4

Plaintiffs allege the “what” – surreptitious post-log out tracking contrary to Facebook’s promise.

5

Plaintiffs allege the “when” – during the class period (and during the IE Subclass period), prior to public

6

discovery of Facebook’s deceit. Plaintiffs allege the “where” – in the interactions between plaintiffs’

7

computers, third-party websites and Facebook’s servers. Plaintiffs allege the “how” – through

8

specifically identified, improperly planted cookies. Having falsely promised to delete user-identifying

9

tracking cookies from browsers after logout, Facebook was duty bound to make, and did not, a

10

corrective disclosure.

11

Facebook does not deny that the SAC alleges all of the elements necessary to establish fraud;

12

instead, Facebook argues in the Motion that the elements were not sufficiently pled. First, Facebook’s

13

fraud was intentional – Facebook cites Engalla v. Permanente, 15 Cal. 4th 951, 976 (1997),16 in arguing

14

that “[f]raud requires intent to induce, not just knowledge of falsity.” Motion at 22. Fraud’s elements

15

are not at issue. The facts are. Plaintiffs allege facts showing Facebook’s intent to deceive – which must

16

be taken as true on this dismissal motion. Facebook’s arguments from other cases with fully developed

17

factual records cannot defeat those facts – which allege Facebook making a false promise and

18

knowingly breaking it. See SAC ¶¶ 4, 23-27, 63, 66, and 68-73.

19

Facebook’s engineering director

20
21

SAC ¶ 74. And Facebook
. See SAC ¶ 78 (“

22

Were more

23

needed, Facebook’s effort to patent its post-log out tracking method confirms inftent. See SAC ¶¶ 79-

24

84. Further confirming Facebook’s intent, when caught, Facebook blamed post-log out tracking on “a

25

bug.” SAC ¶ 105. But Facebook’s internal emails
. See also SAC ¶¶ 75-76.

26
27
28

16

Engalla also involved a well-developed factual record of twelve depositions and thirteen motions
demonstrating the fraudulent inducement that invalidated an arbitration agreement. Engalla, 15 Cal. 4th
at 914. Even without depositions plaintiffs have pleaded facts demonstrating Facebook’s fraud.  
35
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

Facebook’s assertion that the “SAC fails to allege that Facebook intended to induce reliance or

2

conduct,” Memo at 23, simply cannot be squared with the SAC’s factual allegations that (a) Facebook

3

wanted to track users; (b) logged out users posed an obstacle to that desire; and (c) Facebook developed

4

a way of tracking logged out users (d) all the while internally admitting that Facebook’s public promises

5

were to the contrary. These are not “bare allegations” of concealment. Besides, although intent can be

6

alleged generally (Fed. R. Civ. P. 9(b)), Plaintiffs allege facts showing intent. See, e.g., SAC ¶¶ 69 (“

7
8
9

.”), 75 (“
).
Plaintiffs’ SAC also specifically pleads Facebook’s false promises to not track logged-off users.

10

See SAC ¶¶ 4, 23, 24, 27, 74, 78. It also specifically pleads the plaintiffs “relied on Facebook’s false

11

assertions in contracting with and using Facebook.” SAC ¶ 267. Plaintiffs, relying on Facebook’s

12

promises, visited numerous websites while logged out without any inkling that Facebook was tracking

13

their post-log out comings and goings. SAC ¶¶ 5, 115 (Davis), 118 (Quinn), 121 (Lentz), 124 (Vickery).

14

Facebook’s argument about the alleged inspecificity of the reliance allegations ignores the

15

governing law permitting generalized reliance claims. See Anthony v. Yahoo, Inc., 421 F. Supp. 2d

16

1257, 1264 (N.D. Cal. 2006) (reliance element not required to meet heightened Rule 9(b) standard) See

17

also Interserve, Inc. v. Fusion Garage PTE, Ltd., 2011 WL 500497, at *3 (N.D. Cal. Feb. 9, 2011).

18

Facebook’s internal emails also support the reliance element at this stage. In re Clorox Consumer Litig.,

19

894 F. Supp. 2d 1224 (N.D. Cal. Aug. 24, 2012), is instructive. There the court found allegations

20

identifying commercials “upon which the Plaintiffs allegedly relied” and their “contents,” when they

21

aired, plus the allegation that plaintiffs purchased in reliance on the advertisements was “detailed

22

information…sufficient to place Clorox on notice of the basis of Plaintiffs’ claims and demonstrates that

23

Plaintiffs are not on a fishing expedition.” Id. at 1234. Just as the Clorox defendant was sufficiently

24

apprised of the claims to be able “to locate and produce videos” of the allegedly false commercials,

25

Facebook was able to produce emails corresponding precisely to the fraud Plaintiffs claim.

26

Facebook’s claim that no “immediate” causal link exists between Facebook’s misrepresentation and

27

Plaintiffs’ injurious behavior” (Def. Memo at 24) ignores the totality of facts showing that absent

28

Facebook’s falsehood, Plaintiffs “‘would not, in all probability, have entered into the contract’” of use
36
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

with Facebook. Clear Solutions, Inc. v. Clear Channel Comm., 365 F. 3d 835, 840 (9th Cir. 2004)

2

(reliance on truth of fraudulent statement need not be sole or predominant factor influencing plaintiff’s

3

behavior, discussing California law’s recognition of “‘highly subjective nature of a causation analysis’”

4

and noting cases saying causation is usually a jury question (quoting Alliance Mortgage Co. v. Rothwell,

5

10 Cal. 4th 1226, 1239 (1995)). That argument also ignores the SAC’s allegations that plaintiffs never

6

consented to Facebook’s tracking (SAC ¶ 125), never changed the default cookie blocking settings that

7

Facebook evaded (SAC ¶ 126), or employed devices to prevent Facebook’s post-log out information

8

gathering. SAC ¶ 127.

9

Plaintiffs have also sufficiently alleged damages (specific and general) proximately resulting

10

from Facebook’s fraud.17 Cause and effect, sufficient for this pleadings stage, is clear. See Interserve,

11

2011 WL 500497, at * 2 (Rule 9(b) purposes do not require heightened damages specificity). Facebook

12

secretly collected, post-log out, plaintiffs’ confidential personal information. See, e.g., SAC ¶¶ 113-115,

13

Davis); 116-118 (Quinn); 119-121 (Lentz); 122-124 (Vickery). That information has economic value on

14

its own (see SAC ¶¶ 129-143), and is further protected by statutory damages under the ECPA, CIPA,

15

and Cal. Penal Code § 502. No more direct cause-and-effect allegation is necessary, under Moncada v.

16

West Coast Quartz Corp., 221 Cal. App. 4th 768, 776 (2013), or any other case.

17

Plaintiffs also sufficiently alleged affirmative falsity. Facebook falsely represented its post-

18

logout cookie practices on its Help Center pages, which plaintiffs were directed to by the Privacy Policy.

19

When the public learned of the practice, Congress held hearings and the FTC required two decades of

20

privacy audits. Facebook admitted it lacked consent to track post-logout. Facebook cannot now argue

21

no falsity. Moreover, having made that false statement Facebook concomitantly had “a duty to disclose”

22

the truth of post log-out tracking. If the telling of a “half-truth” triggers a duty to disclose the full truth,

23

Facebook’s flat-out lie that it does not track post-log out surely compels corrective disclosure. See, e.g.,

24

Barnes & Noble, Inc. v. LSI Corp., 849 F. Supp. 2d 925, 936 (N.D. Cal. 2012) (“where a party

25

volunteers information…‘the telling of a half-truth calculated to deceive is fraud’” (citation omitted);

26

House of Stuart, Inc. v. Whirlpool Corp., 33 F. 3d 58, 3 (9th Cir. 1994) (unpub.) (“Absent a fiduciary

27
28

17

Facebook should be precluded from arguing this issue under the doctrine of collateral estoppel based on the
Ninth Circuit’s ruling in In re Facebook Privacy Litig., 572 Fed. Appx. 494 (9th Cir. 2014).

37
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

relationship, a duty to disclose arises only where there are ‘special circumstances,’ such as when the

2

party in fault creates a false or misleading impression in the first instance.” (citation omitted)).

3

Finally, plaintiffs have also asserted a claim for constructive fraud. For example, in Dealertrack,

4

Inc. v. Huber, 460 F. Supp. 2d 1177 (C.D. Cal. 1177) “a confidential relationship was created” when the

5

parties executed a Mutual Confidentiality Agreement for evaluating information concerning a possible

6

business deal. Reaching Facebook’s adhesive contract with Plaintiffs, the rule is that “‘[a]s a general

7

principle constructive fraud comprises any act, omission, or concealment involving a breach of legal or

8

equitable duty, trust or confidence which results in damage to another even though the conduct is not

9

otherwise fraudulent.’” Id. at 1183 (citation omitted). Factors elevating a contractual relationship into a

10

confidential one are present here. See Portney v. CIBA Vision Corp., 2008 WL 5505517, at * 5 (C. D.

11

Cal. July 17, 2008). Facebook had superior technological “sophistication and bargaining power” and

12

Plaintiffs’ reliance on Facebook’s privacy promises were “‘so substantial as to give rise to equitable

13

concerns.’” Id. (citation omitted). Facebook’s other constructive fraud cases are not to the contrary.18

14

7.

Trespass to Chattels

15

“Under California common law, the tort of trespass to chattel encompasses unauthorized access to

16

a computer system where ‘(1) defendant intentionally and without authorization interfered with plaintiff's

17

possessory interest in the computer system; and (2) defendant's unauthorized use proximately resulted in

18

damage to plaintiff.’” Craigslist Inc. v. 3Taps Inc., 942 F. Supp. 2d 962, 980 (N.D. Cal. 2013) (quoting

19

eBay, Inc. v. Bidder’s Edge, Inc., 100 F. Supp. 2d 1058, 1069-70 (N.D. Cal. 2000) (further citation

20

omitted)). Plaintiffs adequately allege, among other things, that Facebook placed cookies on their

21

computers post-logout without their consent, allowing Facebook to track their activity without permission

22

and interfering with plaintiffs’ use of their computers, and were harmed by the loss of otherwise valuable

23

private information. See SAC ¶¶ 129-43, 270-73. Such claim is proper both for the IE Subclass, members

24

of which never consented to any cookies, and by the entire class to the extent Facebook exceeded the

25

scope of consent. See eBay, 100 F. Supp. 2d at 1069-70 (“California does recognize a trespass claim

26

where the defendant exceeds the scope of consent”).

27

18

28

In addition, whether a confidential relationship exists is generally a fact question, see Patriot Sci.
Corp. v. Korodi, 504 F. Supp. 2d 952, 966 (S.D. Cal. 2007) and plaintiffs’ allegations at minimum
generate that question.
38
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

Defendant misreads Hamidi, which held a plaintiff need only allege that the defendant’s access

2

caused some “actual damage.” Intel Corp. v. Hamidi, 30 Cal. 4th 1342, 1357 (2003) (citing Prosser &

3

Keeton, Torts (5th ed. 1984), § 15). But damage is defined broadly; “who intentionally intermeddles with

4

another’s chattel is subject to liability only if his intermeddling is harmful to the possessor’s materially

5

valuable interest in the physical condition, quality, or value of the chattel, or if the possessor is deprived

6

of the use of the chattel for a substantial amount of time, or some other legally protected interest of the

7

possessor is affected.” Id. at 1351 (quoting Rest. 2d of Torts § 218) (emphasis added). Here, unlike in In

8

re iPhone Application Litigation, 2011 WL 4403963, at *13-14 (N.D. Cal. Sept. 20, 2011), plaintiffs

9

adequately allege ”actual damage” under Hamidi, including that the activity affects Plaintiffs’ “legally

10

protected interest” in the privacy of their communications and website browsing. Defendant’s cookies

11

interfere with the “ordinary and intended operation” of Plaintiffs’ computers, including by circumventing

12

various privacy protections (¶¶ 85-101) and tracking Facebook users when the users intended to log out

13

of Facebook and not be tracked (¶¶ 63-84).

14

What Defendant calls “trivial,” LaCourt v. Specific Media, Inc., 2011 WL 1661532, at *7 (C.D.

15

Cal. Apr. 28, 2011), is a question of fact not susceptible for resolution at this stage. See Coupons, Inc. v.

16

Stottlemire, 2008 WL 3245006, at *6 (N.D. Cal. July 2, 2008) (denying motion to dismiss trespass to

17

chattels claim, finding that the defendants’ “trivial” interference argument “premature” here there were

18

not enough facts for the court to make a determination). If “other operators of parasitic websites widely

19

replicated the defendants’ conduct, the plaintiffs’ business and computer operations would surely suffer.”

20

Atl. Recording Corp. v. Serrano, 2007 WL 46128921, at * 5 (S.D. Cal. Dec. 28, 2007) (citing Hamidi, 30

21

Cal. 4th at 1354-57). Defendant’s conduct, if condoned, would give other “parasitic” websites reason to

22

replicate similar conduct.

23
24
25
26
27
28
39
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1
2
3

V.

CONCLUSION
Plaintiffs request that the Court deny Facebook’s Motion and allow discovery to continue.

Dated: February 18, 2016

4

KIESEL LAW LLP

8

By:
/s/ Paul R. Kiesel
Paul R. Kiesel (SBN 119854)
8648 Wilshire Blvd.
Beverly Hills, CA 90211-2910
Telephone: [phone]
Facsimile: [phone]
[e-mail]

9

Interim Liaison Counsel

5
6
7

10

SILVERMAN, THOMPSON, SLUTKIN &
WHITE LLC

KAPLAN, FOX & KILSHEIMER LLP

16

By: /s/ Stephen G. Grygiel
Stephen G. Grygiel (admitted pro hac vice)
201 N. Charles St., #2600
Baltimore, MD 21201
Telephone [phone]
Facsimile: [phone]
[e-mail]

17

Interim Co-Lead Counsel

By:
/s/ David A. Straite
Frederic S. Fox (admitted pro hac vice)
David A. Straite (admitted pro hac vice)
850 Third Avenue
New York, NY 10022
Telephone: [phone]
Facsimile: [phone]
[e-mail]

11
12
13
14
15

18
19
20
21

Laurence D. King (206423)
Mario Choi (243409)
350 Sansome Street, 4th Floor
San Francisco, CA 94104
Tel.: [phone]
Fax: [phone]
[e-mail]

22
Interim Co-Lead Counsel
23
24
25
26
27
28
40
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD

1

ATTESTATION OF E-FILED SIGNATURE

2

I, David A. Straite, court-appointed interim lead counsel for the proposed Class, am the ECF

3

User whose ID and password are being used to file the foregoing. In compliance with Civil L.R. 5-

4

1(i)(3), I hereby attest that Paul R. Kiesel and Stephen Grygiel have concurred in this filing.

5
6

/s/ David A. Straite

7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
1
PLAINTIFFS’ OPPOSITION TO FACEBOOK’S MOTION TO DISMISS
CONSOLIDATED CASE NO.: 5:12-MD-02314-EJD