In Re FACEBOOK INTERNET TRACKING LITIGATION

Filing 4

NOTICE by Facebook Inc. of Pendency of, action, Ung v. Facebook, Inc., No. 112-cv-217244 (Ung), pending in the Superior Court of the State of California, County of Santa Clara Facebook intends to move the Superior Court for a stay of proceedings in Ung pending resolution this matter. (Attachments: # 1 Exhibit A, # 2 Exhibit B, # 3 Exhibit C)(Gutkin, Jeffrey) (Filed on 3/16/2012) Modified on 3/19/2012 (cv, COURT STAFF).

EXHIBIT B

~
0
0

8

9.
l(f

S{ffiER1QR'CQPRT Of THE ·~T.~J'E OF GA;tiF0RW,A

11

comiTY. -GF;SANtA: CLARA

Case.No.! , 2C V217 2 4 It
1

-""--

£LASS'ACTlON·c OMPLAINT'
C

!4
15,

16 FACEBOO~ INC.
Defendant.

19

,JU.R¥ TRIAL 'DEMANDED
.
, ,.
'
·- ... ··-···
..
,;.

20
21
22
2~

24

is
26
2_1

28
CL:ASS ACTION CQ}..{P;LAINT

"

1

TABLE OF CONTENTS

2
Page
3
CLASS ACTION COMPLAINT ............................................................. ....................................... 1
4

NATURE OF THE ACTION ......................................................................................................... 1
5

JURISDICTION AND VENUE ......... ............................................. ............................................... 1

6
THE PARTIES .................................... .......................................................................... .................. I

7
STATEMENT OF FACTS: ............................................................................................................ 2

8
About Facebook, Its "Like" Button, and Facebook Connect ..................................................... 2
9
Facebook ......................................................... ............................................................................ 2

10
The Facebook "Like" Button ..................................................................... ................................. 3
11

Facebook Connect. .......................... ............................................. ............................................... 3
12
13

Facebook Uses the "Like" button and Facebook Connect To Track Facebook Members and
Non-Members ............................................................................................................................. 4

14 CLASS ACTION ALLEGATIONS ............................................................................................... 7
15

FIRST CAUSE OF ACTION (Violation of Article 1, Section 1 ofthe California Constitution) .. 8

16 SECOND CAUSE OF ACTION (Unjust Enrichment) .......................... ........................................ 9
17 THIRD CAUSE OF ACTION (Violation of the California Invasion of Privacy Act/Unlawful
Wiretaps California Penal Code§ 631 et seq.) ............................................................................... 9

18
FOURTH CAUSE OF ACTION (Negligence per se) ........................................ ...... .................... 10
19

20

PRAYER FOR RELIEF ............................................................................................................... 11
DEMAND FOR JURY TRIAL .................................................................................................... 12

21

22
23

24
25

26
27

28
- 1-

CLASS ACTION COMPLAINT
D0CS\590755v3

1

CLASS ACTION COMPLAINT

2

Plaintiffs allege the following, upon personal knowledge with respect to themselves, and

3

on information and belief derived from, among other things, investigation of counsel and review

4 of public documents, as to all other matters:
5

6

NATURE OF THE ACTION
1.

This is an action on behalf of a class of millions of California Internet users (the

7 "Class," as defined herein) who have visited one or more websites displaying the Facebook
8 "Like" button (as defined below). The action arises from Facebook's surreptitious use of the
9

"Like" button and "Facebook Connect" (described in detail below) to collect and store sensitive,

10 private, and personally identifiable information in violation of Article I, Section 1 of the
11

California Constitution and California Penal Code Section 631 et seq.

The information is

12 secretly collected and stored regardless of whether the website visitor clicks the "Like" button
13

and, in most cases, regardless of whether the Internet user is a Facebook member.

14
15

JURISDICTION AND VENUE
2.

This Court has jurisdiction over these proceedings because defendant Facebook is

16 headquartered in the State of California, transacts business within this state, has committed
17 wrongful acts within the state, and has committed wrongful acts that have caused injuries to
18 persons within the state.
19

3.

V cnue lies in this court because many of those affected by defendants' wrongful

20 conduct reside in this county, and many of the potential witnesses reside and work in this county.
21
22
23

THE PARTIES
4.

Plaintiff Ryan Ung resides in San Francisco. Mr. Ung is a Facebook member who

visited websites that display the Facebook "Like" button including: anime44.com and

24 crunchyroll.corn. Facebook used the "Like" button to track and collect his browsing history and
25

link it to personally identifiable information without his consent using Facebook's "datr tracking

26

cookie," which was found on Mr. Ung's computer. Mr. Ung was not aware that Facebook was

27

collecting his personal information and browsing history and, had he been aware, would not have

28

- 1CLASS ACTION COMPLAINT

1 consented to this. If given the choice, Mr. Ung would have utilized a username as opposed to his
2 real name in connection with his Facebook account.
3

5.

Plaintiff Chi Cheng resides in San Francisco.

Mr. Cheng is a non-Facebook

4 member who visited a website in the Facebook Connect network and subsequently visited a
5 website displaying the Facebook "Like" button. Facebook used the Like Button and Facebook
6 Connect to collect his browsing history and personally identifiable information without his
7 consent using Facebook's "datr tracking cookie," which was found on Mr. Cheng's computer.
8 Mr. Cheng was not aware that Facebook was collecting his personal information and browsing
9 history and, had he been aware, would not have consented to this.
10
11

6.

Plaintiff Alice Rosen resides in Sunnyvale, California. Ms. Rosen is a non-

Facebook member who visited websites in the Facebook Connect network including HSN.com,

12 MSN.com, QVC.com, and ABC.com, and subsequently visited websites displaying the Facebook
13 "Like" button or Facebook Connect including HSN.com, MSN.com, QVC.com, and ABC.com.
14 Facebook used the Like Button and Facebook Connect to collect her browsing history and
15 personally identifiable information without her consent using Facebook's "datr tracking cookie,"
16 which was found on Ms. Rosen's computer. Ms. Rosen was not aware that Facebook was
17 collecting his personal information and browsing history and, had he been aware, would not have
18 consented to this.
19

7.

Defendant Facebook ("hereinafter "Facebook") is a Delaware Corporation that

20 maintains its headquarters in Santa Clara County, California.
21

Facebook conducts business

throughout California, the nation, and internationally.

22

STATEMENT OF FACTS:
About Facebook, Its "Like" Button, and Facebook Connect

23

24 Facebook
25

8.

Facebook is the world's largest social networking website with more than 500

26 million registered users worldwide.
27

28

- 2CLASS ACTION COMPLAINT

1

9.

Facebook requires that Facebook registrants provide their actual names, rather

2 than merely create a "screen name" or "user name" as is commonplace with other, non-social
3

networking website registrations. Facebook then assigns each Facebook member a user ID

4

number that uniquely identifies that member.

5

The Facebook "Li. e" Button
k

6
7

10.

The Facebook "Like" button is an image displaying a thumbs-up symbol

accompanied by the word "Like." Facebook promotes the "Like" button to website owners as

8 follows:
9

10

The Like button lets a user share your content with friends on Facebook. When
the user clicks the Like button on your site, a story appears in the user's friends'
News Feed with a link back to your website.

11

11.

Anyone can implement the " Like" button on their website by adding a computer

12 code, which is available for free and provided by Facebook.

13

12.

Website owners have a substantial financial incentive to include the ''Like" button

14 on their websites because it tends to increase traffic to the website and thereby increase the
15

amount the website owner can charge for displaying advertising on the website. Indeed, more

16 than 2.5 million websites have integrated the Facebook "Like" button. According to comScore,
17 those 2.5 million websites include all of the top ten sports sites, nine of the top ten news sites,
18

nine of the top ten entertainment sites, and 18 of the top 25 retails sites. Overall, 80% of the

19

United States' comScore top websites are fully integrated. Every day, 10,000 more websites add

20 the "Like" button.
21

The "Like" button has become so deeply embedded in our societal

consciousness that we sometimes do not even realize how much it has permeated our culture. It

22 is an indelible part of the "online experience."
23

Facebook Connect

24

13.

25

Facebook Connect enables Facebook members to log onto third-party websites,

applications, mobile devices, and gaming systems with their Facebook identity. While logged

26 on, users can connect with friends via these media and post information and updates to their
27 Facebook profile. Within a year of its launch in December 2008, Facebook Connect was on
28

- 3CLASS ACTION COMPLAINT

1

almost I million websites, and in March 2009 more than 40 million unique visitors of Facebook

2 Connect implementations were counted.
3
4
5

6
7

8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

Facebook Uses the "Like" button and Facebook Connect To Track Facebook Members
and Non-Members

14.

Unbeknownst to Internet users, Facebook uses the "Like" button to track Internet

users as they browse the web and thereby collects private and, in some cases, sensitive
information about them.

Facebook follows Facebook members and, in some cases, non-

members as they browse the Internet, linking their record of each new page visited to Facebook's
records of all the "Like" button- or Faccbook Connect-affiliated pages that the user has visited in
the previous minutes, months, and years. It may thereby construct and update long-term profiles
of what particular users are doing with their web browsers. Anyone who has used the Internet to
seek advice about hemorrhoids, sexually transmitted diseases, abortion, drug rehabilitation,
dementia -

the list goes on and on -

can be reasonably certain that Facebook has tracked at

least some of those visits and, in many cases, identified them with a particular individual, such
that the information can easily be incorporated into a personal profile for use in Facebook's sale
of advertising space to marketers of all sorts, or to be put at the disposal of the United States or
state government agencies. The information is collected even if the website visitor does not
click on the "Like" button. This practice was brought to light by Arnold Roosendaal, whose

work in progress, Facebook Tracks and Traces Everyone: Like This!, is available at
http:/www.ssm.com/abstract=1717563. Mr. Roosendaal's research uncovers Facebook's use of
the "datr tracking cookie" to record web browsing of its members and non-members whenever
they visit web pages enabled with the Like button or Facebook Connect.
15.

Fo1lowing Roosendaal's research, other researchers have reported similar

instances of Facebook's tracking. For example, Nik Cubrilovic has reported that Facebook
collects Facebook members' web browsing data, even after they have logged out of Facebook,
by placing cookies on their computer and sharing their browsing data whenever the user visits a
Facebook-enabled webpage.

- 4CLASS ACTION COMPLAINT

1

2

16.

The tracking mechanism differs depending on whether the Internet user is a

Facebook member or not.

3

Facebook Members: Upon registration, Facebook implants tracking cookies, including

4

the "datr tracking cookie" on the members' computers. Each time the member visits a site

5 displaying the Facebook "Like" button, the updated Facebook cookie information, including the

6 member's most recent browsing history, is sent to Facebook. Facebook can then link the cookie
7 information with the member's unique Facebook identifier, thereby associating the personally
8 sensitive information with the particular user and his account information.

This occurs

9 regardless of whether the Facebook member clicks the "Like" button.

10

If a Facebook member deactivates his or her account through the process Facebook

11

provides, the entire account is nevertheless kept by Facebook, which can continue to link data to

12

the account just as when the account was active. If a user wishes to delete her account entirely,

13

such that Facebook no longer has access to her personal data, the user must make a specific

14 request to Facebook that takes two weeks to process.
15

Non-Facebook Members: Facebook implants tracking cookies, including the "datr

16 tracking cookie," on the computers of non-Facebook members when the non-Facebook member
17 visits one of the million websites in the Facebook Connect network. Thereafter, Facebook's data
18 profile of the non-member is updated each time the non-Facebook member visits a site
19 displaying the Facebook "Like" button, even if the non-member does not click the "Like" button.

20 The data profile is anonymous unless the non-member subsequently joins Facebook, at which
21

point Facebook can associate the previously anonymous "file" with the member and his or her

22 account information, which includes, at a minimum, the member's name and address(es).
23

Facebook thus tracks and collects extensive information about non-Facebook members -

24 individuals who consciously choose not to participate in Facebook.
25

i.e.

If a non-member

subsequently opens an account on Facebook, all of the previously compiled information can be

26 linked to her Facebook account, and, from that time on, all subsequent requests for Facebook
27 content are accompanied by the Facebook identifier unique to the user.

28
-5CLASS ACTION COMPLAINT

1

17.

The personal information collected by Facebook is an asset of the sort that is

2 priced, bought, and sold in discrete units for marketing and other purposes. "Websites and stores
3 can . . . easily buy and sell information on valued visitors with the intention of merging
4 behavioral with demographic and geographic data in ways that will create social categories that
5 advertisers covet and target with ads tailored to them or people like them." Joseph Turow,
6 Jennifer King, Chris Jay Hoofnagle, Amy Bleakley & Michael Hennessy, Americans Reject
7

Tailored

Advertising

and

Three

Activities

that

Enable

8 http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1478214.

It

(Sept.

29,

2009),

The more information that is

9 known about a consumer, the more a company will pay to deliver a precisely targeted
10 advertisement to him or her.
11

See Federal Trade Commission (FTC), Protecting Consumer

Privacy in an Era of Rapid Change, Preliminary Staff Report (Dec. 2010) ("FTC Report"), at 24.

12

18.

Personal data is viewed as currency. "In many instances, consumers pay for free

13 content and services by disclosing their personal information," according to former FTC
14 commissioner Pamela Jones Harbour. FTC Roundtable Series 1 on: Exploring Privacy (Matter
15 No. P095416) (Dec. 7, 2009), at 148, available at http://www.ftc.gov/bcp/
16 workshops/privacyroundtables/PrivacyRoundtable_Dec 2009_Transcript. pdf. In Property,
17 Privacy, and Personal Data, Professor Paul M. Schwartz wrote:
18

20

Personal information is an important currency in the new millennium. The
monetary value of personal data is large and still growing, and corporate America
is moving quickly to profit from this trend. Companies view this information as a
corporate asset and have invested heavily in software that facilitates the collection
of consumer information.

21

Paul M. Schwartz, Property, Privacy, and Personal Data, 117 Harv. L. Rev. 2055, 2056-57

19

22 (2004).
23

19.

On February 28, 2011, the Wall Street Journal published an article under the

24 headline "Web's Hot New Commodity: Privacy," in which it highlighted a company called
25 "Allow Ltd.," one of nearly a dozen companies that offers to sell people's personal information
26 on their behalf and gives them 70% of the sale. An Allow Ltd. customer received a payment of
27 $8.95 for letting Allow tell a credit card company he is shopping for a new credit card. !d.
28

- 6CLASS ACTION COMPLAINT

CLASS ACTION ALLEGAT IONS

1

20.

2

3
4
5
6
7
8
9
10
11

12
13
14
15

16
17

18
19
20
21

Pursuant to California Code of Civil Procedure § 382, Plaintiffs bring this action

on behalf of themselves and two subclasses of Internet users: 1) all Facebook members who,
while residing in California, visited a website displaying the Facebook "Like" button from April
22, 2010, to the date of filing of this complaint; and 2) all non-Facebook members who, while
residing in California, visited a website in the Facebook Connect network and subsequently
visited a website displaying the Facebook "Like" button from April 22, 2010, to the date of the
filing of this complaint. Venue is proper in this Court because defendant Facebook maintains its
principal place of business in this county and the defendants engaged in wrongdoing in this
county.
21.

This Court has jurisdiction over these proceedings because defendant Facebook is

located in the State of California and because Facebook transacts business within this state, has
committed wrongful acts within the state, and has committed wrongful acts that caused injury to
persons within the state.
22.

This action is properly maintainable as a class action.

23.

The Class is so numerous that joinder of all members is impracticable. There are

millions of Internet users in the State of California who have been tracked via the Facebook
"Like" button.
24.

There are questions of law and fact that are common to the Class including, inter

alia, the following:
(a)

interests;

22
23

(b)

26
27

28

whether Plaintiffs had a reasonable expectation of privacy as to the
interests invaded;

24
25

whether Facebook engaged in conduct that invaded Plaintiffs' privacy

(c)

whether the invasion of privacy was serious;

(d)

whether this invasion of privacy caused Plaintiffs to su ffer injury, damage,
loss, or harm;

-7CLASS ACTION COMPLAINT

1

(e)

2

whether Facebook was unjustly enriched by the unauthorized acquisition
of Plaintiffs' personally identifiable information; and

3

(f)

4

25.

whether Facebook violated Cal. Penal Code § 631 et seq.

Plaintiffs will fairly and adequately represent the Class. Plaintiffs are committed

5 to prosecuting this action and has retained competent counsel experienced in litigation of this
6 nature. Plaintiffs' claims are typical of the claims of other members of the Class and Plaintiffs
7 have the same interests as the other members of the Class.

8

26.

Plaintiffs anticipate no difficulty in the management of this litigation.

9

27.

Defendants have acted in a manner that affects Plaintiffs and all Class members

10 alike, thereby making appropriate injunctive, declaratory, and other relief appropriate with
11

respect to the Class as a whole.

12

28.

The prosecution of separate actions by individual members of the Class would

13 create a risk of inconsistent or varying adjudications with respect to individual members of the
14 Class, establish incompatible standards of conduct for defendants or adjudications with respect to
15 individual members of the Class, and could be dispositive of the interests of other members or
16 substantially impair or impede their ability to protect their interests.
17

FIRST CAUSE OF ACTION
(Violation of Article 1, Section 1 of the California Constitution)

18
29.

20

21
22
23

26
27

Article I, Section 1 of the California Constitution states that "All people are by

nature free and independent and have inalienable rights. Among these are enjoying and
defending life and liberty, acquiring, possessing, and protecting property, and pursuing and
obtaining safety, happiness, and privacy." Cal. Const. art. I, § 1.
31.

Plaintiffs had a legally protected interest in their personal Internet browsing

32.

24
25

Plaintiffs incorporate each and every allegation above as if fully set forth herein.

30.

19

Plaintiffs reasonably expected that their browsing history would remam

history.

anonymous.

28

- 8CLASS ACTION COMPLAINT

1

2
3
4

33.

Facebook committed a serious invasion of Plaintiffs' privacy interest by using the

"Like" button and Facebook Connect to secretly track Plaintiffs' website browsing histories.
34.

By the acts, transactions, and courses of conduct alleged herein, Defendant

violated Plaintiffs' inalienable right to privacy.

5

SECOND CAUSE OF ACTION
(Unjust Enrichment)

6
7
8
9
10
11
12

13
14
15
16

17
18
19
20
21
22
23
24
25

26
27

35.

Plaintiffs incorporate each and every allegation above as if fully set forth herein.

36.

Plaintiffs and the Class have conferred a benefit on Facebook. Facebook has

received and retained money belonging to Plaintiffs and the Class as a result of collecting and
storing its users' personal information, which is an asset, and utilizing that information in order
to sell third-parties targeted advertising space on its website.
37.

Facebook appreciates or has knowledge of this benefit.

38.

Facebook collects and utilizes this information without the knowledge and

consent of Internet users.

39.

Under principles of equity and good conscience, Facebook should not be

permitted to retain money belonging to Plaintiffs and the Class that it unjustly received as a
result of its actions.
40.

Plaintiffs and the Class have suffered loss as a direct result of Facebook's

conduct.
41.

Plaintiffs, on their own behalf and on behalf of the Class, seek imposition of a

constructive trust on a restitution of the proceeds Facebook received as a result of its conduct
described herein and attorneys fees and costs pursuant to Cal. Civ. Proc. Code§ 1021.5.

THIRD CAUSE OF ACTION
(Violation of the California Invasion of Privacy Act/Unlawful Wiretaps California Penal
Code§ 631 et seq.)
42.

Plaintiffs incorporate each and every allegation above as if fully set forth herein.

43.

The communications of Plaintiffs with third-party websites were intentionally

obtained by Facebook while in transit over wires, lines, cables, or instruments through the State

28
- 9CLASS ACTION COMPLAINT

1

of California and while they were being sent from or received at a place within California in

2

violation of California Penal Code § 631.

3

4

44.

Facebook willfully, intentionally, and without the consent of Plaintiffs, or any

party to the communications, and in an unauthorized manner using an unauthorized connection,

5 obtained, read, attempted to read and learned, and attempted to learn the contents of such
6

electronic communications of Plaintiffs while they were in transit in or through California in

7 violation of California Penal Code § 631.

8
9
10

45.

Facebook

used

and

communicated

such

illegally

obtained

electronic

communications of Plaintiffs in violation of California Penal Code § 631.

46.

Facebook agreed with and conspired with third-party websites to unlawfully

11

obtain Plaintiffs' communications with the third-party websites in violation of California Penal

12

Code § 631 and aided and abetted and caused the informant to do such acts in violation of

13

California Penal Code § 631.

14

47.

As a direct and proximate result of the above-described conduct by Facebook,

15 Plaintiffs have suffered, and, unless such conduct is enjoined, will continue to suffer, damages in
16 an amount to be proven at trial.
17

18

19

48.

Plaintiffs are entitled to recover three times their actual and/or statutory damages

from Facebook, for such conduct, pursuant to California Penal Code§ 637.2.
49.

Facebook's conduct is causing, and unless enjoined will continue to cause,

20 Plaintiffs great and irreparable injury that cannot be fully compensated for or measured in
21

money. Plaintiffs have no adequate remedy at law and are entitled to preliminary and permanent

22 injunctions prohibiting further use and communication of their unlawfully obtained information,
23

pursuant to California Penal Code§ 637.2(b).

24

FOURTH CAUSE OF ACTION
(Negligence per se)

25

26
27

28

50.

Plaintiffs incorporate each and every allegation above as if fully set forth herein.

51.

Defendant's violation of California Penal Code § 631 resulted in injury to

Plaintiffs and the Class.
- 10CLASS ACTION COMPLAINT

1

52.

The harm Defendant caused to Plaintiffs and the Class are injuries that resulted

2 from the types of occurrences this statute was designed to prevent.
3

53.

Plaintiffs and the Class are the type of persons for whose protection this statute

4 was adopted.
5

54.

Defendant's violation of this statute as described herein resulted in injury to

6 Plaintiffs and the Class. Plaintiffs and the Class received no valuable consideration in exchange
7 for the personal information Facebook collected and employed in its provision of directed
8 advertising to marketers. As discussed herein, Plaintiffs' and the Class' personal information has
9 ascertainable value.
10
11

PRAYER FOR RELIEF
WHEREFORE, Plaintiffs and members of the Class seek relief against defendant as

12 follows:
A.
13

Declaring that this action is properly maintainable as a class action and certifying

14 Plaintiffs as the representatives of the Class.

15
16

B.

Declaring that Facebook's actions, as described herein, violate Article I, Section 1

of the California Constitution.

17

C.

Declaring that Facebook's actions, as described herein, violate California Penal

18
19

20
21

Code § 631 et seq.
D.

Awarding injunctive and other equitable relief as is necessary to protect the

interests of Plaintiffs and the Class including, inter alia, an order prohibiting Facebook from

22 engaging in the wrongful and unlawful acts described herein.
23

24

E.

Disgorgement of all revenue earned from selling or otherwise trading on the

private information obtained from Plaintiffs and the Class via the Facebook " Like" button and

25
Facebook Connect.

26
27
28

F.

Awarding damages, including statutory damages where applicable, to Plaintiffs

and the Class in an amount to be determined at trial.
- 11 CLASS ACTION COMPLAINT

1

G.

2

attorneys fees; and

3

H.

Awarding Plaintiffs and the Class their reasonable litigation expenses and

Awarding such other and further relief as equity and justice may require.

4
DEMAND FOR JURY TRIAL

5

6

Plaintiffs hereby demand trial of their claims by jury to the extent authorized by law.

7 DATED: January 23, 2012
8

MILBERGLLP
JEFF S. WESTERMAN
DAVID E. AZAR

9
10
11

12
13
14
15
16
17
18
19
20
21
22
23
24
25

One California aza
300 S. Grand Avenue, Suite 3900
Los Angeles, CA90071
Telephone: [phone]
Facsimile:[phone]
Email: [e-mail]
[e-mail]
SANFORD P. DUMAIN
PETER E. SEIDMAN
MELISSA RYAN CLARK
MilbergLLP
One Penn Plaza
New York, New York 10119
Telephone: [phone]
Facsimile: [phone]
Email: [e-mail]
[e-mail]
[e-mail]
REESE RICHMAN LLP
MICHAEL R. REESE
KIM RICHMAN
[e-mail]
875 Avenue of the Americas, 18th Floor
New York, New York 10001
Telephone: [phone]
Facsimile: [phone]
Attorneys for Plaintiffs and the Proposed Class

26
27
28
- 12 CLASS ACTION COMPLAINT