In Re FACEBOOK INTERNET TRACKING LITIGATION

Filing 91

*** POSTED IN ERROR *** please see #93 REDACTED VERSION OF SECOND AMENDED CONSOLIDATED CLASS ACTION COMPLAINT against All Defendants. Filed by Perrin Aikens Davis. (Attachments: #1 Exhibit A, #2 Exhibit B, #3 Exhibit C, #4 Exhibit D, #5 Exhibit E, #6 Exhibit F, #7 Exhibit G, #8 Exhibit H, #9 Exhibit I, #10 Exhibit J, #11 Exhibit K, #12 Exhibit L, #13 Exhibit M, #14 Exhibit N, #15 Exhibit O, #16 Exhibit P, #17 Exhibit Q, #18 Exhibit R, #19 Exhibit S, #20 Exhibit T, #21 Exhibit U, #22 Exhibit V, #23 Exhibit W, #24 Exhibit X, #25 Exhibit Y, #26 Exhibit Z, #27 Exhibit AA, #28 Exhibit BB, #29 Exhibit CC, #30 Exhibit DD, #31 Exhibit EE, #32 Exhibit FF, #33 Exhibit GG, #34 Exhibit HH)(Kiesel, Paul) (Filed on 11/30/2015) Modified on 6/3/2016 (cv, COURT STAFF). Modified on 6/3/2016 (cv, COURT STAFF).

Exhibit HH

1
2

3

J~lL ~ 2

4
DAVI1D` H. Yq~q~AKI
5

Sup rioCC~d o~
gGp~8a
~'°

J. A

6

DEPUTY

rez
'

7
8

SUPERIOR COURT OF CALIFORNIA

9

COUNTY OF SANTA CLARA

10
11
Case No. 1-12-CV-217244

12
13
14

RYAN LING, CHI CHENG,and ALICE ROSEN,
on Behalf of Themselves and All Others Similarly
Situated,

15

ORDER RE: DEMURRER

Plaintiffs,

IC

vs.

17
FACEBOOK,INC.,
18
1~

Defendant.

20
The demurrer to the Complaint filed by defendant Facebook, Inc. came on for hearing

21
22

before the Honorable 3oseph H. Huber on June 19, 2012, at 9:00 a.m. in Department 2. The

23

matter having been submitted, the Court orders as follows:

24

Defendant's rec{uest for judicial notice is DENIED.

25
26

Plaintiffs' request for judicial notice is DENIED.

27
2g

//

Casc No. 1- 12-CV-217244
Order Rc: Dcmurt•cr

l

The Co~n-t finds that Plai~ltiffs Ryan Ung, Chi Cheng, and Alice Rosen (collectively,

2

"Plaintiffs") are not required to separately establish "standing." Rather, Plaintiffs must simply

3

establish the elements of each of their causes of action. Therefore, Defendant's "standing"

4

argument has no merit.

5
6

Defendant argues that Plaintiffs have no privacy interest iii their browsing history. In

7

response, Plaintiffs argue that they have a legally protected privacy interest i►i the whole of their

8

browsing history. As explained in the case of United Stcrte.s v. May~zm~cl, 615 F.3d 544, 5(2

9 (D.C. Cir. 2010):
10
11

Prolonged surveillance reveals types of information not revealed by short-term

12

surveillance, such as what a person does repeatedly, what he does not do, and

13

what he does ensemble. These types of information can each reveal more about a

14

person than does any individual trip viewed in isolation. Repeated visits to a

IS

church, a gym, a bar, or a bookie tell a story not told by any single visit, as does

16

one's not visiting any of these places over the course of a month. The sequence of

17

a person's movements can reveal still more; a single trip to a gynecologist's office

18

tells little about a woman, but that trip followed a few weeks later by a visit to a

19

baby supply store tells a different story. A person who knows all of another's

20

travels can deduce whether he is a weekly church goer, a heavy drinker, a regular

21

at the gym, an unfaithful husband, an outpatient receiving medical treatment, an

22

associate of particular individuals or political groups -- and not just one such fact

23

about a person, but all such facts.

24
25

The t-easoning of this case is persuasive. Eve~l tracking a portion of a person's browsi~lg

26

history, which would include visits to a large number of sites given that Facebook's cookies exi

27

on millions of websites, can pai~lt a comprehensive picture of a person's life. For example,

28

repeated visits to certain websites could show a person has a particular disease, or religious

Case No. I -12-CV-21 7244
Order Re: Demiu•rer

2

1

affiliation, or is contemplating having an abortion, or any number of private facts about a person. ~

2

"Legally recognized privacy interests are generally of two classes:(1) interests in precludia~g the

3

dissemination or misuse of sensitive and confidential infor~~~ation (`informational privacy'); and

4 (2) interests i~l making intimate personal decisions or conducting personal activities without
5~1 observation, intrusion, or interference (`autonomy privacy')." (Hill v. Nntionul Colle~iute
6I Athletic A.s•si~. (1)94) 7 Cal. 4th 1, 35.) Compiling a comprehensive profile of a person through
7'' their web activities necessarily implicates both informational privacy and autonomy privacy.
8'' Accordingly, the Court finds that there is a legally protected privacy interest in a person's
identifiable browsing history.
10
11

However, there is no legally protected privacy interest in anonymous data. (See Loilclo~~

12

v. New Albei-tson's, Inc., 2008 U.S. Dist. LEXIS 76246, 24-25 (S.D. Cal. Sept. 30, 2008).)

13

Therefore, non-Facebook members do not have any privacy right in their browsing data that has

14

not been linked to their identities. Plaintiffs argue that the browsing data of non-Facebook

IS

members can be linked to them if the non-Facebook members ever join Facebook. While that

16

may be true, at this point the browsing history of non-Facebook members is anonymous and is

17

not subject to protection under the right to privacy.

18
19

Defendant contends that Plaintiffs have failed to allege that they lead a reasonable

20

expectation of privacy in their browsing 1listory because Facebook discloses its use of cookies in

21

its Privacy Policy, which is published on its website. The Privacy Policy states, in relevant part:

22
23

Cookie Information. We use "cookies" (small pieces of data we store for an

24

extended period of time on your computer-, mobile phone, or other device) to

25

make Facebook easier to use, to make our advertising better, and to protect both

2C

you and Facebook. For example, we use them to store your login ID (but never

27

your password) to make it easier foi- you to login whenever you come back to

28

Facebook. We also use them to confirm that you are logged into Facebook, 111a

Casc No. 1-12-CV-217244
Ordcr Rc: Dcmurrcr

3

and

1

to know when you are interacting with Facebook Platform

2

websites, our widgets and Share

3

remove or block cookies using the settings in yow~ browser, but in some cases that

4

may impact your ability to use Facebook.

~UttO11S,

1~)~I1C8t1011S

and our advertisements.

You can

5
h

(Declaration of Ana Yang Muller in Support of Defendant Facebook, Inc.'s Demtu•rer to

7

Plaintiffs' Class Action Complaint, Exhibit B.)

8
9
10

First, the Privacy Policy is not the proper subject ofjudicial notice, so it is not properly
before the Court on demu►-rer. Even if the Cow-t were to consider the language of the Privacy
Policy, however, it would not show that Facebook members have consented to having their

12

Internet activity tracked.

13
I4'
The above portion of the Privacy Policy states generally that Facebook uses cookies to
15

store information about users, but it does not make clear the extent of the information Facebook

16

allegedly gathers about each user. According to the allegations of the Complaint, more than 2.5

17

million websites have integrated tl~e Facebook "Like" bUtt011.

18

the "datr tracking cookie" to track members' visits to those websites even if the website visitor

19

does not click on the "Like" button" and even if the Facebook member is logged out of

20

Facebook. (Id., ¶¶ 14-15.) This type of widespread tracking is not apparent fi-om Facebook's

21

Privacy Policy. Although a person might not have any reasonable expectation of privacy from

22

Facebook while interacting with the Facebook website itself, that does not ~1~ean a person would

23

expect Facebook to track all or a large part of the person's Internet activity when not on the

24

actual Facebook website.

~C0111[~Ic1111t, ¶

12.) Facebook uses

25
2C

Defendant asserts that the use of cookies to provide Internet services is a longstanding

27

practice and courts have repeatedly rejected attempts to impose liability for such conduct. While

28

this may be true as to the use of cookies on a single website, Facebook's alleged conduct goes far

Case No. 1-12-CV-217244
Order Rc: Dcm~n-rcr

G~

1

beyond that. Facebook is alleged to have used cookies to track large portions of people's

2

browsing histories across nw»erous other websites so that a profile of each person can be put

3

together. Given the types of info►-mation that this can reveal about a person (as discussed above),

4

the Cou►-t finds that Facebook's alleged conduct constitutes a serious invasio~l of a privacy

5 (interest.
C
7

In sum, Plaintiffs have sufficiently alleged that Defendant's conduct constitutes a serious

8

invasio►~ of a legally protected privacy inte►-est in which there is a reasonable expectation of

9

privacy for Facebook members. Howeve►-, there is no legally protected privacy interest for non-

1~

Facebook members. Accordingly, Defe~ldant~S C~ellllll'I'21' YO the ~t'St C1L1Se Of 1Ct1011 ~V(0~3t1011 C

I1

Article 1, Section 1 of the California Constitution) is OVERRULED as to plaintiff Ryan Ung (a

12

Facebook member) a~ld SUSTAINED WITH 10 DAYS' LEAVE TO AMEND as to plaintiffs

13

Chi Cheng and Alice Rosen (non-Facebook members).

14
15

Plaintiffs' unjust enrichment cause of action is based on Facebook receiving money "as a

16

result of collecting and storing its users' personal information...." (Complaint, ~ 3(.) This

17

allegation shows that the cause of action is essentially a remedy being sought in connection 4vith

18

Facebook's alleged violation of Plaintiffs' right of privacy (i.e. the first cause of action). TIZe

19

proper method to attack an improper remedy is through a motion to strike, not a demw-rer. (See

20

Caliber' Bo~lvtivor•ks, Inc. v. Superior° Coarrt(2005) 134 Cal. App. 4th 365, 385[
"The appropriate

21

procedural device for challenging a portion of a cause of action seeking an improper remedy is a

22

I110t10I1 t0 Stl"I~C~.~~].)

23

Enrichment) is OVERRULED.

Accordingly, Defendant's demurrer to the second cause of action (Unjust

24
25

With regard to the third cause of action (Violatio~i of the California Invasion of Privacy

2C

Act/Unlawful Wiretaps - California Penal Code ~ 631, et sey.), Plaintiffs allege that "[t]he

27

communications of Plaintiffs with third-party websites were intentionally obtained by Facebook

28

while in transit over wires, lines, cables, or instruments through the State of California and while

Casc No. I-12-CV-217244
Ordcr Rc: Dcmurrcr

5

1

they were being sent from o~- received at a place within California. in violation of California Pena

2

Code ~~' 631." (Complaint, ¶ 43.) "Facebook willfully, intentionally, and without the consent of

3

Plaintiffs, or any party to the communications, and in an unauthorized manner using an

4

unauthorized connection, obtained, read, attempted to read and learned, and attempted to learn

5

the COIltelltS Of SUCH elECtl'OIl1C COIll111L1►11C1t1011S Of P~~1lIltlffS W1111e t11e~/ Wel'e 111 tCc111S1t 111 01'

through California in violation of California Penal Code § 631." (Icl., ¶ 44.) "Facebook used
7

COIlllllLll11Cc1teC~ SLICII l~~e~l~ly OUtallleC~ C'IeCtC0111C COIll111U111C1t10I1S Of P~111ltIffS 111 V10~1t1011 Of

8

California Penal Code S 631." (I~l., ¶ 45.)

c~
10

Defendant argues that these vague, ~u~supported, ZIICI COIIC~US01'y ~l~~ef`,71t1O11S 1Pe

11

111SL1fflClellt t0 St1te 1 011111. ~efellC~111t IS COI"1'eCt t~11t COIICIlIS01'y a~~e~at1011S 3T'e 111SL1fflClellt t0

12

survive demu►•rer. (C~n•cini v. Cou~~ty ofAlcu~ie~/u (2008) 164 Cal. App. 4th 629, 650.) Plaintiffs

13

have alleged only legal and factual conclusions and therefore have not sufficiently stated a claim

14

pursuant to Penal Code section 631.

15
16

Even if Plaintiffs included more detailed allegations, however, Plaintiffs would not be

17

able to maintain this cause of action. Section 631 "has been held to apply only to eavesdropping

18

by a third party and not to recording by a participant to a conversation." (Warde« v. Katz» (1979

19

99 Cal. App. 3d 805, 811.)

20
21

Plaintiffs' theory is as follows:

22
23

When a website includes Facebook Third-Party Content on one of its web pages,

24

the page does not actually contain the Facebook Content itself. [] Rather the page

25

contains

26

the Plaintiff's

27

Facebook Content to the browser, to be displayed as part of the page.

28

Accordingly, the Facebook Content is third-party content that is incorporated onto

ll1St1"L1Ct10T1S tI11t,

Case No. 1-12-CV-217244
Order Rc: Dcmurrcr

when a Plaintiff or Class member visits the page, cause

or Class member's browser to ask Facebook to deliver the

6

.

the (first-party) page as the page is loadi~lg, and Facebook is a third party to any
2

communications directly between the Plaintiff or Class member and the web

3

server that hosts the page.

5

(Plaintiffs' Memorandum of Points and Authorities in Opposition to Facebook's Demun-er, p.

C

1):1-9.)

7
Plaintiffs' CIeSCI"I~t10f1 SIIOWS tll~t F1Ce~00k

IS 1CtL11~~y cl ~)~I't1C1~111t ll1 t~le COIlli11L1111C1t10►1

between a plaintiff's or class member's browser and a ~vebsite because Facebook is t-equested to

10

and does deliver information to be displayed on the website. Moreover, Plaintiffs do not make

11

clear how Facebook learns the contents of any communications aside from the information that

12

Facebook itself sends upon request to be displayed as part of web page. Consequently, even if

13

Plaintiffs had included allegations explaining their theory (quoted above), the conduct Facebook

14

is accused of does not violate Penal Code section 631. Accordingly, Defendant's demurrer to the

IS

third cause of action (Violation of tale California Invasion of Privacy Act/U~llawfiil Wiretaps -

16

California Penal Code ~ 631, et sey.) is SUSTAINED WITH 10 DAYS' LEAVE TO AMEND.

17
18

Plaintiffs' fourth cause of action relies on allegations of a violation of Penal Code section

19

C31. (Complaint, ¶ 51.) As discussed above, Plaintiffs have not stated a claim for a violation of

20

Penal Code section 63 I . Therefore, Plaintiffs cannot maintain a cause of action for negligence

21

based on such a violation. Accordingly, Defendant's demurrer to the fourth cause of action

22

(Negligence Per Se) is SUSTAINED WITH 1Q DAYS' LEAVE "I'O AMEND.

23
24
25

Dated:

-!
Eton Jo ph H~Huber
Jude f the Superior Court

26
27
28

Casc No. 1- 12-CV-217244
Ordcr Rc: Dcmurrcr

7