Campbell et al v. Facebook Inc.

Filing 1

COMPLAINT against Facebook Inc. ( Filing fee $ 400, receipt number 0971-8262200.). Filed byMatthew Campbell, Michael Hurley. (Attachments: # 1 Civil Cover Sheet)(Sobol, Michael) (Filed on 12/30/2013)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

Michael W. Sobol (State Bar No. 194857)
[e-mail]
Melissa Gardner (State Bar No. 289096)
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: [phone]
Facsimile: 415.956.1008
Rachel Geman
[e-mail]
Nicholas Diamand
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: [phone]
Facsimile: 212.355.9592
Hank Bates (State Bar No. 167688)
[e-mail]
Allen Carney
[e-mail]
David Slade
[e-mail]
CARNEY BATES & PULLIAM, PLLC
11311 Arcade Drive
Little Rock, AR 72212
Telephone: [phone]
Facsimile: 501.312.8505

17
Attorneys for Plaintiffs
18
UNITED STATES DISTRICT COURT
19
NORTHERN DISTRICT OF CALIFORNIA
20
21
22

MATTHEW CAMPBELL and MICHAEL
HURLEY, on behalf of themselves and all
others similarly situated,

Case No. ________
CLASS ACTION COMPLAINT

23
Plaintiffs,
24
v.
25
FACEBOOK, INC.,
26
Defendant.
27
28
CLASS ACTION COMPLAINT
1147096.1

1
2

CLASS ACTION COMPLAINT
I.

INTRODUCTION
1.

3

The right of privacy is a personal and fundamental right in California 1 and the

4

United States. 2 An individual’s privacy is directly implicated by the collection, use, and

5

dissemination of personal information. Defendant Facebook, Inc. (“Facebook” or “the

6

Company”) has systematically violated consumers’ privacy by reading its users’ personal, private

7

Facebook messages without their consent.
2.

8
9

Facebook is a social-networking site that boasts more than one billion users

worldwide, making it the largest online social network in the world.
3.

10

Across the various services it offers, Facebook takes pains to promise a stark

11

distinction in the types of communications it facilitates. Users may choose to communicate

12

publicly via individual Facebook pages, or privately via personal messages and chats. 3
4.

13

Specifically, Facebook describes communication options “[d]epending on whom

14

you’d like to share with.” The options range from the broadest possible audience (a post which

15

the public may see, including via searches on the internet), to posts viewable by small groups of

16

friends, to Facebook messages shared “privately” with a single individual. 4 Facebook touts the

17

privacy of its messaging function as “unprecedented” in terms of user control and the prevention

18

of unwanted contact. 5

19
20
21
22
23
24
25
26
27
28

1

CAL. CONST., Art. I, § 1, adopted as ballot measure in 1972 (“All people are by nature free
and independent and have inalienable rights. Among these are enjoying and defending life and
liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety,
happiness, and privacy.”). See also Am. Acad. of Pediatrics v. Lungren, 16 Cal. 4th 307, 326
(1997) (“[T]he scope and application of the state constitutional right of privacy is broader and
more protective of privacy than the federal constitutional right of privacy as interpreted by the
federal courts.”).
2
Dep’t of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 763 (1989) (“both
the common law and the literal understandings of privacy encompass the individual’s control of
information concerning his or her person”); Whalen v. Roe, 429 U.S. 589, 605 (1977).
3
The distinction between “messages” and “chats” on Facebook is one of timing: chats happen in
real-time and often give the appearance of conversation, whereas messages act more like email.
4
Help Center: Get Started on Facebook: How to Post & Share, Facebook,
https://www.facebook.com/help/333140160100643/.
5
Joel Seligstein, See the Messages that Matter, Facebook,
https://www.facebook.com/notes/facebook/see-the-messages-that-matter/452288242130.
1147096.1

-1-

CLASS ACTION COMPLAINT

1

5.

Contrary to its representations, “private” Facebook messages are systematically

2

intercepted by the Company in an effort to learn the contents of the users’ communications. In

3

the course of the last year, independent security researchers discovered that Facebook reviews the

4

contents of its users’ private Facebook messages for purposes unrelated to the facilitation of

5

message transmission. When a user composes a Facebook message and includes a link to a third

6

party website (a “URL”) 6, the Company scans the content of the Facebook message, follows the

7

enclosed link, and searches for information to profile the message-sender’s web activity.

8
9
10

6.

This practice is not done to facilitate the transmission of users’ communications

via Facebook, but because it enables Facebook to mine user data and profit from those data by
sharing them with third parties – namely, advertisers, marketers, and other data aggregators.

11

7.

Representing to users that the content of Facebook messages is “private” creates

12

an especially profitable opportunity for Facebook, because users who believe they are

13

communicating on a service free from surveillance are likely to reveal facts about themselves that

14

they would not reveal had they known the content was being monitored. Thus, Facebook has

15

positioned itself to acquire pieces of the users’ profiles that are likely unavailable to other data

16

aggregators.

17

8.

Almost the entirety of Facebook’s revenues derive from the sale of third party

18

advertisements, which the Company is able to target towards its users based upon the personal

19

data it mines and stores. In 2011, Facebook earned $2.7 billion from targeted advertising sales.

20

The more otherwise-unavailable information the Company can collect about its users – including

21

the contents of their private communications – the more valuable its advertising capacity.

22

Accordingly, Facebook promotes itself as a rich source of information about the people who use

23

the site, one which allows businesses to “reach the right people,” through selective targeting of

24
25
26
27
28

6

A “URL,” or “uniform resource locator” is also known as a “web address.” It is a character
string that refers to a specific resource or location on the Internet. For example,
“www.nytimes.com” is the URL for the New York Times’ home page.
1147096.1

-2-

CLASS ACTION COMPLAINT

1

potential customers by, for example, “location,” “age,” or “interests” 7 drawn from “activities,

2

education, job titles, Pages they like or groups to which they belong.”8

3

9.

All of Facebook’s activities complained of herein are performed without users’

4

consent. Instead, to increase users’ comfort with the website and, thereby, increase the amount of

5

information they share, the Company makes assurances of user control over privacy settings and

6

messaging options. These assurances affirmatively state that only senders and intended recipients

7

are privy to the contents of their nonpublic communications. In reality, Facebook never intended

8

to provide this level of confidentiality. Instead, Facebook mines any and all transmissions across

9

its network, including those it labels “private,” in order to gather any and all morsels of

10

information it can about its users.

11

10.

Plaintiffs Matthew Campbell and Michael Hurley are Facebook users who, during

12

the relevant Class Period, utilized Facebook’s private messaging function, each relying on

13

representations that these private and personal communications would be viewed only by the

14

sender and the recipient. Instead, where Plaintiffs sent private messages containing URLs,

15

Facebook scanned Plaintiffs’ messages and searched the website identified in the URL for

16

purposes including but not limited to data mining and user profiling.

17

11.

While Facebook hides the extent of this intrusive behavior from its users, it is

18

candid about these activities in its technical guidance for web developers. Web developers are

19

computer programmers who specialize in the development of internet applications, or distributed

20

network applications that are run from a web server 9 to a web browser, 10 over HTTP. 11 Web

21
22
23
24
25
26
27
28

7

Reach the right people, Facebook, https://www.facebook.com/business/a/online-sales/targetyour-ads.
8
How to target Facebook ads, Facebook, https://www.facebook.com/business/a/online-sales/adtargeting-details.
9
A web server can refer to either the hardware (the computer) or the software (the computer
application) that helps deliver web content that can be accessed through the Internet.
10
A web browser is a software application for retrieving, presenting and traversing information
resources on the Internet.
11
HTTP or “Hypertext Transfer Protocol” is a set of standards that allows users of the World
Wide Web to exchange information found on web pages. When an internet user enters “http://” in
front of a web address, this tells the web browser to communicate over HTTP. An HTTP request
is a request sent by a “client” to a “server” via the internet, asking for information contained on
the server. The most common example of this is when a web browser (e.g., Internet Explorer)
sends a request to a server to call up the information associated with a web page’s URL. For
1147096.1

-3-

CLASS ACTION COMPLAINT

1

developers are website administrators to whom Facebook offers or allows access to data created

2

by its users’ web traffic. Some of these web developers work at Facebook, while others work for

3

companies that do business with Facebook, and still others are freelancers or contractors.

4

12.

This class action is brought on behalf of all natural person Facebook users located

5

within the United States who have sent or received private Facebook messages that included a

6

URL in the content of the Facebook message. Upon information and belief, Facebook read these

7

private Facebook messages.

8
9

13.

Such actions, described in detail below, are intentional interceptions of electronic

communications, committed in violation of the Electronic Communications Privacy Act,

10

18 U.S.C. §§ 2510 et seq. (“ECPA”), California’s Invasion of Privacy Act, Cal. Penal Code

11

§§ 630 et seq. (“CIPA”), and the California Unfair Competition Law (“UCL”).

12

14.

Under ECPA, the CIPA, and the UCL, Plaintiffs seek, individually and on behalf

13

of the Class, injunctive and declaratory relief, restitution, statutory damages, an award of

14

reasonable attorney’s fees and other litigation costs reasonably incurred, and any and all

15

additional relief deemed appropriate by this Court.

16

II.

17

THE PARTIES
15.

Plaintiff Matthew Campbell a resident of Pulaski County, Arkansas. He

18

established a Facebook account in or around January 2009, which he has maintained consistently

19

to the present day. He has used Facebook’s private messaging function throughout the relevant

20

Class Period for, inter alia, purposes of conveying messages whose content includes URL links.

21

16.

Plaintiff Michael Hurley is a resident of North Plains, Oregon. He established a

22

Facebook account in or around October 2008, which he has maintained consistently to the present

23

day. He has used Facebook’s private messaging function throughout the relevant class period for,

24

inter alia, purposes of conveying messages whose content contains URL links.

25
26
27
28

instance, where one enters the URL “www.nytimes.com” into the address bar of a web browser
(the client) and hits the “Enter” button on the keyboard, the web browser will send a request to
the New York Times’ server for information associated with the front page of the Times’ website.
The server responds to the request by sending this information to the client, which then displays
the webpage.
1147096.1

-4-

CLASS ACTION COMPLAINT

1

17.

Defendant Facebook, Inc. is an American corporation, headquartered in Menlo

2

Park, California, and incorporated under the laws of the State of Delaware. Facebook owns and

3

operates an online social networking website that allows its users to communicate with each other

4

through the sharing of text, photograph, and video.

5

III.

6

JURISDICTION, VENUE, AND CHOICE OF LAW
18.

Pursuant to 28 U.S.C. § 1331, this Court has original subject matter jurisdiction

7

over the claims of Plaintiffs and the Class that arise under the Electronic Communications

8

Privacy Act of 1986 (“ECPA”), 18 U.S.C. §§ 2510 et seq.

9

19.

Further, this Court has subject matter jurisdiction over this putative nationwide

10

class action pursuant to 28 U.S.C. § 1332, as amended by the Class Action Fairness Act of 2005

11

(“CAFA”), because the matter in controversy exceeds $5,000,000.00, exclusive of interest and

12

costs, and is a class action in which some members of the Class are citizens of states different

13

than Defendant. See 28 U.S.C. § 1332(d)(2)(A). Therefore, both elements of diversity

14

jurisdiction under CAFA are present, and this Court has jurisdiction.

15

20.

This Court has personal jurisdiction over Facebook because Facebook owns and

16

operates a business that is headquartered in California, and because it conducts substantial

17

business throughout California.

18
19

21.

Venue properly lies in this district pursuant to 28 U.S.C. § 1391(b)(1), as

Facebook is headquartered in this district.

20

22.

Venue is also proper in this district pursuant to Facebook’s Statement of Rights

21

and Responsibilities, which governs the agreement between Plaintiffs and Facebook and which

22

states in pertinent part that Plaintiffs “will resolve any claim, cause of action or dispute (claim) . .

23

. relating to . . . Facebook exclusively in a state or federal court located in Santa Clara County.”

24

23.

California law governs the substantive legal issues in the instant matter, as

25

Facebook’s Statement of Rights and Responsibilities further states in pertinent part that “the laws

26

of the State of California will govern . . . any claim that might arise between you and us.”

27
28
1147096.1

-5-

CLASS ACTION COMPLAINT

1

IV.

FACTUAL BACKGROUND

2

A.

Data Aggregation

3

24.

Many websites capitalize on the personal information they can collect from users.

4

Some sell the data directly; some use the data to build valuable profiles of users for sale or their

5

own use.
25.

6

Data aggregation and sale are highly lucrative, both in the United States and

7

abroad. In the United States alone, data-driven marketing was reportedly worth $156 billion in

8

2012, 12 whereas a recent Boston Consulting Group Report puts the numbers in Europe even

9

higher: it estimates a total “digital identity value” of Europeans in 2011 as €315 billion, a number

10

expected to reach €1 trillion by 2020. 13
26.

11

Even though many websites remove personally identifiable information from data

12

when they are initially sold, data aggregators are employing ever more sophisticated cross-

13

referencing and predictive analytics techniques to make more sources of data personally

14

identifiable. 14
27.

15

Widespread dissemination of even de-identified data is already causing problems

16

for internet users. Kate Crawford, a visiting professor at the MIT Center for Civic Media and a

17

principal researcher at Microsoft Research, and Jason Shultz, of the New York University School

18

of Law, explain the privacy risks arising from new methods of data aggregation and analysis:
Even very vague signals online, such as liking things on Facebook,
can generate a detailed picture. As one University of Cambridge
study found, ‘highly sensitive personal attributes,’ such as sexual
orientation, ethnicity, religious and political views, personality
traits, intelligence, use of addictive substances, parental separation,
age and gender were predictable with high degrees of success just
from what people liked online. Thus, racial discrimination could be
applied to prevent some candidates from seeing loans that might be

19
20
21
22
23
12

24
25
26
27
28

US Data Marketing ‘Worth $156 bn,’ Warc (fka World Advertising Research Center) (Oct. 16,
2013),
http://www.warc.com/Content/News/N32077_US_data_marketing_worth_24156bn_.content?CI
D=N32077&ID=6bba593a-da7f-433f-9030-c2c91452cc4b&q=direct+response+advertising&qr=.
13
The Value of Our Digital Identity, The Boston Consulting Group (Nov. 2012),
http://www.libertyglobal.com/PDF/public-policy/The-Value-of-Our-Digital-Identity.pdf.
14
Kate Crawford and Jason Schultz, Big Data and Due Process: Toward a Framework to
Redress Predictive Privacy Harms, New York University School of Law Public Law & Legal
Theory Research Paper Series, Working Paper No. 13-64 at 8 (Oct. 2013),
http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2325784.
1147096.1

-6-

CLASS ACTION COMPLAINT

1

advantageous to them, and housing renters and sellers could
potentially use big data to discriminate based on gender, all while
circumventing the fair housing laws. 15

2
28.

3
4

Information that people never intended to make public can be used against them in

other ways, such as to deny healthcare coverage. According to Crawford and Schulz:
[D]ata about our online behavior generally – such as buying an ebook about breast cancer survival or liking a disease foundation’s
Facebook page – can also reveal information about our health . . .
When these data sets are cross-referenced with traditional health
information, as big data is designed to do, it is possible to generate
a detailed picture about a person’s health, including information a
person may never have disclosed to a health provider. The
combination of data sets and use of predictive analytics can
dramatically increase the amount of data that can be considered
private. 16

5
6
7
8
9
10

29.

In another example of the uses to which data aggregators are putting predictive

11

analytics, a recent New York Times blog post reported that one man saw his American Express

12

credit card limit reduced because, according to American Express, “Other customers who have

13

used their card at establishments where you recently shopped have a poor repayment history with

14

American Express.” 17

15

30.

Even if a company only stores user information, and does not immediately use the

16

data it gleans from users’ private messages to target advertisements or for any purpose directly

17

associated with the individual, it may sell that information at its discretion, and it can be resold by

18

any company that buys it. Companies that acquire user data can retain that information

19

indefinitely and use it for any purpose not prohibited by law or contract.

20

31.

This puts people at risk of crime, discrimination, or embarrassment, and they are

21

powerless to stop it because once a company like Facebook obtains their data, users have no

22

control over subsequent analysis, sale, or other use of the data.

23
24

32.

Widespread dissemination of information about individuals empowers the

government against citizens to a degree well beyond the contemplation of the Fourth

25
26
27
28

15

Id.
Id. at 6.
17
Lily Altavena, What Story Does Your Personal Data Tell?, N.Y. Times, The Learning Network
(Feb. 17, 2013), http://learning.blogs.nytimes.com/2012/02/07/what-story-does-your-personaldata-tell/.
16

1147096.1

-7-

CLASS ACTION COMPLAINT

1

Amendment. Facebook declares that it only provides the stored contents of any account to the

2

government with a warrant, 18 yet it has been reported that the companies that purchase such

3

information can hand it over to government agencies with no probable cause and with no

4

warrant. 19

5

33.

6

Foreign regimes may also gain access to users’ private data after it has been

aggregated by companies like Facebook. 20

7

34.

Furthermore, if companies like Facebook do not have to adhere to terms of their

8

own policies and representations regarding what data they collect, there is no basis for consumer

9

trust. Ultimately, the duplicity alleged herein by entities like Facebook will likely cause

10

consumers to assume that all communications they make are recorded and disseminated,

11

significantly chilling free speech.

12

35.

In response to the threats posed by internet privacy invasions, the Department of

13

Commerce has recently recommended basic principles for internet regulation that align with the

14

goals underlying the CIPA and the ECPA. First articulated by the Department of Health and

15

Human Services more than 30 years ago, they are known as the Fair Information Practice

16

Principles (“FIPPs”). The FIPPs stand for eight relatively straightforward ideas:

17

•

Transparency: Individuals should have clear notice about the data
collection practices involving them.

•

Individual Participation: Individuals should have the right to consent to the
use of their information.

•

Purpose Specification: Data collectors should describe why they need
particular information.

•

Data Minimization: Information should only be collected if it is needed.

18
19
20
21
22
23
18

24
25
26
27
28

Information for Law Enforcement Authorities, Facebook,
https://www.facebook.com/safety/groups/law/guidelines/.
19
American Civil Liberties Union, Focus on Data Aggregation, at 2 (June 2010) (“The federal
government is also a customer of private data companies. It’s cheaper to buy information that’s
already been assimilated; it also avoids warrants or court oversight.”)
20
Repressive regimes like Iran have demonstrated an interest in the online activities of U.S.
citizens. For example, dozens of American Facebook users who posted political messages critical
of Iran have reported that Iranian authorities subsequently questioned and detained their relatives.
Electronic Privacy Information Center, Frequently Asked Questions Regarding EPIC’s Facebook
Complaint, http://epic.org/privacy/socialnet/fbfaq.html.
1147096.1

-8-

CLASS ACTION COMPLAINT

•

Use Limitation: Information collected for one purpose should not be used
for another.

3

•

Data Quality and Integrity: Information should be accurate.

4

•

Security: Information should be kept secure.

5

•

Accountability and Auditing: Data collectors should know who has
accessed information and how it is used.

B.

Facebook

36.

With 1.1 billion users accessing this service on a monthly basis – approximately

1
2

6
7
8

51% of all internet users – Facebook is the world’s largest social media company.
9
37.

The popularity of Facebook hinges upon the ability of its users to communicate

10
with one another. As the Company stated in a Securities and Exchange Commission filing in
11
anticipation of its May 2013 initial public offering or “IPO,” “[p]eople use Facebook to stay
12
connected with their friends and family, to discover what is going on in the world around them,
13
and to share and express what matters to them to the people they care about. . . . We believe that
14
we are at the forefront of enabling faster, easier, and richer communication between people and
15

that Facebook has become an integral part of many of our users’ daily lives.” 21

16
38.

Communications among Facebook users span a continuum, from the publicly

17
viewable to the entirely private. In the Facebook tutorial “Get Started on Facebook,” guidance is
18
offered on how to share or send information via the service, either publicly or privately:
19


20

How to Post & Share


21

How do I share a status or other content on Facebook?

22

Depending on whom you’d like to share with, there are different ways to
share content on Facebook:

23


24
25
26
27
28

Sharing Status Updates and Other Stories

Sharing with a broad audience: Use the share menu that’s located at
the top of your homepage and timeline to let others know what’s on your
mind. You can update your status and share photos, videos, links and
other application content. Things you share will appear as posts on your
timeline, and can appear in your News Feed. To control whether or not

21

Form S-1 Registration Statement for Facebook, Inc., as filed with the Securities and Exchange
Commission, “Prospectus Summary,” at 1 (Feb. 1, 2012),
http://www.sec.gov/Archives/edgar/data/1326801/000119312512034517/d287954ds1.htm.
1147096.1

-9-

CLASS ACTION COMPLAINT

specific people have the option to view your stories, you can change the
privacy settings for each piece of content you post.

1
2



Sharing with a small group of friends: Use the Groups feature to
share content with a select group of people, like family members, your
soccer team or your book club.



Sharing with an individual: You can use the share menu at the top of
a friend’s timeline to write or share something on his or her timeline.
Friends of your friend will also be able to view your post. I f you’d like to

3
4
5

share som ething privately, you can alw ays send som eone a
private m essage. 22

6
7

39.

Thus, Facebook states that its private messaging function is meant to be precisely

8

that: a “private” mechanism for communication between individuals using the Company’s

9

services. Further, Facebook telegraphs through the use of the words “privately” and “private”

10

that when a user sends a private message to another party, only the user and the intended recipient

11

will be privy to the contents of that communication.

12

1.

13

40.

Facebook’s Private Messaging Function

On November 15, 2010, Facebook announced a new, integrated email and

14

messaging service for its users. Combining the functionality of email, chat, SMS, 23 and in-

15

service messaging into a single platform, Facebook’s private messaging service enables Facebook

16

users to communicate directly with specifically chosen individuals, in a single conversation,

17

across devices and through a variety of popular media. 24 Because the messaging service can also

18

serve as an email address, account holders can also use Facebook as a means of sending messages

19

to, and receiving messages from, sources outside the Company’s social media network.

20

41.

Facebook took special pains to tout the privacy features of its new private

21

messaging service. In its rollout announcement, it said “[y]ou can also change your account

22

settings to be even more limited and bounce any emails that aren’t exclusively from friends. This

23

kind of message control is pretty unprecedented and people have been wanting to do this with

24

email (and phone calls) for a long time. ‘Messages’ reverses the approach to preventing

25
26
27
28

22

Help Center: Get Started on Facebook: How to Post & Share (italic and bold emphasis added).
“SMS” is an acronym for “short message service,” commonly known as “text messaging.”
24
See the Messages that Matter
23

1147096.1

- 10 -

CLASS ACTION COMPLAINT

1

unwanted contact. Instead of having to worry about your email address getting out, you’re now

2

in control of who can actually reach you.” 25

3
4

42.

Thus, in Facebook’s inaugural representations of its private messaging service, it

stressed “unprecedented” amounts of (1) user control and (2) user privacy inherent in its product.

5

43.

Where Facebook discusses its private messaging service on its website, it does so

6

in terms that expressly contemplate a private communication, taking place only between the

7

sender and the intended recipient or recipients (e.g., “If you’d like to share something privately,

8

you can always send someone a private message” 26 and “unprecedented” levels of “message

9

control” 27). Additionally, Facebook’s website contains a “Help Center” which assists account

10

holders in utilizing basic functions of the service. In the Help Center, under the heading “How do

11

I send a message” the step-by-step instruction begins with the prompt “To send a private

12

message.” 28 Under the heading “Who can see my message,” Facebook states “You and the

13

people you’re messaging with can view the contents and history of your conversation.” 29

14

44.

All of these representations reflect the promise that only the sender and the

15

recipient or recipients will be privy to the private message’s content, to the exclusion of any other

16

party, including Facebook.

17

2.

18
19

45.

Third-Party Security Researchers Demonstrate that Facebook is
Intercepting and Scanning the Content of “Private” Messages

Facebook’s representations of privacy have been discredited by security

20

researchers over the past year. Facebook has been caught surreptitiously intercepting and

21

scanning the contents of its users’ private messages for a variety of purposes, none of which

22

Facebook discloses in either its Terms of Use or its Privacy Policy.

23
24
25
26
27
28

25

Id. (emphasis added).
Help Center: Get Started on Facebook: How to Post & Share (emphasis added).
27
See the Messages that Matter
28
Help Center: Messaging: Messages: Sending a Message: How Do I Send a Message?,
Facebook, https://www.facebook.com/help/326534794098501/, (emphasis added).
29
Help Center: Messaging: Messages: Settings & Security: Who Can See My Messages?,
Facebook,
https://www.facebook.com/help/212388195458335?sr=16&sid=0ntT7VdfDjw7Y5KSV.
26

1147096.1

- 11 -

CLASS ACTION COMPLAINT

1

46.

On August 27, 2013, a Swiss security firm announced that it had conducted a

2

simple experiment to test how scrupulously the fifty largest social networks, web services, and

3

free email systems (“Web Services”) respected user privacy. 30 The firm, High-Tech Bridge

4

(“HTB”), used a dedicated web server and generated a secret URL for each of the Web Services.

5

HTB then used the private messaging function of each of the Web Services, embedding a unique

6

URL in each message.

7

47.

HTB then monitored its dedicated web server’s logs for all incoming HTTP

8

requests, in order to see whether any of the Web Services would “click” on the test URLs that had

9

been transmitted via private message.

10
11

48.

Facebook was one of the Web Services that was caught scanning URLs despite

such activity remaining undisclosed to the user.

12

49.

Concerning Facebook’s scanning of the contents of privately sent messages,

13

HTB’s Chief Research Officer stated, “there is no way to keep the URL and its content

14

confidential . . . while transferring the URL via social networks.” 31

15

50.

Facebook performs this task to aggregate data on its users for purposes of

16

advertising, marketing and user profiling; specifically, at least in part, in the form of generating

17

“Likes” for web pages, generated via Facebook’s social plugins embedded on websites, thereby

18

monitoring users’ web browsing patterns.

19

3.

20

51.

Facebook’s Social Plugins

In addition to having users interact on its own website, Facebook also provides

21

code for third-party websites to embed, so-called “social plugins.” Facebook explains the social

22

plugin as follows,

23

Alright, so this is how it works. Let’s say you are logged in to
Facebook, but you check out a popular new site. It’s kind of a
bummer, because before you would have to choose between the
social experience of Facebook or the specialized information of a
content site. Ok, well now, if the website has a social plug-in, you
can take your Facebook friends with you and get both. Instead of
having to comb through page after page of article after article to

24
25
26
27
28

30

High-tech Bridge, Social Networks: Can Robots Violate User Privacy? (Aug. 27, 2013),
https://www.htbridge.com/news/social_networks_can_robots_violate_user_privacy.html.
31
Id.
1147096.1

- 12 -

CLASS ACTION COMPLAINT

1

find something that catches your eye, now you can see what your
friends have already enjoyed on a site. And with one click, you can
share an article or a video review with your friends. 32

2
52.

3

The effect of embedding social plugins into third-party websites is that it enables

4

Facebook to extend its data gathering practices, keeping tabs on its users’ behavior even after

5

they log out of Facebook. One of the principal social plugins is the “Like” button commonly

6

found on internet websites. 33 A video tutorial on Facebook’s website states:

7

When someone clicks “Like,” they’re highlighting the things that
are valuable to them and sharing that with their friends. And when
all of this goes to your News Feed, it’s like you have a real time,
super-customized window to the most valuable things on the
Internet. But we understand that many of the things people care
about live outside of Facebook, so we wanted to create a way to
bring your friends with you to other websites. So we created social
plugins. Social plugins extend the things you love about Facebook
to your favorite websites. 34

8
9
10
11
53.

12

In practice, Facebook social plugins serve as an extension of Facebook on the

13

internet at large. In addition to Facebook’s “Like” button at the top of a news article, Facebook’s

14

social plugins can take the form of a sidebar feed noting any friends who have read or

15

recommended the article, or a clickable Facebook icon, as circled below.

16
17
18
19
35

20
21
22

54.

across the world’s largest social network, the Company offers this assurance:

23

When you start to see websites that are customized for you all over
the Internet, you might wonder if everyone else can see it. But it’s
not like that. Although you can see customized information on
other sites, all the information lives on Facebook, and Facebook

24
25
26
27
28

If users are concerned that their extra-Facebook web traffic is being broadcast

32

Understanding Social Plugins, Facebook tutorial video at 0:40 – 1:09 (posted June 7, 2010),
https://www.facebook.com/video/video.php?v=10150210521510484.
33
Id. (listing the “Like” button as one of “the main social plugins.”).
34
Id. at 0:15 – 0:39
35
Somini Sengupta, The Information Gathering Paradox, N.Y. Times, Oct. 26, 2013.
1147096.1

- 13 -

CLASS ACTION COMPLAINT

1

doesn’t share your information with anyone through social plugins.
And each person has full control of what they want to share.
You’re only sharing the information you want to, and you’re only
sharing it with the people you want to share it with. 36

2
3
55.

4

In October 2012, a security researcher published findings in the Wall Street

5

Journal showing that Facebook scans users’ private messages for URLs. 37 When a private

6

message contains a link to a third-party website, and that website has a “Like” social plugin,

7

Facebook registers up to two “Likes” for that web page via the social media plugin. 38
56.

8
9

In this first screenshot, the website set up by the security researcher, Ashkan

Soltani, “ashkansoltani.org/fb_test.html,” has two (2) likes registered to it.

10
11
12
13
14

Soltani also provided the html code for the website:

15
16
17
18
19
20
21
22
23

Soltani then logged into Facebook and sent a message that contained the URL and the text

24

“testing 1 2 3.”

25
26
36

27
28

Understanding Social Plugins, at 1:14 – 1:37 (emphasis added).
Jennifer Valentino-DeVries and Ashkan Soltani, How Private Are Your Private Facebook
Messages?, Wall St. J., Oct. 3, 2012.
38
Id.
37

1147096.1

- 14 -

CLASS ACTION COMPLAINT

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

Finally, Soltani navigated back to his test website to see if the number of “Likes” registered to it
increased, which they did. 39

19
20
21
22
57.

23

The article notes that this practice is described in Facebook’s guidance for

24

developers – administrators of the third-party websites whom Facebook seeks to entice to use

25

social plugins. The developer guidance states that “the number of inbox messages containing” a

26
27
28

39

Indeed, as a result of a technical glitch at the time, Facebook added two “Likes” per URL
instead of one. A video showing Soltani complete this test in real-time can be found as part of the
Digital Trends article reporting on it. See Molly McHugh, Facebook Scans Private Messages for
Brand Page Mentions, Admits a Bug Is Boosting Likes, Digital Trends (Oct. 4, 2012),
http://www.digitaltrends.com/social-media/facebook-scans-private-messages/.
1147096.1

- 15 -

CLASS ACTION COMPLAINT

1

link to a page will count as ‘Likes.’” 40 However, this practice – scanning private messages and

2

doling out “Likes” to websites if a hyperlink is contained therein – is not disclosed anywhere in

3

Facebook’s Privacy Policy.

4

58.

Beyond scanning messages for social plugin purposes, Facebook also has

5

conceded that it uses a combination of software and human screening to comb through private

6

messages and search for criminal activity. 41 Upon information and belief, this practice extends

7

beyond the scanning of URLs and involves a combination of keyword searches, user profiling,

8

and other, “extensive but little discussed technology,” 42 all of which enables Facebook to gather

9

additional private information about its users.

10

59.

As discussed in paragraph 63, the “Like” function is crucial in gathering data

11

points for the profiles Facebook keeps on its users for profit, including for purposes of delivering

12

targeted advertising.

13

60.

The practice, purpose, and effect of scanning users’ private messages, as described

14

herein, are not disclosed by Facebook to its users, and these scans are undertaken without users’

15

consent.

16

61.

The practice, purpose, and effect of scanning users’ private messages, as described

17

herein, are not necessary for the rendition of Facebook’s private messaging service, the

18

protection of Facebook’s rights or property, or the security of Facebook users. These scans are

19

not undertaken in the ordinary course of business of an electronic communication service, as

20

described in 28 U.S.C. § 2510(15).

21

4.

22

62.

Facebook’s Incentive: Mining User Data

As information is shared by its more than one billion unique users, Facebook is

23

provided with sophisticated, exceedingly detailed data profiles. These vast databases of

24

individual user information and behavior, coupled with proprietary analytics algorithms, enable

25
40

26
27
28

Id., citing Facebook.com, Facebook Developers: Social Plugins: Like Button,
https://developers.facebook.com/docs/plugins/like-button/.
41
Joseph Menn, Social Networks Scan For Sexual Predators, With Uneven Results, Reuters (July
12, 2012), http://www.reuters.com/article/2012/07/12/us-usa-internet-predatorsidUSBRE86B05G20120712.
42
Id.
1147096.1

- 16 -

CLASS ACTION COMPLAINT

1

Facebook to surgically place ads throughout users’ accounts based upon the extensive profiles

2

assembled on each and every user. As the Company explains:

3

8

When an advertiser creates an ad, they are given the opportunity to
choose their audience by location, demographics, likes, keywords,
and any other information we receive or can tell about you and
other users. For example, an advertiser can choose to target 18 to 35
year-old women who live in the United States and like basketball.
An advertiser could also choose to target certain topics or
keywords, like “music” or even people who like a particular song or
artist. If you indicate that you are interested in topics, such as by
liking a Page, including topics such as products, brands, religion,
health status, or political views, you may see ads related to those
topics as well.

9

****

10

Sometimes we allow advertisers to target a category of user, like a
“moviegoer” or a “sci-fi fan.” We do this by bundling
characteristics that we believe are related to the category. For
example, if a person “likes” the “Star Trek” Page and mentions
“Star Wars” when they check into a movie theater, we may
conclude that this person is likely to be a sci-fi fan. Advertisers of
sci-fi movies, for example, could ask us to target “sci-fi fans” and
we would target that group, which may include you. Or if you
“like” Pages that are car-related and mention a particular car brand
in a post, we might put you in the “potential car buyer” category
and let a car brand target to that group, which would include you. 43

4
5
6
7

11
12
13
14
15
16

63.

As the above statement by the Company makes clear, “Likes” are essential to

17

Facebook in its creation of data profiles for each of its users. These data profiles in turn enable

18

Facebook to deliver ads with industry-leading accuracy. According to a third-party study,

19

broadly targeted campaigns on Facebook (e.g., adults between the ages of 25 and 49) reach the

20

desired audience with 95% accuracy, compared with an industry average of 72%; for more

21

narrowly targeted campaigns (e.g., females between the ages of 25 and 34), Facebook reaches the

22

desired audience with 90% accuracy, compared to an industry average of just 35%. 44

23
24

64.

In 2009, 2010, and 2011, targeted advertising accounted for 98%, 95%, and 85%,

respectively, of the Company’s revenue. 45

25
26
27
28

43

Data Use Policy, IV. How Advertising and Sponsored Stories Work, Facebook (updated
Dec. 11, 2012), http://www.scribd.com/doc/191118234/Facebook-2.
44
Form S-1 Registration Statement for Facebook, Inc., How We Create Value for Advertisers and
Marketers, 76.
45
Id., Risks Related to Our Business and Industry, 12.
1147096.1

- 17 -

CLASS ACTION COMPLAINT

1

65.

However, as discussed throughout this Complaint, Facebook’s desire to harness

2

the myriad data points of its users has led to overreach and intrusion on the part of the Company

3

as it mines its account holders’ private communications for monetary gain.

4

C.

5

1.

6
7
8

Facebook Employs Devices and/or Technology to Scan, Extract, Acquire, and
Use the Contents of Its Users’ Messages.

66.

Web Crawlers and Social Plugins

Upon information and belief, Facebook uses a software application called a “web

crawler” to scan any URL contained in a user’s private message.

9

67.

These web crawlers perform the automated task of scanning the URL by sending

10

HTTP requests to the server associated with the URL and then seeking various items of

11

information about the web page to which the URL is linked.

12

68.

As discussed in paragraphs 51-54, Facebook has developed items of code called

13

“social plugins,” which can be embedded in third-party websites and, when clicked on by visitors,

14

interact with Facebook.

15

69.

Such social plugins include, among others, the “Like” button. 46

16

70.

Upon information and belief, one of the items of information Facebook’s web

17

crawlers seek is whether or not the web page associated with the URL contains a “Like” button.

18
19

71.

web crawlers transmit this information back to Facebook.

20
21

72.

73.

74.

28

Upon information and belief, Facebook further uses these data to build and refine

user profiles.

26
27

Upon information and belief, Facebook further provides these data to the web page

at issue, in the form of analytical analysis of web traffic to that site by Facebook users.

24
25

Upon information and belief, Facebook then uses these data to register the URL

sent via private message as a “Like” for the web page.

22
23

Upon information and belief, where a web page does contain a “Like button, the

75.

Upon information and belief, Facebook’s interception occurs in transit, in

transmission, and/or in transfer of users’ private messages.
46

Product Docs: Social Plugins, Facebook, https://developers.facebook.com/docs/plugins/.

1147096.1

- 18 -

CLASS ACTION COMPLAINT

1

2.

2
76.

3

Facebook’s Message-Scanning Devices and/or Technology Constitute
Conduct Outside the Scope of the Company’s Ordinary Course of
Business.

None of the practices complained of throughout this complaint are necessary for or

4

incidental to the ability to send or receive private messages – an electronic communication

5

service – across Facebook’s online social network.
77.

6
7

Facebook has the technical capacity to offer its private message service without

intercepting, scanning, and using the content of Plaintiffs’ and Class Members’ private messages.
78.

8

Facebook’s acquisition and use of content from Plaintiffs’ and Class Members’

9

electronic communications, as described in this Complaint, is not necessary for or incidental to

10

the protection of the rights or property of the Company, as provider of the service. Indeed, such

11

activities, as described herein, are outside the ordinary course of business of electronic

12

communication service providers.

13

D.

14

Facebook Fails to Disclose That Its Private Message Processes Read, Acquire,
and Use Private Message Content, in Violation of Its Express Agreements
With Facebook Users.

15

1.

16
79.

17

No user consents to Facebook’s unlawful conduct because Facebook’s
Statement of Rights and Responsibilities and Privacy Policy are silent
on the private-message-scanning processes.

In order to establish a Facebook account, a user must agree to the Company’s

18

Statement of Rights and Responsibilities and its Privacy Policy. Specifically, on Facebook’s

19

main page, it states, “By clicking Sign Up, you agree to our Terms and that you have read our

20

Data Use Policy, including our Cookie Use.” 47 Within this sentence, the word “Terms” contains

21

a hyperlink, leading to Facebook’s “Statement of Rights and Responsibilities;” 48 similarly, the

22

words “Data Use Policy” contain a hyperlink, leading to Facebook’s “Data Use Policy.” 49

23

2.
80.

24
25

28

The Statement of Rights and Responsibilities informs users that
This Statement of Rights and Responsibilities (“Statement,”
“Terms,” or “SRR”) derives from the Facebook Principles, and is
our terms of service that governs our relationship with users and

26
27

Facebook’s Statement of Rights and Responsibilities

47

Facebook, https://www.facebook.com.
Statement of Rights and Responsibilities, Facebook, https://www.facebook.com/legal/terms.
49
Data Use Policy, Facebook, https://www.facebook.com/about/privacy.
48

1147096.1

- 19 -

CLASS ACTION COMPLAINT

1

others who interact with Facebook. By using or accessing
Facebook, you agree to this Statement, as updated from time to time
in accordance with Section 14 below. Additionally, you will find
resources at the end of this document that help you understand how
Facebook works.

2
3
4

(emphasis added).

5

81.

6

is titled “Privacy.” It consists of three sentences:

7

Your privacy is very important to us. We designed our Data Use
Policy50 to make important disclosures about how you can use
Facebook to share with others and how we collect and can use your
content and information. We encourage you to read the Data Use
Policy, and to use it to help you make informed decisions.

8
9
82.

10
11

The very first enumerated section of the Statement of Rights and Responsibilities

The above language incorporates Facebook’s Data Use Policy by reference, and

designates this document as governing the Company’s privacy policy with its users.

12

3.
83.

13

Facebook’s Data Use Policy

The term “message” is found in Facebook’s Data Use Policy (“the Policy”) only

14

nine times, and only once contemplates the Company receiving data related to users’ private

15

messages. Specifically, under the heading “Information we receive and how it is used,” the

16

Company states:

17

Other information we receive about you

18

We also receive other types of information about you:
•

19
20
21

We receive data about you whenever you use or are running
Facebook, such as when you look at another person’s
timeline, send or receive a message, search for a friend or a
Page, click on, view or otherwise interact with things, use a
Facebook mobile app, or make purchases through
Facebook. 51

22
23
24
25
26
27
28

50

As with the disclosure on the main page, “www.facebook.com,” the words “Data Use Policy”
contain a hyperlink leading to https://www.facebook.com/about/privacy/.
51
Data Use Policy: Information we receive and how it is used, Facebook,
https://www.facebook.com/full_data_use_policy. There have been minor revisions to this
language during the class period, not one of which is material to the allegations contained herein.
Prior to November 15, 2013, this language read: “We receive data about you whenever you
interact with Facebook, such as when you look at another person’s timeline, send or receive a
message, search for a friend or a Page, click on, view or otherwise interact with things, use a
Facebook mobile app, or purchase Facebook Credits or make other purchases through Facebook.”
1147096.1

- 20 -

CLASS ACTION COMPLAINT

1
2

84.

Under the section titled “How we use the information we receive,” the Policy

states:

3

We use the information we receive about you in connection with
the services and features we provide to you and other users like
your friends, our partners, the advertisers that purchase ads on the
site, and the developers that build the games, applications, and
websites you use. For example, in addition to helping people see
and find things that you do and share, we may use the information
we receive about you:

4
5
6
7



8
9




10



11



12
13
14


15
16

as part of our efforts to keep Facebook products, services and
integrations safe and secure;
to protect Facebook’s or others’ rights or property;
to provide you with location features and services, like telling
you and your friends when something is going on nearby;
to measure or understand the effectiveness of ads you and
others see, including to deliver relevant ads to you;
to make suggestions to you and other users on Facebook, such
as: suggesting that your friend use our contact importer because
you found friends using it, suggesting that another user add you
as a friend because the user imported the same email address as
you did, or suggesting that your friend tag you in a picture they
have uploaded with you in it; and
for internal operations, including troubleshooting, data analysis,
testing, research and service improvement.
***

17

While you are allowing us to use the information we receive about
you, you always own all of your information. Your trust is
important to us, which is why we don’t share information we
receive about you with others unless we have:

18
19




20
21



22

received your permission;
given you notice, such as by telling you about it in this policy;
or
removed your name or any other personally identifying
information from it.

23
85.

24

These disclosures do not disclose that as a matter of course Facebook scans,

25

mines, and manipulates the content of its users’ private messages, acting in a manner in direct

26

conflict with the assurances it provides to its users regarding the privacy and control they should

27

expect in using Facebook’s services. See ¶¶ 38-44, etc., supra.

28
1147096.1

- 21 -

CLASS ACTION COMPLAINT

1

86.

In contrast to its disclosures to developers discussed in paragraph 57, supra,

2

Facebook’s disclosures to users do not state that Facebook scans URLs transmitted via private

3

message across its social network.

4

87.

In contrast to its disclosures to developers discussed in paragraph 57, supra,

5

Facebook’s disclosures to users do not state that Facebook will register the fact that a URL is

6

communicated privately, via its private message function, as a “Like” for a particular web page.

7

88.

In contrast to its disclosures to developers discussed in paragraph 57, supra,

8

Facebook’s disclosures to users do not state that, when a user sends a URL as part of a private

9

message, this act will become part of Facebook’s data profile of web traffic for the linked-to

10

website.

11

89.

In contrast to its disclosures to developers discussed in paragraph 57, supra,

12

Facebook’s disclosures to users do not state that, when a user sends a URL as part of a private

13

message, this act will become part of Facebook’s data profile of the user.

14

90.

Instead, Facebook misleads users into believing that they have a secure, private

15

mechanism for communication – Facebook’s private messaging function – when, in fact,

16

Facebook intercepts and scans the content and treats portions of that content no differently than a

17

public “Like” or post, broadcast openly across the Internet. Further, the purpose for the invasive

18

scanning of these purportedly “private” messages is not meant for the benefit of users, but rather

19

is a mechanism for Facebook to surreptitiously gather data in an effort to improve its marketing

20

algorithms and increase its ability to profit from data about Facebook users.

21

CLASS ALLEGATIONS

22
23

91.

Rules of Civil Procedure, individually and on behalf of all members of the following Class:

24

All natural person Facebook users located within the United States
who have sent or received private messages where such message
included URLs in the content, from within two years before the
filing of this action up through and including the date of the
judgment in this case.

25
26
27
28

Plaintiffs bring this nationwide class action, pursuant to Rule 23 of the Federal

92.

Excluded from the Class are the following individuals and/or entities: Facebook

and its parents, subsidiaries, affiliates, officers and directors, current or former employees, and
1147096.1

- 22 -

CLASS ACTION COMPLAINT

1

any entity in which Facebook has a controlling interest; all individuals who make a timely

2

election to be excluded from this proceeding using the correct protocol for opting out; any and all

3

federal, state or local governments, including but not limited to their departments, agencies,

4

divisions, bureaus, boards, sections, groups, counsels and/or subdivisions; and all judges assigned

5

to hear any aspect of this litigation, as well as their immediate family members.

6
7

93.

Plaintiffs reserve the right to modify or amend the definition of the proposed Class

before the Court determines whether certification is appropriate.

8

94.

The Class is so numerous that joinder of all members is impracticable. Upon

9

information and belief, there are more than 166 million Facebook account holders in the United

10

States. The number of separate individuals who sent private messages via Facebook, where such

11

message included URLs in the content, within two years before the filing of this action, is likely

12

in the millions, and is identifiable and ascertainable based on Facebook’s records.

13
14

95.

There are questions of law or fact common to the Class. These questions include,

but are not limited to, the following:

15

a.

Whether Facebook intentionally intercepted, endeavored to intercept, or

16

procured any other person to intercept or endeavor to intercept Plaintiffs’ and Class Members’

17

electronic communications sent via Facebook;

18

b.

Whether Facebook intentionally used, or endeavored to use, the contents of

19

Plaintiffs’ and Class Members’ electronic communications sent via Facebook, knowing or having

20

reason to know that the information was obtained in violation of 18 U.S.C. § 2511(1)(d);

21

c.

Whether Facebook acted intentionally in violating privacy rights;

22

d.

Whether Facebook acquired any “contents” of Plaintiffs’ and Class

23

Members’ private messages, within the meaning of 18 U.S.C. § 2510(8);

24
25

e.

Facebook were “electronic communications” within the meaning of 18 U.S.C. § 2510(12);

26
27

Whether Plaintiffs’ and Class Members’ private messages sent via

f.

Whether Facebook used an “electronic, mechanical, or other device,”

within the meaning of 18 U.S.C. § 2510(5);

28

g.
1147096.1

The amount of statutory damages that should be levied against Facebook;
- 23 -

CLASS ACTION COMPLAINT

1

h.

Whether injunctive and/or declaratory relief against Facebook should be

3

i.

Whether Facebook’s conduct was likely to deceive its users;

4

j.

Whether Facebook’s conduct was unlawful; and

5

k.

Whether Plaintiffs and Class Members are entitled to restitution.

2

awarded;

6

96.

Plaintiffs’ claims are typical of the claims of the Class in that Plaintiffs and the

7

Class sent and/or received private messages via Facebook, where such messages contained URLs

8

in the content. In the process, Facebook intercepted, scanned, and acquired the private messages’

9

content, sending HTTP requests to the servers housing the web pages referred to in Plaintiffs’ and

10

Class Members’ private messages. Facebook further used or endeavored to use the contents of

11

Plaintiffs’ and Class Members’ private messages, where the Company found URLs to webpages

12

containing social plugins, manipulating such social plugins to generate “Likes” for web pages and

13

to assemble profiles of users’ web traffic and personal preferences. Plaintiffs and Class Members

14

did not consent to the interception and uses of their private message content, which comprise the

15

basis for this suit. Plaintiffs and Class Members are entitled to declaratory relief, statutory

16

damages, restitution, and injunctive relief as a result of the conduct complained of herein.

17

Moreover, upon information and belief, the conduct complained of herein is systemic. Thus, the

18

representative Plaintiffs, like all other Class Members, face substantial risk of the same injury in

19

the future. The factual basis of Facebook’s conduct is common to all Class Members, and

20

represents a common thread of conduct resulting in injury to all members of the Class. Plaintiffs

21

have suffered the harm alleged and have no interests antagonistic to any other Class Member.

22

97.

Plaintiffs will fairly and adequately protect the interests of the Class. Plaintiffs’

23

interests do not conflict with the interests of the Class Members. Furthermore, Plaintiffs have

24

retained competent counsel experienced in class action litigation. Plaintiffs’ counsel will fairly

25

and adequately protect and represent the interests of the Class. Fed. R. Civ. P. 23(a)(4) and 23(g)

26

are satisfied.

27
28
1147096.1

- 24 -

CLASS ACTION COMPLAINT

1

98.

Plaintiffs assert that pursuant to Fed. R. Civ. P. 23(b)(3), questions of law or fact

2

common to the Class Members predominate over any questions affecting only individual

3

members.

4

99.

A class action is superior to other available methods for the fair and efficient

5

adjudication of this controversy. Arguably no Class Member could afford to seek legal redress

6

individually for the claims alleged herein. Therefore, absent a class action, the Class Members

7

will continue to suffer losses and Facebook’s misconduct will proceed without remedy.

8
9

100.

Even if Class Members themselves could afford such individual litigation, the

court system could not. Given the complex legal and factual issues involved, and considering that

10

the Class could number in the tens of millions or greater, individualized litigation would

11

significantly increase the delay and expense to all parties and to the Court. Individualized

12

litigation would also create the potential for inconsistent or contradictory rulings. By contrast, a

13

class action presents far fewer management difficulties, allows claims to be heard which may

14

otherwise go unheard because of the relative expense of bringing individual lawsuits, and

15

provides the benefits of adjudication, economies of scale and comprehensive supervision by a

16

single court.

17

CAUSES OF ACTION

18

COUNT ONE
(Violations of the Electronic Communications Privacy Act,
18 U.S.C. §§ 2510 et seq.)

19
20

101.

21

stated fully herein.

22

102.

Plaintiffs adopt and incorporate each and every allegation of this complaint as if

Plaintiffs, individually and on behalf of Class Members, assert violations of

23

18 U.S.C. §§ 2511(1)(a) and (1)(d) for Facebook’s unlawful interception and use of Plaintiffs’

24

electronic communications.

25

103.

Facebook, as a corporation, is a “person” pursuant to 18 U.S.C. § 2510(6).

26

104.

Throughout the entirety of the conduct upon which this suit is based, Facebook’s

27

actions have affected interstate commerce. Upon information and belief, the Company has over

28

166 million users in the United States alone, and over one billion users worldwide.
1147096.1

- 25 -

CLASS ACTION COMPLAINT

1

105.

Facebook’s actions are and have been intentional as evidenced by, inter alia, its

2

disclosures to developers and the design and implementation of its private messaging service,

3

web crawlers, and social plugins.

4

106.

Facebook’s actions complained of herein are not necessary practices for providers

5

of electronic communications, nor are they incidental to the act of facilitating private messages

6

across Facebook’s social network.

7

107.

Pursuant to 18 U.S.C. § 2511(1)(a), Facebook intentionally intercepted, intercepts,

8

or endeavored or endeavors to intercept the electronic communications of Plaintiffs and Class

9

Members.

10

108.

Through Facebook’s scanning of users’ private messages, the Company acquired

11

and continues to acquire the substance, purport, and meaning of private messages transmitted to

12

and from Plaintiffs and Class Members.

13

109.

The private messages transmitted to and from Plaintiffs and Class Members via

14

Facebook’s private messaging function are and have been at all relevant times electronic

15

communications.

16

110.

The conduct alleged herein does not occur while the private message is in storage.

17

Rather, Facebook utilizes each accused device for the purpose of acquiring and manipulating

18

content from the message in the course of the message’s transmission.

19

111.

Facebook utilized and continues to utilize one or more devices or technology

20

comprised of an electronic, mechanical, or other device or apparatus to intercept the electronic

21

communications transmitted to and from Plaintiffs and Class Members. Such devices or

22

technology include, but are not limited to, web crawlers and social plugins.

23
24

112.

and users do not use the devices for connection to the facilities.

25
26

Facebook does not furnish the above-referenced devices or technology to its users,

113.

The intercepting devices or technology are not used for the ability to send or

receive electronic communications.

27
28
1147096.1

- 26 -

CLASS ACTION COMPLAINT

1

114.

The devices or technology are not used by Facebook, operating as an electronic

2

communication service, in the ordinary course of business as a provider of an electronic

3

communication service.

4

115.

Facebook’s interception of electronic communications sent by and to Plaintiffs and

5

Class Members (a) for undisclosed purposes; (b) for the purpose of generating “Likes” for third-

6

party websites; (c) for purposes of providing web traffic data to third parties; (d) for purposes of

7

cataloging user data for targeted advertising and building user profiles; (e) for purposes beyond

8

facilitating private messages sent via Facebook; (f) in violation of its user agreements; (g) in

9

violation of its public statements to users; (h) in violation of federal and California law; and (i) in

10

violation of the property rights of Plaintiffs, Class Members, and third parties. These activities

11

are not within the ordinary course of business of a provider of an electronic communication

12

service.

13

116.

Pursuant to 18 U.S.C. § 2511(1)(d), Facebook intentionally used, uses, or

14

endeavored or endeavors to use the contents of Plaintiffs’ and Class Members’ electronic

15

communications while knowing or having reason to know that it obtained the information through

16

the interception of the electronic communication in violation of 18 U.S.C. § 2511(1)(a).

17

117.

Facebook’s interception of and use of the contents of Plaintiffs’ and Class

18

Members’ electronic communications were not performed by an employee engaged in any

19

activity necessary for the rendition of an electronic communication service or for the protection of

20

the rights or property of Facebook.

21
22

118.

communications are not electronic communication services.

23
24

Facebook’s services that are not related to the ability to send and receive electronic

119.

No party to the electronic communications alleged herein consented to Facebook’s

interception or use of the contents of the electronic communications.

25

120.

Facebook intercepts Plaintiffs’ and Class Members’ electronic communications for

26

the purpose of committing a criminal or tortious act in violation of the laws of any state, and as

27

such, it cannot obtain consent pursuant to § 2511(2)(d).

28
1147096.1

- 27 -

CLASS ACTION COMPLAINT

1
2

121.

As a result of Facebook’s violations of § 2511, pursuant to § 2520, Plaintiffs and

the Class Members are entitled to:

3

a.

Preliminary and permanent injunctive relief to require Facebook to fully

4

disclose the extent of its activities, to seek the informed and knowing consent of its users when

5

scanning users’ private messages, and to halt Facebook’s violations;

6

b.

Appropriate declaratory relief;

7

c.

For Plaintiffs and each Class Member, the greater of $100 a day for each

8

day of violation or $10,000; and

9

d.

10

122.

Reasonable attorney’s fees and other litigation costs reasonably incurred.

While certain devices and/or technology have been identified in this Complaint,

11

Plaintiffs reserve the right to assert ECPA violations as to any further devices and/or technology

12

disclosed or those devices and/or technology upon which Facebook provides additional

13

information.

14

COUNT TWO
(Violations of the California Invasion of Privacy Act,
Cal. Penal Code §§ 630, et seq.)

15
16

123.

17

stated fully herein.

18

124.

Plaintiffs adopt and incorporate each and every allegation of this complaint as if

Plaintiffs, individually and on behalf of Class Members, assert violations of the

19

CIPA, Cal. Penal Code §§ 630, et seq., specifically Cal. Penal Code §§ 631(a) and 632, for

20

Facebook’s unlawful interception and scanning of the contents of its users’ private messages.

21

Facebook uses this information about the sender and recipient for purposes of profiling,

22

marketing, and advertising.

23

125.

Cal. Penal Code § 630 provides that “The Legislature hereby declares that

24

advances in science and technology have led to the development of new devices and techniques

25

for the purpose of eavesdropping upon private communications and that the invasion of privacy

26

resulting from the continual and increasing use of such devices and techniques has created a

27

serious threat to the free exercise of personal liberties and cannot be tolerated in a free and

28

civilized society.”
1147096.1

- 28 -

CLASS ACTION COMPLAINT

1

126.

Facebook’s acts in violation of the CIPA occurred in the State of California

2

because those acts resulted from business decisions, practices, and operating policies that

3

Facebook developed, implemented, and utilized in the State of California and which are unlawful

4

and constitute criminal conduct in the state of Facebook’s residence and principal business

5

operations. Facebook’s implementation of its business decisions, practices, and standard ongoing

6

policies that violate the CIPA took place and continue to take place in the State of California.

7

Facebook profited and continues to profit in the State of California as a result of its repeated and

8

systemic violations of the CIPA. Facebook’s unlawful conduct, which occurred in the State of

9

California, harmed and continues to harm Plaintiffs and Class Members. Facebook developed,

10

designed, built, and physically placed in California one or more of the accused devices or

11

technology employed by Facebook to violate the CIPA.

12
13

127.

which included URLs, via Facebook’s services.

14
15

128.

Facebook is not and was not at any time a party to Plaintiffs’ and Class Members’

private messages.

16
17

Plaintiffs and Class Members sent and received private messages, the contents of

129.

The private messages exchanged among Plaintiffs and Class Members are

messages.

18

130.

These messages are communications among Plaintiffs and Class Members.

19

A.

Violations of Cal. Penal Code § 631(a)

20

131.

Pursuant to Cal. Penal Code § 7, Facebook, a corporation, is a “person.”

21

132.

Facebook uses a “machine,” “instrument,” “contrivance,” or “in any other manner”

22

is able to, read or to learn the content or meaning of Plaintiffs’ and Class Members’ private

23

messages.

24
25

133.

Facebook acts willfully when it reads, attempts to read, or learns the content or

meaning of Plaintiffs’ and Class Members’ private messages.

26

134.

Facebook does not have the consent of any party to the communication, or it acts

27

in an unauthorized manner, when it reads, attempts to read, or learns the content or meaning of

28

Plaintiffs’ and Class Members’ private messages.
1147096.1

- 29 -

CLASS ACTION COMPLAINT

1
2

135.

communication.”

3
4

Plaintiffs’ and Class Members’ private messages are “any message, report, or

136.

At the time Facebook reads, attempts to read, or learns the content or meaning of

Plaintiffs’ and Class Members’ private messages, the private messages are in transit.

5

137.

At the time Facebook reads, attempts to read, or learns the content or meaning of

6

Plaintiffs’ and Class Members’ private messages, the private messages are passing over any wire,

7

line, or cable.

8
9

138.

Private messages – coded, written messages sent electronically to remote locations

– are telegraphs within the meaning of the CIPA and this section of CIPA. As such, the wires,

10

lines, cables and/or instruments which carry and facilitate the transmission of Plaintiffs’ and Class

11

Members’ private messages are telegraph wires, lines, cables and/or instruments within the

12

meaning of the CIPA and CIPA § 631(a).

13

139.

Plaintiffs and Class Members do not consent, expressly or impliedly, to

14

Facebook’s eavesdropping upon and recording of their private messages. Facebook does not

15

disclose material information to its users relating to its attempts at, among other things,

16

intercepting, scanning and reading the contents of users’ private messages.

17

140.

There is no knowledge or expectation among Plaintiffs and Class Members

18

regarding the extent of Facebook’s reading of message content, learning about the content or

19

meaning of users’ private messages, the acquisition of such content, the collection of such

20

content, or the manipulation of such content. Each and every one of these actions extends beyond

21

the normal occurrences, requirements, and expectations regarding the facilitation and

22

transmission of Facebook’s private messages.

23

B.

Violations of Cal. Penal Code § 632

24

141.

Pursuant to Cal. Penal Code §§ 7 and 632(b), Facebook, a corporation, is a

25

“person.”

26
27

142.

Cal. Penal Code § 632 prohibits eavesdropping upon or the recording of any

confidential communication, including those occurring by telephone, telegraph or other device,

28
1147096.1

- 30 -

CLASS ACTION COMPLAINT

1

through the use of an amplification or electronic recording device without the consent of all

2

parties to the communication.

3
4

143.

Facebook intentionally and without the consent of any party to the communication

eavesdrops upon and/or records the contents of Plaintiffs’ and Class Members’ private messages.

5

144.

Facebook uses electronic amplifying or recording devices, including its web

6

crawlers and social plugins, to eavesdrop upon and to record Plaintiffs’ and Class Members’

7

private messages, for purposes independent and unrelated to storage.

8
9

145.

Plaintiffs’ and Class Members’ private messages are confidential communications

with specifically identified and designated recipients.

10

146.

At the time Plaintiffs and Class Members transmit private messages via Facebook,

11

their communications are confidential because the communications are confined to those persons

12

specified as recipients in the destination address fields. There neither would nor could be any

13

expectation that a third party, such as Facebook, would act in any manner other than to facilitate

14

the communication of the private message between the sender and the intended recipient or

15

recipients. There certainly would not and could not be any expectation that Facebook – a third

16

party – would scan the contents of the private message in an effort to catalog and manipulate the

17

information contained therein.

18

147.

There is no knowledge or expectation among Plaintiffs and Class Members

19

regarding the extent of Facebook’s reading of users’ private message content, learning about the

20

content or meaning of the private messages, acquiring and collecting the content of such

21

messages, and manipulating the content of such messages – each action being beyond the normal

22

occurrences, requirements, and expectations regarding the facilitation and transmission of

23

Facebook’s private messages.

24
25

148.

among the parties by means of an electronic device that is not a radio.

26
27

Plaintiffs’ and Class Members’ private messages sent via Facebook are carried on

149.

Plaintiffs and Class Members do not consent, expressly or impliedly, to

Facebook’s eavesdropping upon and recording of their private messages. Facebook does not

28
1147096.1

- 31 -

CLASS ACTION COMPLAINT

1

disclose material information to its users relating to its attempts at reading, scanning, acquiring,

2

collecting, and manipulating the contents of users’ private messages.

3

150.

While Plaintiffs have identified certain accused devices and/or technology in this

4

Complaint, Plaintiffs reserve the right to assert violations of Cal. Penal Code §§ 631 and 632 as to

5

any further devices or technology subsequently discovered or any devices or technology upon

6

which Facebook provides additional information.

7

C.

Relief Sought Under Cal. Penal Code § 637.2

8

151.

As a result of Facebook’s violations of Cal. Penal Code §§ 631 and 632, Plaintiffs

9

and the Class are entitled to:

10

a.

Preliminary and permanent injunctive relief to require Facebook to fully

11

disclose the extent of its activities, to seek the informed and knowing consent of its users when

12

scanning users’ private messages, and to halt Facebook’s violations;

13

b.

Appropriate declaratory relief;

14

c.

Monetary relief in the amount set forth in Cal. Penal Code § 637.2(a) for

15

each Class Member; and

16

d.

17

COUNT THREE
(Violations of California’s Unfair Competition Law
California Business & Professions Code § 17200 et seq.)

18
19
20

152.

23

153.

26

Professions Code (“UCL”).
154.

Facebook’s conduct constitutes “unlawful” business acts or practices by virtue of

Defendant’s violation of the Electronic Communications Privacy Act, 18 U.S.C. §§ 2510, et seq.,
Cal. Penal Code §§ 631(a) and 632.

27
28

Facebook’s conduct as alleged herein constitutes unfair, unlawful, or fraudulent

business acts or practices as proscribed by Section 17200, et seq., of the California Business &

24
25

Plaintiffs and Class Members reallege and incorporate by reference every

allegation set forth in the preceding paragraphs as though alleged in this Count.

21
22

Reasonable attorney’s fees and other litigation costs reasonably incurred.

155.

Plaintiffs reasonably relied on Facebook’s representations that Plaintiffs’ private

messages are viewable only by the sender and the recipient, and as a result engaged in “private”
1147096.1

- 32 -

CLASS ACTION COMPLAINT

1

messaging on Facebook. Facebook failed to disclose to Plaintiffs and members of the general

2

public that it systematically reviews and captures the content of, and metadata associated with,

3

Plaintiffs’ private messages. Facebook failed to disclose that it aggregates the content and data of

4

private messages, using it to sell advertising for a profit. Facebook’s Data Use Policy fails to

5

disclose Facebook’s acts or practices, and together with its statements that private messages are

6

viewable only by the sender and the recipient, are likely to deceive members of the public. As a

7

result, Facebook’s conduct constitutes “fraudulent” business acts or practices.

8
9

156.

Plaintiffs have an interest in controlling the disposition and dissemination of their

private messages. Contrary to Plaintiffs’ interests, Facebook exercised control over the content of

10

Plaintiffs’ private messages, exploiting it for sale and profit without Plaintiffs’ consent. As a

11

result, Facebook’s conduct constitutes “unfair” business acts or practices.

12
13

157.

Plaintiffs have suffered injury in fact and lost money or property as a result of

Facebook’s business acts or practices.

14

158.

Plaintiffs and Class Members seek an order to enjoin Facebook from such

15

unlawful, unfair, and fraudulent business acts or practices, and to restore to Plaintiffs and Class

16

Members their interest in money or property that may have been acquired by Facebook by means

17

of unfair competition.

18

JURY DEMANDED

19
20

Pursuant to Federal Rule of Civil Procedure 38, Plaintiffs, individually and on behalf of
the Class they seek to represent, demand a jury on any issue so triable of right by a jury.

21

PRAYER FOR RELIEF

22
23

WHEREFORE, Plaintiffs, on behalf of themselves and all Class Members, request
judgment be entered against Facebook and that the Court grant the following:

24

1.

An order determining that this action may be maintained as a class action under

25

Rule 23 of the Federal Rules of Civil Procedure, that Plaintiffs are proper class representatives,

26

that Plaintiffs’ attorneys be appointed Class counsel pursuant to Rule 23(g) of the Federal Rules

27

of Civil Procedure, and that Class notice be promptly issued;

28
1147096.1

- 33 -

CLASS ACTION COMPLAINT

1

2.

Judgment against Facebook for Plaintiffs’ and Class Members’ asserted causes of

3

3.

Appropriate declaratory relief against Facebook;

4

4.

Preliminary and permanent injunctive relief against Facebook;

5

5.

An award of statutory damages to Plaintiffs and Class Members pursuant to

2

action;

6

18 U.S.C. § 2520, for each, the greater of $100 a day for each day of violation of Count One, or

7

$10,000;

8

6.

9
10

Penal Code § 637.2, for each, the greater of $5,000 or three times the amount of actual damages
sustained by Plaintiffs and Class Members;

11
12

An award of statutory damages to Plaintiffs and Class Members pursuant to Cal.

7.

An award of reasonable attorney’s fees and other litigation costs reasonably

incurred; and

13

8.

Any and all relief to which Plaintiffs and the Class may be entitled.

14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
1147096.1

- 34 -

CLASS ACTION COMPLAINT

1

Dated: December 30, 2013

LIEFF CABRASER HEIMANN & BERNSTEIN, LLP

2
3

By:

4

/s/ Michael W. Sobol
Michael W. Sobol

Michael W. Sobol (State Bar No. 194857)
[e-mail]
Melissa Gardner (State Bar No. 289096)
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: [phone]
Facsimile: 415.956.1008

5
6
7
8
9

Rachel Geman
[e-mail]
Nicholas Diamand
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: [phone]
Facsimile: 212.355.9592

10
11
12
13
14

Hank Bates (State Bar No. 167688)
[e-mail]
Allen Carney
[e-mail]
David Slade
[e-mail]
CARNEY BATES & PULLIAM, PLLC
11311 Arcade Drive
Little Rock, AR 72212
Telephone: [phone]
Facsimile: 501.312.8505

15
16
17
18
19
20

Attorneys for Plaintiffs and the Proposed Class

21
22
23
24
25
26
27
28
1147096.1

- 35 -

CLASS ACTION COMPLAINT